If you install the .war file onto glassfish everything will work until you need to do something which requires authentication (such as logging in to AdminCentral). The reason for this is that magnolia needs custom authentication modules to be declared to allow it to handle its own users and authentication. To do this you have to edit the "login.conf" file for the glassfish domain you're deploying on (probably "domain1" if you're using the out-of-the-box glassfish setup. I haven't yet found a way to do this through the Glassfish GUI - so you'll have to hack the file manually. Assuming your domain is "domain1" then the path to the file within your glassfish app folder will be :

 domains/domain1/config/login.conf 

you'll have to add this at the end of the file :

magnolia
{
    info.magnolia.jaas.sp.jcr.JCRAuthenticationModule requisite;
    info.magnolia.jaas.sp.jcr.JCRAuthorizationModule required;
};

Jackrabbit
{
    org.apache.jackrabbit.core.security.SimpleLoginModule required;
};

I've tested this with Magnolia 3.5.4 on on Glassfish 2.1 and it seems to be working fine so far. Thanks to user "huggy77" on the Ubuntu forums for this advice (though note that the code on the forum page actually has an error in it so you're better off copying from here).