web.xml, security constraint, where do you declare that a user has x role besides declaring it in web.xml?

Question

Hi I'm just learning about the deployment descriptor and I'm wondering about how whatever is using the security constraint knows whether the user is of a certain role, where do you declare the role for the user? for example in an android application, but clear this doubt for me please, you have to give each user a role right? where do you do that? I'm using google cloud storage and app engine