Although I didn't succeed with my entiry security setup, here's what I've found and put into my jboss-security.xml:
That's it! Substitute 'testUsersAndRoles' with your preferred security domain name. Leave 'java:/jaas/' as is.
Yes! That worked! Thanks!!!
I had tried it before, but I realize now that I had the file in the wrong directory. It has to be put in the xdoclet-directory and not in xdoclet/packagedir/of/my/bean/ as stated in the documentation (or did I interprete the docs wrong?)