Lists of improvements that came out of a discussion with Pete:

1) General improvements
a) document thread safety of IDM classes in Javadoc
b) Make config fields final
c) Make Collections and Maps unmodifiable
d) Make the identity store configuration immutable

2) IdentityManager producer method should be @RequestScoped

3) For JPA dependencies:
a) Make JPA dependencies in picketlink-idm-impl module <optional>
b) Introduce unit tests that test in an environment without JPA

4) DefaultStoreFactory
a) Populate identityConfigMap in the constructor, store as an unmodifiable Map
b) Populate storesCache in the constructor, store as an unmodifiable Map
c) realmStores, configuredRealms, tierStores, configuredTiers -> to be removed/refactored

5) SecurityContext
a) Make fields immutable
b) Javadoc - document that this is a lightweight object, cheap to create

6) CredentialHandler
a) Remove CredentialHandlerFactory
b) Instantiate CredentialHandler instances during IdentityStoreConfiguration initialization
c) Store CredentialHandler instances in the configuration

7) IdentityStore
a) Document thread safety -> recommend that implementations are thread-safe

8) (Optional) Introduce abstract base class for IdentityStore implementations, pass configuration as constructor parameter.