Larry McCay Larry - you should use the JIRA for PicketLink (https://issues.jboss.org/browse/PLINK). This particular PLINK2 is deprecated and old. Also you can use the mailing list (security-dev) at lists.jboss.org