diff --git a/demoiselle-core/src/main/java/org/demoiselle/jee/core/interfaces/security/DemoisellePrincipal.java b/demoiselle-core/src/main/java/org/demoiselle/jee/core/interfaces/security/DemoisellePrincipal.java
index 92ca068..b89ece9 100644
--- a/demoiselle-core/src/main/java/org/demoiselle/jee/core/interfaces/security/DemoisellePrincipal.java
+++ b/demoiselle-core/src/main/java/org/demoiselle/jee/core/interfaces/security/DemoisellePrincipal.java
@@ -28,4 +28,6 @@ public interface DemoisellePrincipal extends Principal {
     public Map<String, String> getPermissions();
 
     public void setPermissions(Map<String, String> permissions);
+
+    public DemoisellePrincipal clone();
 }
diff --git a/demoiselle-security-jwt/src/main/java/org/demoiselle/jee/security/jwt/impl/DemoisellePrincipalImpl.java b/demoiselle-security-jwt/src/main/java/org/demoiselle/jee/security/jwt/impl/DemoisellePrincipalImpl.java
deleted file mode 100644
index c70a217..0000000
--- a/demoiselle-security-jwt/src/main/java/org/demoiselle/jee/security/jwt/impl/DemoisellePrincipalImpl.java
+++ /dev/null
@@ -1,99 +0,0 @@
-/*
- * Demoiselle Framework
- *
- * License: GNU Lesser General Public License (LGPL), version 3 or later.
- * See the lgpl.txt file in the root directory or <https://www.gnu.org/licenses/lgpl.html>.
- */
-package org.demoiselle.jee.security.jwt.impl;
-
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import javax.enterprise.context.ApplicationScoped;
-import javax.enterprise.context.Dependent;
-import javax.enterprise.context.RequestScoped;
-import org.demoiselle.jee.core.interfaces.security.DemoisellePrincipal;
-
-/**
- *
- * @author 70744416353
- */
-@RequestScoped
-public class DemoisellePrincipalImpl implements DemoisellePrincipal {
-
-    private String id;
-    private String name;
-    private List<String> roles;
-    private Map<String, String> permissions;
-
-    @Override
-    public String getId() {
-        return id;
-    }
-
-    @Override
-    public void setId(String id) {
-        this.id = id;
-    }
-
-    @Override
-    public String getName() {
-        return name;
-    }
-
-    @Override
-    public void setName(String name) {
-        this.name = name;
-    }
-
-    @Override
-    public List<String> getRoles() {
-        return roles;
-    }
-
-    @Override
-    public void setRoles(List<String> roles) {
-        this.roles = roles;
-    }
-
-    @Override
-    public Map<String, String> getPermissions() {
-        return permissions;
-    }
-
-    @Override
-    public void setPermissions(Map<String, String> permissions) {
-        this.permissions = permissions;
-    }
-
-    @Override
-    public int hashCode() {
-        int hash = 7;
-        hash = 37 * hash + Objects.hashCode(this.id);
-        return hash;
-    }
-
-    @Override
-    public boolean equals(Object obj) {
-        if (this == obj) {
-            return true;
-        }
-        if (obj == null) {
-            return false;
-        }
-        if (getClass() != obj.getClass()) {
-            return false;
-        }
-        final DemoisellePrincipalImpl other = (DemoisellePrincipalImpl) obj;
-        if (!Objects.equals(this.id, other.id)) {
-            return false;
-        }
-        return true;
-    }
-
-    @Override
-    public String toString() {
