I did not mention that I am using JBOSS 3.2.2 RC3.
My investigation shows that you can put your login module class directly into any ejb/war archive in your ear application. Remember that this archive should be mentioned in META-INF/application.xml application descriptor. Avoid putting login module to server classpath (server/default/lib etc.). While it will work with some versions of JBOSS, it will cause you problems with undeploying / redeploying your app.