At present I am doing this work around to enable user authentication on glassfish. It would be nice if it were integrated with cargo.servlet.users.
The keyfile file contains user and hashed password data. Not sure if it allows non-hashed data yet.
The second XML island is to enable group to role mapping which may be useful as a default. (Though can be overriden by a property)