old_contents: from sqlalchemy.orm.exc import NoResultFound
  from .storage import (
      DBSession,
      UserMap,
      )
  
  
  def groupfinder(login, request):
      if ':' not in login:
          return None
      namespace, localname = login.split(':', 1)
  
      if namespace == 'mailto':
          session = DBSession()
          query = session.query(UserMap).filter(UserMap.login == login)
          try:
              user = query.one().user
              principals = ['userid:' + str(user.rid)]
              principals.extend('lab:' + lab_uuid for lab_uuid in user.statement.object.get('lab_uuids', []))
              return principals
          except NoResultFound:
              return None
  
      elif namespace == 'remoteuser':
          if localname in ['TEST', 'IMPORT']:
              return ['group:admin']
  
new_contents: from sqlalchemy.orm.exc import NoResultFound
  from .storage import (
      DBSession,
      UserMap,
      )
  
  
  def groupfinder(login, request):
      if ':' not in login:
          return None
      namespace, localname = login.split(':', 1)
  
      if namespace == 'mailto':
          session = DBSession()
          model = session.query(UserMap).get(login)
          if model is None:
              return None
          user = model.user
          principals = ['userid:' + str(user.rid)]
          principals.extend('lab:' + lab_uuid for lab_uuid in user.statement.object.get('lab_uuids', []))
          return principals
  
      elif namespace == 'remoteuser':
          if localname in ['TEST', 'IMPORT']:
              return ['group:admin']
  
subject: Simplify the groupfinder a little. In general we should try to use session.query(...).get() rather than .filter().