Here is an use-case:
<datasources>
<xa-datasource>
<jndi-name>PostgresDS</jndi-name>
<track-connection-by-tx>true</track-connection-by-tx>
<xa-datasource-class>org.postgresql.xa.PGXADataSource</xa-datasource-class>
<xa-datasource-property name="ServerName">server_name</xa-datasource-property>
<xa-datasource-property name="PortNumber">5432</xa-datasource-property>
<xa-datasource-property name="DatabaseName">database_name</xa-datasource-property>
<xa-datasource-property name="User">user</xa-datasource-property>
<xa-datasource-property name="Password">password</xa-datasource-property>
<metadata>
<type-mapping>PostgreSQL 8.0</type-mapping>
</metadata>
</xa-datasource>
</datasources>
There isn't a security-domain defined here.