Glassfish JDBC Security Realm with JPA Annotations

Question

I have a fairly simple servlet application running under Glassfish 3.1.1 with a Derby 10.5.3.0 database. I have created a security realm using JPA annotations and am able to login successfully. My problem comes when I then try and access the Users entity. JPA/Hibernate seems to be repeatedly reading the user table until it throws a StackOverflowError exception. I have tried commenting out the login code, but I still get the exceptions when trying to access the user table, so I'm pretty sure that the fault must be with my JPA annotiactions. Can anyone help please?

User.java:

package com.optasense.owr.relay.domain.user;

import static com.optasense.owr.relay.domain.user.Role.ROLE.SITE_USER;

import java.io.Serializable; 
import java.util.HashSet;

@Entity(name="USER_TABLE")
public class User implements Serializable {

private static final long serialVersionUID = -1907443883886809564L;

@Id
private String userName;

@Column(length=32,columnDefinition="VARCHAR(32)")
private String password;

private String deviceID;

@ManyToMany
private Set<Site> sites;

@OneToOne(fetch=FetchType.EAGER, cascade=CascadeType.ALL, mappedBy="user")
private Role role;

public User() {
}

public User(String userName, String password) {
    this(userName, password , SITE_USER);
}

public User(String userName, String password, ROLE role) {
    this.userName = userName;
    this.password = password;
    this.role = new Role(role, this);
}

public String getUserName() {
    return userName;
}

public void setUsername(String userName) {
    this.userName = userName;
}

public void setPassword(String password) {
    this.password = password;
}

public String getPassword() {
    return password;
}

public boolean isPassword(String password) {
    return getPassword().equals(password);
}

public String getDeviceID() {
    return deviceID;
}

public void setDeviceID(String deviceID) {
    this.deviceID = deviceID;
}

public void clearDeviceID() {
    this.setDeviceID(null);
}

public Set<Site> getSites() {
    if (sites == null) {
        sites = new HashSet<Site>();
    }
    return sites;
}

public void setSites(Set<Site> sites) {
    this.sites = sites;
}

public void add(Site site) {
    getSites().add(site);
}

public void remove(Site site) {
    getSites().remove(site);
}

public void setRole(Role role) {
    this.role = role;
    role.setUser(this);
}

public Role getRole() {
    return role;
}
}

Role.java:

package com.optasense.owr.relay.domain.user;

import java.io.Serializable;

import javax.persistence.Column;
import javax.persistence.Entity;
import javax.persistence.EnumType;
import javax.persistence.Enumerated;
import javax.persistence.Id;
import javax.persistence.JoinColumn;
import javax.persistence.OneToOne;

@Entity(name="ROLE_TABLE")
public class Role implements Serializable {

private static final long serialVersionUID = -3509067216602046181L;

public static enum ROLE {
    WEB_ADMIN, SITE_ADMIN, SITE_OPERATOR, SITE_USER, SITE_VIEWER
}

@Id
@Column(name = "ROLE_NAME")
@Enumerated(EnumType.STRING)
private ROLE roleName;
@Id
@OneToOne
@JoinColumn(name = "USER_NAME")
private User user;

public Role() {
}

public Role(ROLE roleName, User user) {
    this.roleName = roleName;
    this.user = user;
}

public ROLE getRole() {
    return roleName;
}

public void setRole(ROLE roleName) {
    this.roleName = roleName;
}

public User getUser() {
    return user;
}

public void setUser(User user) {
    this.user = user;
}

}

My user finder code (lockmode is OPTIMISTIC):

private User findUser(String userName, LockModeType lockModeType) {
    User userFound = null;
    try {
        EntityManager em = getRelayPersistence().getEntityManager();
        userFound = (User)em.find(User.class, userName, lockModeType);
    } catch (Exception ignored) {
        LOGGER.debug("Unexpected exception (ignored)", ignored);
    }

    return userFound;
}