I was able to beat custom realms them into submission ^_^ after setting the
<jvm-options>-Djava.security.debug=logincontext</jvm-options>
security option in domain.xml (or in app server admin console) when starting up.
Setting the logger to finest did not show me all the information that this option showed me.
[Message sent by forum member 'fedevela' (fedevela)]
http://forums.java.net/jive/thread.jspa?messageID=240409