if you use a DynamicLoginConfig (see here: http://community.jboss.org/wiki/DynamicLoginConfig ), you will at least be able change config and only have to restart/redeploy your own app, but you can keep JBoss alive.
Hope this helps
Thanks for your reply, but unfortunately I do not user DynamicLoginConfig. I use UsersRolesLoginModule (with properties files) and DatabaseServerLoginModule (with principalsQuery etc.) because of some security issues for my web services.
I wish there is another way..