The role is tied to the application, and the groups are tied to the deployment. For authentication purposes, it's very important to realise that roles are NOT groups. The two terms are not used interchangeably. This distinction often causes much confusion. A role can also contain any number of users.
Roles are an app server concept.
We wish to authenticate users against these database tables. Roles in web.xml are local, in that they only apply to the web module. Roles defined in application.xml are global in that they apply to the entire application. The J2EE spec specifies also that exact same xml fragmet has to go into web.xml, to specify the roles available to the app. The description of the roles will be inherited from that specified in application.xml , but can be overridden within the module.