Does anyone know how this works, where/how do you set the roles that are checked for in this tag? Or can anyone give me a link that explains how this works I've tried looking through the struts documentation, but I just end up finding what tags use the role attribute. But no real information on defining the role for a user/session.
Security roles are determined by your application server / servlet container. If you are using Tomcat, here's an article I found which discusses how to do this. The Tiles tags work with your server's specified roles to determine if a tile will display based on the role of the user who is logged in and trying to access that tile.