Description of problem:
Configuration file picketlink.xml can be referenced outside of war deployment, with time interval to reload this configuration. When Identity Provider(IDP) initialize this external configuration on start up, you can make any changes in its configuration file, but they won't be applied. I have tested it for changes in <KeyProvider> configuration (try to add or remove ValidatingAlias for some SP and identity federation is working without change).
For Service Provider(SP) the reload functionality works fine.

How reproducible:
Start IDP with no configured SP. Then add ValidatingAlias for SP in configuration file and wait until next reload. If you try to access this SP the identity federation is not working. 

This configuration I have used in jboss-web.xml:
<vault>
  <class-name>org.picketlink.identity.federation.bindings.tomcat.idp.IDPWebBrowserSSOValve</class-name>
  <param>
    <param-name>timerInterval</param-name>
    <param-value>5000</param-value>
  </param>
  <param>
    <param-name>configFile</param-name>
    <param-value>/path-to/picketlink.xml</param-value>
  </param>
</vault>