I found a little bit critical bug related Privacy Lists with Clustering.
If clustering setting is disabled, this bug isn't happen.
I tested with Openfire 3.7.1 release with Hazelcast plugin,
and current Openfire 3.7.2 Beta trunk on Amazon EC2.
<How to Reproduce>
Login to Clustering enabled server
Create Privacy Lists, and set to Active List
Repeat logout and login
This user can't login again
In admin console, delete cache of Privacy Lists.
User can login again
Added name attribute for persisted privacy lists.
Presumed fixed, but not tested locally.