I tried to create the ejb-jar.xml but it requires me to also define the ejb-class, session-type, transaction-type, etc. Shouldn't this all be defined from the annotations? It seems redundant to me. Is this the only way to define security role references? I've tried in jboss.xml and jboss-app.xml but it doesn't work. There must be somebody out there that uses EJB3 annotations and security references. Please help. View the original post : http://www.jboss.com/index.html?module=bb&op=viewtopic&p=4194412#... Reply to the post : http://www.jboss.com/index.html?module=bb&op=posting&mode=reply&a...