Login in Always On Availability Groups
Putting in a simple language :

A login gives you access to server.

A user gives you access to database.

A login must map a user so that you can access the database.


For SQL Authentication, you should create the login with SAME SID and map it to your user database/s on all the nodes with proper permissions (follow the principle of least privileged). This script will help you or this SSMS addin from sqlskills.

For Windows Authentication, you should create a login and map it to your user database. Create/transfer the same login to other nodes.

A listener is a virtual interface and has nothing to do with logins or users.