It really is, but take a look at https://github.com/picketlink/picketlink/blob/277c5b8ec9b6eee5dcd36422763db6f02479f081/modules/federation/src/main/java/org/picketlink/identity/federation/core/sts/registry/JPABasedTokenRegistry.java.