Tucked away in the admin guide in a section on Debug Logging by Service, you are told that you can login as
Debug.jsp (for example
http://openam.example.com:8080/openam/Debug.jsp), and set the log levels for different services on the fly. This feature is actually more handy than its location in the admin guide suggests.
Debug.jsp page shows you what is affected when you submit a change.
Then you can tail the logs (for example,
$HOME/openam/openam/log/*) or debug logs (for example,
$HOME/openam/openam/debug/*) to see what the service thinks is happening. Turn it up to
Message if you want details. You can turn it back down once you have found what you are looking for.