Typically organizations uses technologies such as LDAP, NTLM, MSAD. Shared services leverages these repositories to perform an external authentication.

When a user supplies their credentials at login, Shared Services accesses the user information stored in the external directory to authenticate the user in real time.

Applications from Essbase or Hyperion Planning are stored under Project folder. Shared Services User / Group provision to provide access to particular application, particular role or specific tasks.

Provisioning users and groups with Shared Services roles is designed primarily to create administrative level users who can manage applications and provision them. Shared Services also allows the auditing of provisioning and life-cycle management activities to track changes to security objects.

Here is some of the roles specific to Essbase in Shared Services.
Server Roles (Administrator, Create/Delete App, Server Access)
Application Roles (App Manager, DB Manager, Start/Stop Application, Calc, Write, Filter and Read Roles)

Read Introduction to Shared Services System 9 Security and User Management White Paper.

Shared Services is part of Foundation Services which provides a single, shared infrastructure to manage users, security, and metadata. Foundation Services consist of EPM Architect, Hyperion Workspace (Workspace), Hyperion Smart View for Office (Smart View), Hyperion Shared Services, and Hyperion License Server.