Pretty sure that synchronized block doesn't do what the description says, at least not for all ticket registries. The ones that work in memory may be safe, but the ones that rehydrate the ticket from a serialized form would produce multiple, distinct instances here. I would think we'd want to simply synchronize CentralAuthenticationService#destroyTicketGrantingTicket. We'll lose some concurrency, but I prefer safe, simple code to fast without compelling evidence of a performance problem.