seems this got lost as a result of this issue: https://jira.jboss.org/jira/browse/SECURITY-260
For JBoss 4.2, the DTD can be found in the "docs\dtd" director, but 5.0 does not contain it any more.
Ask it in the "Design of Security" forum: http://www.jboss.org/index.html?module=bb&op=viewforum&f=171, or raise a JIRA issue.
We no longer refer to the dtd in JBAS 5.x
Can you remove the DTD defs from your login-config.xml?
Am I missing something?
I forgot to mention that am using JBoss 4.2.3.
As JBoss 4.x still refers to the security-config.dtd, it might be nice if would still be available online. ;-)