In the jboss-service.xml file (from the /deploy/server/default/deploy/jbpm/jbpm-service.sar/META-INF/ directory) the name attribute of the jaas:application-policy tag is set to 'jbpm-console'.

In the jboss-web.xml (from the /deploy/server/default/deploy/jbpm/jsf-console.war/WEB-INF/ directory) the value for the security-domain tag is set to 'java:/jaas/soa'.

This means that when the contents of the /deploy/ directory are copied as-is to an appropriate directory on an application server (as tested on JBoss EAP 4.3) it will not be possible to log in at the jBPM console.

It is simply solved by synching these two values (e.g. set the jaas:application-policy tag name attribute to 'soa').