From Openejb/TomEE mailing list, I understood that you have to:
- Add the tag to the server.xml;
- create the login.config in TomEE's conf directory;
- add the -Djava parameter to the startup line;
- create the files user.properties and groups.properties in the same directory as the login.config file.