In testing on my desktop, the password is required by uPortal between 327 and 450ish ms after first retrieval attempt.  I'd actually be inclined to go smaller rather than larger.  Ideally you'd want to complete the two calls to the CAS server (to get the proxy ticket and then to use it to get the password) before uPortal needs to deliver the password to a portlet.  However I also felt 5 x 300ms is a sufficient period to wait for the PGT to be processed by the distributed cache before we give up on attempts.