A thorough title. But again:

If a collection is protected by a local group which contains a space in its name, e.g. "WDCC2 Test" (haven't tried CMIP5 Research but might be the same), any attempt to publish to it will fail because of improper rights.

The server logs:
2011-04-19 15:14:31,846 org.springframework.security.web.access.ExceptionTranslationFilter [DEBUG]: Access is denied (user is not anonymous); delegating to AccessDeniedHandler
org.springframework.security.access.AccessDeniedException: Access is denied
        at org.springframework.security.access.vote.UnanimousBased.decide(UnanimousBased.java:78)
...
2011-04-19 15:14:31,849 org.springframework.web.servlet.FrameworkServlet [DEBUG]: Could not complete request
java.lang.NullPointerException
        at org.safehaus.uuid.UUID.<init>(Unknown Source)
        at org.safehaus.uuid.UUID.valueOf(Unknown Source)
...
2011-04-19 15:14:31,852 sgf.gateway.web.filters.exception.UnhandledExceptionFilter [ERROR]: This exception that was not handled by the UnhandledExceptionFilter
org.springframework.web.util.NestedServletException: Request processing failed; nested exception is java.lang.NullPointerException
        at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:656)
        at org.springframework.web.servlet.FrameworkServlet.doPost(FrameworkServlet.java:560


The client just says:
esgcet.publish.hessianlib.ProtocolError: <ProtocolError for https://albedo2.dkrz.de/esgcet/remote/secure/client-cert/hessian/publishingService: 500 Internal Server Error>

To solve this I merely edited the group name on the gateway DB to "WDCC2_Test", i.e. replaced the space by an underscore.

Trying to publish again immediately afterwards (i.e. no new certificate gathered, etc) succeeded without any inconvenience.