User roles are a concept that I think deserves to be translated correctly on its own.
It is not the same as a user, or even a user with a role. The user role can exist without any users, and the privileges that are granted to roles are granted to the roles rather than to users.
This is a very specific and concious application design decision, removing any direct link between users and privileges. It makes it possible to group privileges based on functionality and you don't have to keep track of which user is allowed to do what.
In practice, user roles and users are sometimes seen as equivalent even though they are different concepts (John the manager may have the "manager" role) but it is quite common that users have several roles, and even that some roles are (initially) not assigned to any users ("system tester" could be a role that is only temporary assigned to some users that at other times have different roles.)
So in short, the translation depends on translation the concept user role. You could drop user and just translate role. It is commonly done in English: within an application context, role-bases privileges are understood to refer to roles that users may have.
Just to add a bit of grammar, the expression user role means a role (that happens to be a "user"-type role), not a user of any kind. The noun user is use attributively to _describe role.
It is common to use this construction, and it is important to remember that the actual main noun comes last:
I can describe my work as "software engineering", meaning I am engineering something: software. On the other hand, an engineer may use specialised software to do his job, which would be "engineering software".
In the case of the user role, it is a role. So it does not describe a user with roles, users with a role, users with roles, or a user with a role. It describes a role that may or may not be linked to a user at some point.