They need to be separate files; not part of any dd.
They need to be on the webapp's classpath; I've seen them put in WEB-INF/classes. This allows them to be hot deployed with the webapp. They can also go in the /server/.../conf folder.
Give the files a unique, app-specific name --- don't just call them users.properties and roles.properties.
For an example, see the $JBOSS_HOME/server/default/conf/login-config.xml file, the "web-console" application policy. If you then look in the deploy/management/console-mgr.sar/web-console.war you can see the files in WEB-INF/classes.