You can use a JDBC realm, which will let you programmatically add/change/remove users. I'm not aware of any better solutions than this. I'm going to be experimenting with programmatically adding users fairly soon - my plan at the moment is to link up the entity persistence table for the 'Account' entity bean in my system to the security realm using JDBC.
Glassfish 2 comes bundled with the JDBCRealm driver.
Here's an article that seems to cover the basics (although it's talking about using Tomcat): http://tomcat.apache.org/tomcat-3.3-doc/JDBCRealm-howto.html
The same principles apply to Glassfish - if you create a new realm (configuration -> security, if I remember correctly), choose to make it a JDBCRealm and set the properties as listed on the page above (look at the table in the section "3. Configure Tomcat").
You can see that if you're smart about which datasource, table and columns to use, you can tie this in with entity beans. This means that creating a new account will be as simple as creating a new instance of some entity bean and persisting it.
Hopefully it'll all work out nicely. :)