I tried enabling security for the Duke's Bank application as mentioned in the Getting Started guide paragraph 4.3.1.

When I added the security-domain element for the jboss-web.xml file for the web application, the login does work. Both using property files and using database.

However, the Getting Started guide also says to add a security-domain element to the jboss.xml file in the EJB package. However, if I add the security-domain element there, I then get an EJB SecurityException after logging into the web app on the AccountBean EJB.

Why isn't the EJB-level security working? It's the same exact line as the web app security, using the dukesbank security domain.