When EJB client uses JBOSS-LOCAL-USER for silent authentication, then during invocations, he is seen as anonymous instead of $local.
This also means that he is not able to invoke methods annotated with @RolesAllowed("**") which is supposed to allow everyone with an established security context.

On EAP 7.0.0, this works as expected and the EJB calls are performed as the user named $local and it is allowed to invoke methods annotated @RolesAllowed("**")