Controller Based WLANs

How does a user entry get into the user-table of the controller?

If an IP packet is coming from either a wireless tunnel or an untrusted interface, the source IP of the packet will be placed into the user table starting with the initial role.

Then the user with this IP has to pass authentication if there's any. Once the authentication is passed, user will be placed into the authenticated role.