You say you're trying to implement a undirectional relationship, therefore the Role EJB shouldn't have a users field and corresponding accessor methods. If you need the users field you should make your relationship bidirectional.
Hope this gives you some clue.
Thanks for the help.
I had a misunderstanding about <key-fields><key-field><field-name> and what value(s) to use.
I've got it figured out now.