I recently reviewed the org.picketlink.identity.federation.web.servlets.saml.SOAPSAMLXACMLServlet and noticed that it only instantiates one PDP. Could this be a source of bottleneck? Could multiple PDP be instantiated and stored in a common pool (i.e. Apache GenericObjectPool) to process requests? If yes, is it thread safe?
Do profiling and see for yourself.