SecurityStore is a pluggable object, and it has a default implementation on messaging-service.xml.

<server>
	<mbean code="org.jboss.jms.server.security.SecurityMetadataStore"
	name="jboss.messaging:service=SecurityStore">
	
	<attribute name="DefaultSecurityConfig">
	<security>
	<role name="guest" read="true" write="true" create="true"/>
	</security>
	</attribute>
	
	<attribute name="SecurityDomain">java:/jaas/messaging</attribute>
	
	<attribute name="SuckerPassword">CHANGE ME!!</attribute>
</mbean>
...
...file truncated..