Actually we already have a fix for this in latest picketlink master: https://github.com/picketlink/picketlink-idm/commit/f3b9c09dc5c70e508bc7f8392efd7afe4186f443 . Only issue is that it's not released so far. Also not sure if you are using picketlink 1.4 or some different branch in gatein 3.5. Let us know if you want plidm release and we can try to add one .

Also possible workaround is to create subclass of InfinispanIdentityStoreCacheProviderImpl and override some methods here and put it into idm registry under different name: https://github.com/gatein/gatein-portal/blob/master/web/portal/src/main/webapp/WEB-INF/conf/organization/picketlink-idm/examples/picketlink-idm-ldap-config.xml#L368 . In this case you don't need new idm release. Not sure if it is an option for you.