"no in the ejb-jar" should read "No unchecked in the ejb-jar"
Please post your roles.properties and user.properties file.
Also, please explain the exact scenario
Are you sure that you added the <security-domain> tag in the jboss.xml descriptor in you ejb layer deployment????
It seems that you didn't and so it will explain the behaviour you described.
Let us know.
Yep, Andrea. That was it. Thanks for your help!