You need edit the jaas configuration file
thanks for your hint. It worked.
However, the properties (jmxLogin, jmsPassword) in org.apache.felix.karaf.management.cfg don't seem to have any influence at all.
My user.properties now looks like the following:
And hence the login with admin (with password kadmin) and only with this credentials work.