I implemented APOP w/StaticUserRepository. Ran into some snags with the JAAS which you can follow here: http://www.jboss.com/index.html?module=bb&op=viewtopic&p=3895901
Of course once that is fixed there is the matter of JBoss 4.0.3RC3 (CVS) not being a target that we can test against as it has had various problems (deployers changing, classloader issues, Hibernate/Hypersonic mismatch), but we're close. I should have the non mailbox/imap issues nailed this week with the IMAP stuff to following week and release following. We're behind but I noted that we would be at the beginning of this cycle.
Meanwhile the project is generating a lot of corporate and governmental interest. So assume we're being watched ;-)
