first of all ,you should take a look at JAAS spec, as you look through it you will find that you need to define some roles in your ejb-jar.xml and then specifing each ejb or yur web  resources a needed role who can access it , after it ,you will use JAAS as an interface for all accesses I mean you get an instance of JAAS and the you tell it what to call or which object to be executed through this interface and the JAAS will help you in the security  issue such as if the user can access this resource or not.