Ok, I gave up on trying to access "java:/JmsXA" from a web app deployment, however I came up with a solution that works. Just make a copy of the connection-factory configuration for "java:/JmsXA" but map this second one to a JNDI name in the global namespace.
Here is the detailed procedure.
===================== deploy/hornetq/jms-ds.xml ============
Since the JCA RA pooled JMS ConnectionFactory is mapped to "java:/JmsXA" and, for some reason, the "java:" namespace is not accessable from web applications - we will configure another connection factory and map it in the global namespace. The raw XAConnectionFactory is mapped to the global name "/ConnectionFactory", but JBoss does not recommend usage by applications since connections and sessions are not pooled, nor automatically cleaned up.
As such, we need to configure an additional JCA RA pooled JMS ConnectionFactory
Edit $JBOSS_HOME/server/default/deploy/hornetq/jms-ds.xml and add the following entry:
<tx-connection-factory>
<jndi-name>JmsXAGlobal</jndi-name>
<use-java-context>false</use-java-context>
<xa-transaction/>
<rar-name>jms-ra.rar</rar-name>
<connection-definition>org.hornetq.ra.HornetQRAConnectionFactory</connection-definition>
<config-property name="SessionDefaultType"
type="java.lang.String">javax.jms.Topic</config-property>
<config-property name="JmsProviderAdapterJNDI"
type="java.lang.String">java:/DefaultJMSProvider</config-property>
<max-pool-size>20</max-pool-size>
<!-- following configured in conf/login-config.xml -->
<security-domain-and-application>JmsXAGlobalRealm</security-domain-and-application>
</tx-connection-factory>
===================== conf/login-config.xml ============
Edit $JBOSS_SERVER/conf/login-config.xml add an application login policy for the newly added JMS connection factory. You're basically just going to copy/paste the one for "JmsXA", then replace the two occurances of the string "JmsXA" with "JmsXAGlobal"
<application-policy name="JmsXAGlobalRealm">
<authentication>
<login-module code="org.jboss.resource.security.ConfiguredIdentityLoginModule"
flag="required">
<module-option name="principal">guest</module-option>
<module-option name="userName">guest</module-option>
<module-option name="password">guest</module-option>
<module-option name="managedConnectionFactoryName">jboss.jca:service=TxCM,name=JmsXAGlobal</module-option>
</login-module>
</authentication>
</application-policy>