JAXRPC EJB Security Ignored in app migrating to JBoss EAP 6

Issue

• We are migrating a JAXRPC EJB Web Service and having trouble getting the security to work. It looks like the security settings are being ignored altogether. We have the following jboss.xml:

<?xml version="1.0" encoding="UTF-8"?>
<jboss>
    <security-domain>java:/jaas/wsaf</security-domain>

    <enterprise-beans>
        <session>
            <ejb-name>pt.segsocial.wsmicap.service.export.ejb.WsMicapInterfaceRemote</ejb-name>
            <jndi-name>global/wsmicap-service-impl/wsmicap-service-impl/pt.segsocial.wsmicap.service.export.ejb.WsMicapInterfaceRemote!pt.segsocial.wsmicap.service.export.ejb.WsMicapInterfaceHome</jndi-name>
            <port-component>
                <port-component-name>WsMicap</port-component-name>
                <port-component-uri>/wsmicap-service-impl/WsMicapInterfaceImplementation</port-component-uri>
                <auth-method>BASIC</auth-method>
            </port-component>
        </session>
    </enterprise-beans>
</jboss>

• We are developing a JAX-WS EJB-based endpoint, but we don't want to use annotations to specify our WS metadata if we can help it.