Hi David Webb,
I use JBPM 5.3 and use it as a service (accessing the REST API provided by JBPM Console Server).
The JBPM Console Server security is provided by JBOSS AS's Security Domain (you can see it on the standalone.xml)
here is an example on configuring the security to authenticate user and role from external database:
https://community.jboss.org/message/758517#758517
If you want to, you can read more about setting JBOSS AS Security domain here:
http://docs.jboss.org/jbosssecurity/docs/6.0/security_guide/html/Login_Modules.html#sect-DatabaseServerLoginModule
Regards,
Thomas Setiabudi