diff --git a/security/src/main/java/org/genesys/blocks/oauth/model/OAuthClient.java b/security/src/main/java/org/genesys/blocks/oauth/model/OAuthClient.java
index c1af729947081d76c1cb0acf335fbc07f2aabb01..aa0433685b4db0233f3ada67c238e56a054b4bc1 100644
--- a/security/src/main/java/org/genesys/blocks/oauth/model/OAuthClient.java
+++ b/security/src/main/java/org/genesys/blocks/oauth/model/OAuthClient.java
@@ -29,6 +29,7 @@ import javax.persistence.ElementCollection;
 import javax.persistence.Entity;
 import javax.persistence.EnumType;
 import javax.persistence.Enumerated;
+import javax.persistence.FetchType;
 import javax.persistence.JoinColumn;
 import javax.persistence.Lob;
 import javax.persistence.PostLoad;
@@ -127,7 +128,7 @@ public class OAuthClient extends AclSid implements ClientDetails, Copyable<OAuth
 
 	/** The roles. */
 	@JsonView(JsonViews.Protected.class)
-	@ElementCollection
+	@ElementCollection(fetch = FetchType.EAGER)
 	@Enumerated(EnumType.STRING)
 	@CollectionTable(name = "oauthclientrole", joinColumns = @JoinColumn(name = "clientId"))
 	@Column(name = "oauthclientrole")
diff --git a/security/src/main/java/org/genesys/blocks/security/service/impl/CustomAclServiceImpl.java b/security/src/main/java/org/genesys/blocks/security/service/impl/CustomAclServiceImpl.java
index e063fd159511da5a84c69d8dca10ce80082387c7..1000a13d27ec36a773f2373066c678b8d26c03c4 100644
--- a/security/src/main/java/org/genesys/blocks/security/service/impl/CustomAclServiceImpl.java
+++ b/security/src/main/java/org/genesys/blocks/security/service/impl/CustomAclServiceImpl.java
@@ -394,6 +394,8 @@ public class CustomAclServiceImpl implements CustomAclService {
 		if (objectIdentity != null) {
 			objectIdentity = getObjectIdentity(objectIdentity.getId());
 			AclObjectIdentityExt _aclObjectIdentity = new AclObjectIdentityExt(objectIdentity);
+			
+			// lazy load SIDs for AclEntries
 			objectIdentity.getAclEntries().forEach(entry -> entry.getAclSid().getId());
 
 			List<AclEntry> inheritedEntries = inherited(objectIdentity.getParentObject(), new ArrayList<>(), new HashSet<>());
@@ -410,6 +412,10 @@ public class CustomAclServiceImpl implements CustomAclService {
 		if (objectIdentity == null || handled.contains(objectIdentity)) {
 			return aclEntries;
 		}
+
+		// lazy load SIDs for AclEntries
+		objectIdentity.getAclEntries().forEach(entry -> entry.getAclSid().getId());
+		
 		aclEntries.addAll(objectIdentity.getAclEntries());
 		handled.add(objectIdentity);