If you are wondering where the source code for the security subsystem in JBoss AS 5.x (and also EAP 5.x) is, then you will need to look at the following locations:
Security Integration Code:
1. security module of the JBoss AS workspace.
2. Security SPI
The location of the source can be found from:
JBoss AS workspace:
There are two security projects integrated into JBAS5/EAP5.x, namely JBossXACML and JBoss Negotiation.
You can get their source from here:
JBoss Negotiation: http://anonsvn.jboss.org/repos/jbossas/projects/security/security-negotiation/tags/security-negotiation-2.0.3.SP1/