forgot to define security-role?

[Jonathan H Brown]

i'm getting the following when i try to access
a restricted area of my application:
--
403 Forbidden

Error initializing security, security-role not found: users
--
where might i have forgotten to define:
---
web-xml:
     <security-constraint>
         <web-resource-collection>
             <web-resource-name>Everything</web-resource-name>
             <url-pattern>*</url-pattern>
         </web-resource-collection>
         <auth-constraint>
             <role-name>users</role-name>
         </auth-constraint>
         <login-config>
             <auth-method>BASIC</auth-method>
         </login-config>
     </security-constraint>

ejb-jar.xml
     <assembly-descriptor>
         <security-role>
             <description>Test</description>
             <role-name>users</role-name>
         </security-role>

orion-application.xml
     <security-role-mapping name="users">
         <group name="users" />
     </security-role-mapping>

config/principals.xml
         <group name="users">
             <description>users</description>
             <permission name="rmi:login" />
             <permission name="com.evermind.server.rmi.RMIPermission" />
         </group>


what did i miss?

thanks,
jonathan