The PicketLink Identity Provider Authenticator is a component responsible for the authentication of users and for issue and validate SAML assertions.
Basically, there two different different authenticator implementations type:
Identity Provider Authenticators
Service Provider Authenticators
PicketLink includes a number of Authenticators for providing SAML support on Apache Tomcat and JBoss Application Server.