The implementation in the test is a simple implementation to show how to do the work, but you must implement it using the mechanisms that you trust, just implementing the interfaces there.
If you want to code a J2EE solution you can do it if you know how to configure users and identity components in those environments. That topic is not related with jBPM and it's mostly about the technology that you want to use to manage identities. After that you can integrate the solution that you choose with jbpm very quickly.
Greetings.