<authenticator type='com.caucho.server.security.XmlAuthenticator'>
     <init>
             <user>admin:xxxx:admin</user>
     </init>
</authenticator>
...
<security-constraints url-pattern='/*' role-name="admin' />
<security-role role-name='admin' />

servlet code:

public class TestServlet extends HttpServlet
{
    TestHome _th = null;        // the SLSB home
    public void init(ServletConfig sc) throws ServletException {
            super.init(sc);
            try {
                Context ejb = new InitialContext().lookup("java:comp/env/ejb");
                _th = ejb.lookup("testejb");          //  cause error here !!!
            } catch(NamingException e) {
                e.printStackTrace();
                throw new ServletException;
            }
    }
}