Looking at the code for user federation it looks like user federation provider instances with the same configuration can be created multiple times for a single session. Also they are never closed to resources aren't released.