you need to add the users using the script $JBOSS_HOME/bin/add-user.sh and assign them the corresponding roles that you configured in <security-settings>.
Jeff, you might be wrong because add-user.sh is AS7.
Jatin please clarify whether you use AS6 or AS7.
If you use AS6 I would recommend to use AS7 for new implementations.
I am using JBoss 6 and I have to do it in jboss 6 itself..