Ok, there is a jaas:role-add
command. This then worked (in addition to the previous deletion and re-add of the user openhab):
openhab> jaas:realm-manage --index 6
openhab> jaas:role-add openhab administrator
openhab> jaas:user-list
User Name │ Group │ Role
──────────┼───────┼──────────────
openhab │ │ administrator
openhab │ │ user
openhab> jaas:role-delete openhab user
openhab> jaas:user-list
User Name │ Group │ Role
──────────┼───────┼──────────────
openhab │ │ administrator
openhab │ │ user
openhab> jaas:role-delete openhab user
openhab> jaas:user-list
User Name │ Group │ Role
──────────┼───────┼──────────────
openhab │ │ administrator
openhab │ │ user
openhab> jaas:update
openhab> jaas:user-list
No JAAS Realm/Login Module has been selected
~ openhab> jaas:realm-manage --index 6
openhab> jaas:user-list
User Name │ Group │ Role
──────────┼───────┼──────────────
openhab │ │ administrator
openhab>
Edited to mention that the jaas:role-add
command was mentioned in the thread I just checked out from @hafniumzinc. Good lead!