I just checked and JBOSS 3.2.3 does not yet implement the authenticated shutdown request.
Could we get this item on the TODO list? I would like to see this feature implemented in the next release.
Note: although kill works fine it is nice to have the shutdown to work as well.
If your doing an html get/post against a secured jmx-console in your script then its up to you to provide the required credentials. If your using the shutdown.sh script shipped with JBoss, this has nothing to do with the jmx-console, and will support the authenticated usage in 3.2.4RC1.