Ive just created an even easier setup to reproduce the issue on Glassfish + Eclipselink.
See here: https://github.com/rkorn86/jboss-picketlink-quickstarts/tree/PLINK-617/picketlink-authorization-idm-jpa
Base for this was https://github.com/jboss-developer/jboss-picketlink-quickstarts/tree/master/picketlink-authorization-idm-jpa and https://github.com/pedroigor/picketlink-quickstarts/commit/a8ed0d00f4638dc7d2c596e9c440db78088b1c0d