I found out that it is a mistake eclipselink, but it can be fixed in picketlink;

A little example with two classes:
@Entity
public class Entity implements Serializable

@javax.persistence.Entity
public class Identity implements Serializable

Test database on mysql:
CREATE TABLE `entity` (
`ID` varchar(255) NOT NULL,
PRIMARY KEY (`ID`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;
INSERT INTO `entity` VALUES ('aaa');
INSERT INTO `entity` VALUES ('bbb');
INSERT INTO `entity` VALUES ('ccc');
INSERT INTO `entity` VALUES ('ddd');

CREATE TABLE `identity` (
`ID` varchar(255) NOT NULL,
`OWNER_ID` varchar(255) NOT NULL,
PRIMARY KEY (`ID`)
) ENGINE=InnoDB DEFAULT CHARSET=utf8;

INSERT INTO `identity` VALUES ('1', 'aaa');
INSERT INTO `identity` VALUES ('2', 'yyy');
INSERT INTO `identity` VALUES ('3', 'zzz');
INSERT INTO `identity` VALUES ('4', 'ccc');
INSERT INTO `identity` VALUES ('5', 'xxx');

I tested in war application in glassfish 4:
1) JPQL this query is working as excected:
Query query = em.createQuery("select r from Entity r where r in (select e.owner from Identity e)");
System.out.println(query.getResultList());//Two records

2) Criteria api query is not working:
CriteriaBuilder cb = em.getCriteriaBuilder();
CriteriaQuery<?> cq = cb.createQuery(Entity.class);
Root from = cq.from(Entity.class);
Subquery<?> subquery = cq.subquery(Identity.class);
Root subRoot = subquery.from(Identity.class);
subquery.select(subRoot.get("owner"));
cq.select(from);
cq.where(cb.in(from).value(subquery));
System.out.println(em.createQuery(cq).getResultList());//Exception

Exception [EclipseLink-6048] (Eclipse Persistence Services - 2.5.0.v20130507-3faac2b): org.eclipse.persistence.exceptions.QueryException
Exception Description: Illegal use of getField() [entity.ID] in expression.
Query: ReadAllQuery(referenceClass=Entity )

But if I change requests as follows, it will work perfectly:
1) JPQL this query is working as excected:
Query query = em.createQuery("select r from Entity r where r.id in (select e.owner.id from Identity e)");
System.out.println(query.getResultList());//Two records

2) Criteria api query is not working:
CriteriaBuilder cb = em.getCriteriaBuilder();
CriteriaQuery<?> cq = cb.createQuery(Entity.class);
Root from = cq.from(Entity.class);
Subquery<?> subquery = cq.subquery(Identity.class);
Root subRoot = subquery.from(Identity.class);
subquery.select(subRoot.get("owner").get("id"));//.get("id")
cq.select(from);
cq.where(cb.in(from.get("id")).value(subquery));//.get("id")
System.out.println(em.createQuery(cq).getResultList()); //Two records

I will write about this error in eclipselink community , but it can take a very long time.
We return to the picketlink.
I have the same error in Criteria API in the next call:
BasicModel.hasRole(relationshipManager, identity.getAccount(), role);
Could you close the error something like this (compare entity ID in 'IN clause' and not entirely entity) in JPAIdentityStore:
https://github.com/picketlink/picketlink/blob/master/modules/idm/impl/src/main/java/org/picketlink/idm/jpa/internal/JPAIdentityStore.java

Subquery<?> subquery = cq.subquery(relationshipMemberMapper.getEntityType());
Root fromRelationshipIdentityType = subquery.from(relationshipMemberMapper.getEntityType());
subquery.select(fromRelationshipIdentityType.get(relationshipProperty.getName()).get("id"));//Id-field name taken from the meta-description of course

Property<String> descriptorProperty = relationshipMemberMapper.getProperty(RelationshipDescriptor.class).getValue();
Predicate conjunction = cb.conjunction();
conjunction.getExpressions().add(cb.equal(fromRelationshipIdentityType.get(descriptorProperty.getName()), identityTypeParameter.getName()));
Property<Object> identityProperty = relationshipMemberMapper.getProperty(RelationshipMember.class).getValue();

if (identityProperty.getJavaClass().equals(String.class))

else

subquery.where(conjunction);
predicates.add(cb.in(from.get("id")).value(subquery));//added .get("id")