Thanks for this post.
I had everything except the @SecurityDomain, and so my @RolesAllowed was not working.
With that in place, my EJBs are properly secured.