Answering my own question, most of it seems to be spelled out here:
Here's a question:
Is it possible to include a trivial auth.conf in jbossall-client.jar ("other" using ClientLoginModule) and have it loaded by by LoginInitialContextFactory by default?
If auth "just worked" by including the principal and credential in the initial context (and using LoginInitalContextFactory, of course) this might make life easier for people that don't want to climb the (already steep) JAAS/JBossSX learning curve.
Thanks, I found JndiLoginInitialContextFactory from browsing the code, but I also noticed that is not included in jbossall-client.jar. At least not in the head trunk.
I know what you're going to say next...