Logging out is not an issue of JBoss, it is an issue of the application itself. The best you can do without getting into the actual application is to set a session timeout. In web.xml add the following:
<session-config>
<session-timeout>30</session-timeout>
</session-config>
The 30 is 30 minutes meaning that if we haven't heard from the person for 30 minutes or more, then the server is to kill their session. It's not a logout, per se, but it's the best we have as an admin that I'm aware of.