This article is a one stop resource for web security in JBoss Application Server. Even though the configuration may change between major versions of JBoss Application Server, the features should be available starting JBoss AS 5 and beyond.
What is provided by Java EE in terms of Web Security?
The main security constructs in Web Security come from the web.xml security configurations until Java EE5. These are reasonably documented in a use case manner at
http://java.dzone.com/articles/understanding-web-security
Starting Java EE6, with the introduction of the Servlet 3 specification, you have some security annotations that allow your to configure your servlets with security information.
Some examples are: