====================================
<session>
<ejb-name>SecTestEJB</ejb-name>
<business-local>xxx</business-local>
<ejb-class>xxx</ejb-cla
ss>
<security-role-ref>
<role-name>ADMIN</role-name>
<role-link>Administrator</role-link>
</security-role-ref>
<security-role-ref>
<role-name>MGR</role-name>
<role-link>Manager</role-link>
</security-role-ref>
</session>
==================================================

There can be security role references configured at the bean level in ejb-jar.xml

The metadata that is parsed by the ejb3 metamodel does not recognize the security role references.

The isCallerInRole checks on the EnterpriseContext needs to be aware of these security role references.