If you define an EJB within WEB-INF/classes it does not inherit the security domain from the WAR file and defaults to "other". Counter-intuitive, IMO. Not sure if it is easily fixable though