diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/dataaccess/db/AuthorizationGroupDAO.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/dataaccess/db/AuthorizationGroupDAO.java
index 0f2bcb94012347a2486e348bb299dcb45b29427c..26ae5e5418ca18d9d5ad70a16798fbb845d6eea7 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/dataaccess/db/AuthorizationGroupDAO.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/dataaccess/db/AuthorizationGroupDAO.java
@@ -40,19 +40,25 @@ import ch.systemsx.cisd.openbis.generic.shared.dto.DatabaseInstancePE;
 public class AuthorizationGroupDAO extends AbstractGenericEntityDAO<AuthorizationGroupPE> implements
         IAuthorizationGroupDAO
 {
+    public static final Class<AuthorizationGroupPE> ENTITY_CLASS = AuthorizationGroupPE.class;
+
+    private static final String TABLE_NAME = ENTITY_CLASS.getSimpleName();
+
     private static final Logger operationLog =
             LogFactory.getLogger(LogCategory.OPERATION, AuthorizationGroupDAO.class);
 
     protected AuthorizationGroupDAO(final SessionFactory sessionFactory,
             final DatabaseInstancePE databaseInstance)
     {
-        super(sessionFactory, databaseInstance, AuthorizationGroupPE.class);
+        super(sessionFactory, databaseInstance, ENTITY_CLASS);
     }
 
     public List<AuthorizationGroupPE> list()
     {
         final List<AuthorizationGroupPE> list =
-                cast(getHibernateTemplate().loadAll(AuthorizationGroupPE.class));
+                cast(getHibernateTemplate().find(
+                        String.format("from %s a where a.databaseInstance = ?", TABLE_NAME),
+                        toArray(getDatabaseInstance())));
         if (operationLog.isDebugEnabled())
         {
             operationLog.debug(String.format("%s(): %d authorization group(s) have been found.",
@@ -78,7 +84,7 @@ public class AuthorizationGroupDAO extends AbstractGenericEntityDAO<Authorizatio
 
     public AuthorizationGroupPE tryFindByCode(String code)
     {
-        final Criteria criteria = getSession().createCriteria(AuthorizationGroupPE.class);
+        final Criteria criteria = getSession().createCriteria(ENTITY_CLASS);
         criteria.add(Restrictions.eq("code", CodeConverter.tryToDatabase(code)));
         criteria.add(Restrictions.eq("databaseInstance", getDatabaseInstance()));
         return (AuthorizationGroupPE) criteria.uniqueResult();
diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/dataaccess/db/PersonDAO.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/dataaccess/db/PersonDAO.java
index 48dc667af416f9a756a9a9ae61e66fd922dc170f..801af9b5670539ab7571e2202c9f6cbb91304107 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/dataaccess/db/PersonDAO.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/dataaccess/db/PersonDAO.java
@@ -39,12 +39,13 @@ import ch.systemsx.cisd.openbis.generic.shared.dto.PersonPE;
 /**
  * Implementation of {@link IPersonDAO} for databases.
  * 
- * @author     Franz-Josef Elmer
+ * @author Franz-Josef Elmer
  */
 public final class PersonDAO extends AbstractGenericEntityDAO<PersonPE> implements IPersonDAO
 {
+    private static final Class<PersonPE> ENTITY_CLASS = PersonPE.class;
 
-    private final static Class<PersonPE> ENTITY_CLASS = PersonPE.class;
+    private static final String TABLE_NAME = ENTITY_CLASS.getSimpleName();
 
     /**
      * This logger does not output any SQL statement. If you want to do so, you had better set an
@@ -112,7 +113,7 @@ public final class PersonDAO extends AbstractGenericEntityDAO<PersonPE> implemen
         final List<PersonPE> persons =
                 cast(getHibernateTemplate().find(
                         String.format("from %s p where p.userId = ? "
-                                + "and p.databaseInstance = ?", ENTITY_CLASS.getSimpleName()),
+                                + "and p.databaseInstance = ?", TABLE_NAME),
                         toArray(userId, getDatabaseInstance())));
         final PersonPE person = tryFindEntity(persons, "persons", userId);
         if (operationLog.isDebugEnabled())
@@ -127,8 +128,8 @@ public final class PersonDAO extends AbstractGenericEntityDAO<PersonPE> implemen
     {
         final List<PersonPE> list =
                 cast(getHibernateTemplate().find(
-                        String.format("from %s p where p.databaseInstance = ?", ENTITY_CLASS
-                                .getSimpleName()), toArray(getDatabaseInstance())));
+                        String.format("from %s p where p.databaseInstance = ?", TABLE_NAME),
+                        toArray(getDatabaseInstance())));
         if (operationLog.isDebugEnabled())
         {
             operationLog.debug(String.format("%s(): %d person(s) have been found.", MethodUtils
diff --git a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/dataaccess/db/RoleAssignmentDAO.java b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/dataaccess/db/RoleAssignmentDAO.java
index 326e040dfbb23a0f15404d135a656c134d65e746..c553901306b0d26e0eb76eca7b9616e00f7474b6 100644
--- a/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/dataaccess/db/RoleAssignmentDAO.java
+++ b/openbis/source/java/ch/systemsx/cisd/openbis/generic/server/dataaccess/db/RoleAssignmentDAO.java
@@ -51,7 +51,7 @@ public final class RoleAssignmentDAO extends AbstractGenericEntityDAO<RoleAssign
 
     private static final String PERSON_INTERNAL_USER_ID = "personInternal.userId";
 
-    public final static Class<RoleAssignmentPE> ENTITY_CLASS = RoleAssignmentPE.class;
+    public static final Class<RoleAssignmentPE> ENTITY_CLASS = RoleAssignmentPE.class;
 
     private static final String TABLE_NAME = ENTITY_CLASS.getSimpleName();
 
@@ -73,7 +73,13 @@ public final class RoleAssignmentDAO extends AbstractGenericEntityDAO<RoleAssign
 
     public final List<RoleAssignmentPE> listRoleAssignments()
     {
-        final List<RoleAssignmentPE> list = cast(getHibernateTemplate().loadAll(ENTITY_CLASS));
+        // returns roles connected directly or indirectly (through group) to current db instance
+        final List<RoleAssignmentPE> list =
+                cast(getHibernateTemplate().find(
+                        String.format("select r from %s r left join r.databaseInstance ri"
+                                + " left join r.group g left join g.databaseInstance gi"
+                                + " where ri = ? or (ri is null and gi = ?)", TABLE_NAME),
+                        toArray(getDatabaseInstance(), getDatabaseInstance())));
         if (operationLog.isDebugEnabled())
         {
             operationLog.debug(String.format("%s(): %d role assignment(s) have been found.",