Only one instance of your Data Provider is created and it is used for all the lifecycle of the Server. That means that such instance will be shared for all the requests. Also notice that the Data Provider has no notion of users. It's the Metadata Adapter that can know about each user's requests.