...
private List<SecurityRole> roles;
At the moment this is not supported. That is, the entries in the list have to be a @Entity ... rather than a enum/scalar/embedded bean.
In your case it is a List of enum... but the same applies for "scalar values" (String, Integer, Double, Timestamp etc) ... and also for Embedded beans.
NOTE: I believe JPA 2.0 will contain support for this type of mapping.
I'll log this as an enhancement request.
Cheers, Rob.