I just encountered this problem. Or at least, I think I did. I hit it when I called IdentityManager.updateCredential(), not when trying to authenticate the user, but I'm guessing both actions use the JPAIdentityStore.lookupIdentityObjectById() method. I'll attach a full stack trace, but I'm 99% sure the problem is in that method, specifically at lines 617-618 where the code does this:

predicates.add(builder.in(join.get(getConfig().getModelProperty(PropertyType.PARTITION_ID).getName())).value(partitionIds));

I believe that passing partitionIds to the In.value() method is the problem. I don't use the Criteria API, but if this were a String query, then the above would be something like "IN (:paritionIds)". I know from first-hand experience that that works fine with Hibernate but not with EclipseLink. The reason is that the JPA standard doesn't allow passing collection objects (List, Set, etc.) for the IN clause. So EclipseLink adheres to the standard and forces you to do "IN (:partitionId1, :partitionId2, ..., :partitionIdN)", but Hibernate is more lenient and expands the collection for you.

To fix this, I think the PicketLink code would need to be changed so it loops over the partitionIds collection and invokes the value() method for each partitionId individually. I looked for other places where In.value() is called, and it appears that these methods are also affected by this issue:

• JPAIdentityStore.fetchQueryResults() at line 1525-1526
• IdentityTypeHandler.findByPartition() at line 518-520
• GroupHandler.getPredicate() at line 215

Note: all line number references are for 2.5.0.Beta4.