Creating a user and assigning rights in PicketLink is slow in EPP 5.2

Issue

Problem: we are experiencing performance issues using the PicketLink IDM as part of the JBoss Enterprise Portal Platform, version 5.2.2. More specifically, creating a single user and making him a member of 38 groups takes about half a minute, although much higher values have been observed. This is a typical use case, and we are seeking a 5-second maximum for this operation.

Background: the IDM tables in our database contain ~20.000 users, which have a cumulative ~400.000 group memberships. There are almost 50 different groups that users can be a member of, which we use to control access to various pages in the portal.

We have created a custom portlet that encapsulates functionality from the "classic" portal pages; it is a thin shell over a series of PicketLink API calls to perform the logic of creating a user, filling his profile, and adding him to various groups. By stepping through the code debugging, we have determined that about half of the time spent between clicking the "create" button and the (static) result page being fully rendered is spent completing the various PicketLink API calls. We are as yet unclear on what causes the other half.