Setup the following authentication policy
<application-policy name="CLSIS-Security">
<authentication>
<login-module code="org.jboss.security.auth.spi.DatabaseServerLoginModule" flag = "required">
<module-option name="unauthenticatedIdentity">guest</module-option>
<module-option name="dsJndiName">java:/DefaultDS</module-option>
<!--module-option name="hashAlgorithm">MD5</module-option>
<module-option name="hashEncoding">base64</module-option>
<module-option name="principalsQuery">SELECT USER_PWD FROM WEB_USERS WHERE USER_ID=?</module-option>
<module-option name="rolesQuery">SELECT ROLE_ID, 'Roles' FROM WEB_ROLES WHERE USER_ID=?</module-option-->
<module-option name = "principalsQuery">SELECT PASSWD FROM JBM_USER WHERE USER_ID=?</module-option>
<module-option name = "rolesQuery">SELECT ROLE_ID, 'Roles' FROM JBM_ROLE WHERE USER_ID=?</module-option>
</login-module>
</authentication>
</application-policy>

and for jmx-console.war set the jaas policy in jboss-web.xml
<?xml version="1.0" encoding="UTF-8"?>

<jboss-web>

<resource-ref>

<res-ref-name>jdbc/DefaultDS</res-ref-name>

<res-type>javax.sql.DataSource</res-type>

<jndi-name>java:/DefaultDS</jndi-name>

</resource-ref>

<security-domain>java:/jaas/CLSIS-Security</security-domain>

</jboss-web>

finally setting the web-app with role "john" and user/pass guest/guest

OPTION A: left deploy/jmx-invoker-service.xml unchanged with default policy "jmx-console"

Back in JBDS,
Open Server View
Right click on server --> Open
In Overview set the Server Credentials to admin/admin
Start the server and all is well

OPTION B: left deploy/jmx-invoker-service.xml change the policy to "CLSIS-Security"

Back in JBDS,
Open Server View
Right click on server --> Open
In Overview set the Server Credentials to admin/admin
Start the server pop-up comes up asking for the correct credentials enter guest/guest and all is well

OPTION B1: all as in OPTION B but
In Overview set the Server Credentials to guest/guest
Start the server and expect that since the correct credentials for the DB policy held in deploy/jmx-invoker-service.xml are given no pop-up will appear BUT
pop-up appears pre-populated with guest/guest I enter guest/guest and it keeps popping up (why?) if I choose "ignore" it does so server starts and JMX-CONSOLE is available via http://localhost:8080/jmx-console but JBDS is showing in Server View next to the server "Starting .... Synchnonized"

then after 450 secs the JBDS throws an error popup and the server stops (why?)