The lookupSecurityDomain/newSecurityDomainCtx need to be synchronized to avoid a race condition with creating a security manager instance and initializing its cache. The referenced forum thread indicates that this can happen in the jca layer which can certainly have mulitple threads all creating connections without the underlying security domain instance being created by more than one.