...
You want to replace server-security-config with your own geronimo plugin (see plugin- Plugin infrastructure) that contains a security realm customized for your security setup (e.g. ldap), and includes whatever keystores you need. To make your plugin replace all uses of server-security-config, you need to include an artifact-alias element in your geronimo-plugin.xml file.
...