Security is configured like JBoss Application server but within the Embeddable EJB 3.0 distribution direction conf/login-config.xml. You must also deploy the security-beans.xml file. See the example for more details.