So, here the solution after my personal "via dolorosa" :)
First, the error was in the server.xml JAASRealm configuration.
Using the instruction at http://tomee.apache.org/tomee-jaas.html I used
userClassNames="org.apache.openejb.core.security.AbstractSecurityService$User"
roleClassNames="org.apache.openejb.core.security.AbstractSecurityService$Group"
After downloading tomcat sources and some debugging I found out that the actual generated Principals by org.apache.openejb.core.security.jaas.SQLLoginModule
are:
userClassNames="org.apache.openejb.core.security.jaas.UserPrincipal"
roleClassNames="org.apache.openejb.core.security.jaas.GroupPrincipal"
That solved the problem.