The roles refer to the user roles given to the user and subsequent access. The authentication itself is done by the controller on behalf of the user.
As zalion0 mentioned, if you are not returning an Aruba-User-Role VSA then the users will be in a denyall role.