I just ran into this same issue. I'm new to J2EE, GlassFish and NetBeans 5.5, so I spent all day yesterday trying various things, believing it was my lack of knowledge. In the end, what worked was to copy the security-role-mapping element from sun-web.xml into sun-application.xml. When I saved this file and redeployed, the problem was solved. The NetBeans deployment descriptor GUI for the sun-application.xml file doesn't prompt you for the security-role-mapping information, so I wasn't including it.
Hope this helps.
[Message sent by forum member 'bkildea' (bkildea)]
http://forums.java.net/jive/thread.jspa?messageID=237748