In the docs at http://docs.jboss.org/jbossas/jboss4guide/r4/html/ch8.chapter.html, it goes to great length to explain how to set up security in the various
components of JBoss.

These docs are however deafeningly silent on security troubleshooting - if you configure the security, and your config doesn't work, you get absolutely
no help from JBoss whatsoever. No error messages, no log files, and no documentation on how to switch on error messages or log files.

In its current state, JBoss security is virtually impossible to configure reliably - if the user doesn't strike the perfect configuration on the first attempt, all
hope is lost.

The JBoss security docs need a section dedicated to "what to do if things don't work". Searching for "logging" and "error" within the docs show no useful information, just references to code methods.