btw - the userid your testing with, how many groups does it belong to ? how many entries in the tokencache ?