They have made this as difficult to find as possible! (Actually, if you are a Maven guru and live and breath Maven then it really isn't all that difficult...)
Anyway, the DatabaseServerLoginModule class is in the lib/jbossssx.jar file.
The source for that file is in the Maven repository at https://repository.jboss.org/jboss/jbosssx/. (Maybe, see later...)
Looking in lib/jbosssx.jar/META-INF/MANIFEST.MF, the version number given as 3.0.0.CR2, which has no relationship whatsoever to the version numbers presented at https://repository.jboss.org/jboss/jbosssx/. The manifest also claims that jbossx was created by Maven, so why isn't the pom within the JAR?
Scanning the POMs in the JBoss AS source, I see that jbossssx.jar actually has a groupId of org.picketbox, so I was looking in the wrong Maven location. Of course there is no org.picketbox in the JBoss Maven repository. So that is a dead end.
Decided to compile it. I had done this before, but since then I had reset my local Maven repository so I knew the artifacts would no longer be there. The jar file appeared at m2_repo/ogr/picketbox/jbosssx/3.0.0.CR2. I ran the build again as "build dependency:sources" and got m2_repo/ogr/picketbox/jbosssx/3.0.0.CR2/jbosssx-3.0.0.CR2-sources.jar. Finally! Like I said, if you live and breath Maven, then using dependency:sources would have been second nature. Of course, this goal obtains all of the source for everything, which might not be exactly what you want. Though the dependency:sources has numerous parameters which you can use to zero in on just the source(s) you want.
I managed to track it down. I found it very confusing and convoluted though. JBoss community site is not user friendly at all.
One thing that confused me was jboss-as-distribution-6.0.0.Final-src.zip. It contains a security subdirectory with source for the same package as all the LoginModules, but not the LoginModules themselves. They are distributed somewhere else. It makes no sense why JBoss 6.0 Final distributable contains binaries, but the matching source ZIP only contains a subset. Is it that hard to zip up all the source in one place?
After some googling to filter out all the junk search results (noise!), I found out DatabaseSourceLoginModule.class is in jbosssx.jar. There is no top-level JBoss SX project though, and more searching got me nowhere.
By sheer accident, I stumbled on the XML file in the root of jboss-as-distribution-6.0.0.Final.zip. It has a list of all JARs included in JBoss AS. Anyway, I found an entry for jbosssx.jar. The description says it comes from PicketBox version 3.0.0CR2. Finally! I found out where the login module source lives after wasted time! PicketBox is a top-level project on the JBoss community website.
I navigated to the landing page for PicketBox and looked at the source tab. No links for 3.0.0CR2, only 3.0.0 Final and 3.0.0 CR1. So I copied the 3.0.0CR1 link, guessed at what the link for 3.0.0CR2 might be, and viola I found it! I found the actual source ZIP for PicketBox 3.0.0CR2 absolutely buried in a giant haystack.
I am happy I found it, but seriously. The process was so convoluted, and google is just full of junk search results.
Click the link for: picketbox-3.0.0.CR2-sources.zip