PicketLink Federation WS-Trust support needs PicketLinkAuthenticator configured in $JBOSS_HOME/server/${profile}/deployers/jbossweb.deployer/META-INF/war-deployers-jboss-beans.xml file.

WarDeployer bean has to have authenticators property configured like this:
<property name="authenticators">
<map class="java.util.Properties" keyClass="java.lang.String" valueClass="java.lang.String">
<entry>
<key>BASIC</key>
<value>org.apache.catalina.authenticator.BasicAuthenticator</value>
</entry>
<entry>
<key>CLIENT-CERT</key>
<value>org.apache.catalina.authenticator.SSLAuthenticator</value>
</entry>
<entry>
<key>DIGEST</key>
<value>org.apache.catalina.authenticator.DigestAuthenticator</value>
</entry>
<entry>
<key>FORM</key>
<value>org.apache.catalina.authenticator.FormAuthenticator</value>
</entry>
<entry>
<key>NONE</key>
<value>org.apache.catalina.authenticator.NonLoginAuthenticator</value>
</entry>
<entry>
<key>SECURITY_DOMAIN</key>
<value>org.picketlink.identity.federation.bindings.tomcat.PicketLinkAuthenticator</value>
</entry>
</map>
</property>

Whole file can be seen at http://anonsvn.jboss.org/repos/picketlink/integration-tests/branches/product/common-dist/files/eap/5.1.1/war-deployers-jboss-beans.xml

IMO: This could be quite tricky for user so better we have that in out of the box configuration.