Frist you grant the application role to users (groups).
The application must execute sp_setapprole with approlename and password to activate the app role. The application has to get the password from somewhere, hardcoded maybe, or ask the user - this is an issue I have never been satisfied with.