[keycloak-user] authenticate EJB remote clients

http://docs.jboss.org/keycloak/docs/1.1.0.Final/userguide/html/ch08.html#... I'm probably mis-reading that chapter, but is it implying that Keycloak can handle authenticating EJB *remote* clients? I haven't had success, so far, even after setting up the security-domain in standalone.xml and referencing it with @SecurityDomain. Even with concepts from https://github.com/wildfly/quickstart/tree/master/ejb-security, I continue to receive "Invalid user". Is that a use case that's supported, or am I misunderstanding? Thanks!