-        return "DemoisellePrincipal{" + "id=" + id + ", name=" + name + ", roles=" + roles + ", permissions=" + permissions + '}';
-    }
-
-}
diff --git a/demoiselle-security-token/src/main/java/org/demoiselle/jee/security/token/impl/DemoisellePrincipalImpl.java b/demoiselle-security-token/src/main/java/org/demoiselle/jee/security/token/impl/DemoisellePrincipalImpl.java
deleted file mode 100644
index e39dcd8..0000000
--- a/demoiselle-security-token/src/main/java/org/demoiselle/jee/security/token/impl/DemoisellePrincipalImpl.java
+++ /dev/null
@@ -1,97 +0,0 @@
-/*
- * Demoiselle Framework
- *
- * License: GNU Lesser General Public License (LGPL), version 3 or later.
- * See the lgpl.txt file in the root directory or <https://www.gnu.org/licenses/lgpl.html>.
- */
-package org.demoiselle.jee.security.token.impl;
-
-import java.util.List;
-import java.util.Map;
-import java.util.Objects;
-import javax.enterprise.context.Dependent;
-import org.demoiselle.jee.core.interfaces.security.DemoisellePrincipal;
-
-/**
- *
- * @author 70744416353
- */
-@Dependent
-public class DemoisellePrincipalImpl implements DemoisellePrincipal {
-
-    private String id;
-    private String name;
-    private List<String> roles;
-    private Map<String, String> permissions;
-
-    @Override
-    public String getId() {
-        return id;
-    }
-
-    @Override
-    public void setId(String id) {
-        this.id = id;
-    }
-
-    @Override
-    public String getName() {
-        return name;
-    }
-
-    @Override
-    public void setName(String name) {
-        this.name = name;
-    }
-
-    @Override
-    public List<String> getRoles() {
-        return roles;
-    }
-
-    @Override
-    public void setRoles(List<String> roles) {
-        this.roles = roles;
-    }
-
-    @Override
-    public Map<String, String> getPermissions() {
-        return permissions;
-    }
-
-    @Override
-    public void setPermissions(Map<String, String> permissions) {
-        this.permissions = permissions;
-    }
-
-    @Override
-    public int hashCode() {
-        int hash = 7;
-        hash = 37 * hash + Objects.hashCode(this.id);
-        return hash;
-    }
-
-    @Override
-    public boolean equals(Object obj) {
-        if (this == obj) {
-            return true;
-        }
-        if (obj == null) {
-            return false;
-        }
-        if (getClass() != obj.getClass()) {
-            return false;
-        }
-        final DemoisellePrincipalImpl other = (DemoisellePrincipalImpl) obj;
-        if (!Objects.equals(this.id, other.id)) {
-            return false;
-        }
-        return true;
-    }
-
-    @Override
-    public String toString() {
-        return "DemoisellePrincipal{" + "id=" + id + ", name=" + name + ", roles=" + roles + ", permissions=" + permissions + '}';
-    }
-
-}
diff --git a/demoiselle-security-token/src/main/java/org/demoiselle/jee/security/token/impl/TokensManagerImpl.java b/demoiselle-security-token/src/main/java/org/demoiselle/jee/security/token/impl/TokensManagerImpl.java
index 8afa5f4..e73a384 100644
--- a/demoiselle-security-token/src/main/java/org/demoiselle/jee/security/token/impl/TokensManagerImpl.java
+++ b/demoiselle-security-token/src/main/java/org/demoiselle/jee/security/token/impl/TokensManagerImpl.java
@@ -5,15 +5,11 @@
  */
 package org.demoiselle.jee.security.token.impl;
 
