Tucked away in the admin guide in a section on Debug Logging by Service, you are told that you can login as amadmin, access Debug.jsp (for example http://openam.example.com:8080/openam/Debug.jsp), and set the log levels for different services on the fly. This feature is actually more handy than its location in the admin guide suggests.
The Debug.jsp page shows you what is affected when you submit a change.
Then you can tail the logs (for example, $HOME/openam/openam/log/*) or debug logs (for example, $HOME/openam/openam/debug/*) to see what the service thinks is happening. Turn it up to Message if you want details. You can turn it back down once you have found what you are looking for.
