I had this discussion in the wrong project. I have moved it here.
I agree that there are quite some classes in that package. However, the fact that the class names start with prefixes (Facebook, OpenId and Saml) makes it quite easy to grasp the structure, so I don't think it's a big issue. In Seam 3, the package structure is already more hierarchical, and SAML and OpenID will not be mixed any more in the same package. So I think this has already been addressed in the successor of the external authentication module.