-import java.util.Map;
-import java.util.UUID;
 import static java.util.UUID.randomUUID;
 import java.util.concurrent.ConcurrentHashMap;
 import java.util.logging.Logger;
-import javax.enterprise.context.ApplicationScoped;
 import javax.enterprise.context.Dependent;
 import javax.inject.Inject;
-import javax.ws.rs.ApplicationPath;
 import org.demoiselle.jee.core.interfaces.security.DemoisellePrincipal;
 import org.demoiselle.jee.core.interfaces.security.Token;
 import org.demoiselle.jee.core.interfaces.security.TokensManager;
@@ -22,10 +18,10 @@ import org.demoiselle.jee.core.interfaces.security.TokensManager;
  *
  * @author 70744416353
  */
-@ApplicationScoped
+@Dependent
 public class TokensManagerImpl implements TokensManager {
 
-    private ConcurrentHashMap<String, DemoisellePrincipal> repo = new ConcurrentHashMap<>();
+    private static ConcurrentHashMap<String, DemoisellePrincipal> repo = new ConcurrentHashMap<>();
 
     @Inject
     private Logger logger;
@@ -51,7 +47,7 @@ public class TokensManagerImpl implements TokensManager {
 
         if (token.getKey() == null) {
             String value = randomUUID().toString();
-            repo.putIfAbsent(value, user);
+            repo.putIfAbsent(value, user.clone());
             token.setKey(value);
         }
 
diff --git a/demoiselle-security/src/main/java/org/demoiselle/jee/security/impl/DemoisellePrincipalImpl.java b/demoiselle-security/src/main/java/org/demoiselle/jee/security/impl/DemoisellePrincipalImpl.java
new file mode 100644
index 0000000..54b5bff
--- /dev/null
+++ b/demoiselle-security/src/main/java/org/demoiselle/jee/security/impl/DemoisellePrincipalImpl.java
@@ -0,0 +1,111 @@
+/*
+ * Demoiselle Framework
+ *
+ * License: GNU Lesser General Public License (LGPL), version 3 or later.
+ * See the lgpl.txt file in the root directory or <https://www.gnu.org/licenses/lgpl.html>.
+ */
+package org.demoiselle.jee.security.impl;
+
+import java.util.List;
+import java.util.Map;
+import java.util.Objects;
+import java.util.logging.Level;
+import java.util.logging.Logger;
+import javax.enterprise.context.ApplicationScoped;
+import javax.enterprise.context.Dependent;
+import javax.enterprise.context.RequestScoped;
+import org.demoiselle.jee.core.interfaces.security.DemoisellePrincipal;
+
+/**
+ *
+ * @author 70744416353
+ */
+@RequestScoped
+public class DemoisellePrincipalImpl implements DemoisellePrincipal, Cloneable {
+
+    private String id;
+    private String name;
+    private List<String> roles;
+    private Map<String, String> permissions;
+
+    @Override
+    public String getId() {
+        return id;
+    }
+
+    @Override
+    public void setId(String id) {
+        this.id = id;
+    }
+
+    @Override
+    public String getName() {
+        return name;
+    }
+
+    @Override
+    public void setName(String name) {
+        this.name = name;
+    }
+
+    @Override
+    public List<String> getRoles() {
+        return roles;
+    }
+
+    @Override
+    public void setRoles(List<String> roles) {
+        this.roles = roles;
+    }
+
+    @Override
+    public Map<String, String> getPermissions() {
+        return permissions;
+    }
+
+    @Override
+    public void setPermissions(Map<String, String> permissions) {
+        this.permissions = permissions;
+    }
+
+    @Override
+    public int hashCode() {
+        int hash = 7;
+        hash = 37 * hash + Objects.hashCode(this.id);
+        return hash;
+    }
+
+    @Override
+    public boolean equals(Object obj) {
+        if (this == obj) {
+            return true;
+        }
+        if (obj == null) {
+            return false;
+        }
+        if (getClass() != obj.getClass()) {
+            return false;
+        }
+        final DemoisellePrincipalImpl other = (DemoisellePrincipalImpl) obj;
+        if (!Objects.equals(this.id, other.id)) {
+            return false;
+        }
+        return true;
+    }
+
+    @Override
+    public String toString() {
+        return "DemoisellePrincipal{" + "id=" + id + ", name=" + name + ", roles=" + roles + ", permissions=" + permissions + '}';
+    }
+
+    @Override
+    public DemoisellePrincipal clone() {
+        try {
+            return (DemoisellePrincipal) super.clone();
+        } catch (CloneNotSupportedException ex) {
+            Logger.getLogger(DemoisellePrincipalImpl.class.getName()).log(Level.SEVERE, null, ex);
+        }
+        return null;
+    }
+
+}
--
libgit2 0.21.2