All u wrote is acceptable, but as pooyan mentioned pls. consider that i might not need any EJB security  at all. The thing is that all data encryption that i need will implemented later on. but for now, as my web  app. security is not that important (an average level as many other web apps. on the net) I just want to follow the basic and essential authentication  and authorization  patterns in JBoss.
actually I wrote some JAAS classes to authenticate and authorize users  in some stanalone app using LDAP and RDBMS. but mapping these files in JBoss needs more knowledge.