SQL Server 2016 - Availability Groups - How To Copy Permissions To Secondary Node
Use sp_help_revlogin procedure to safely script SQL logins and their passwords (and Windows-authenticated Logins as well), so you can re-create all those logins on secondary replica with exactly same SIDs, as they have on primary replica

https://support.microsoft.com/en-us/help/918992/how-to-transfer-logins-and-passwords-between-instances-of-sql-server

After you create all necessary logins on secondary replica with same SIDs as on primary, you need to use ScriptLoginPermissions procedure, find out if your logins on primary replica have any server-level permissions.

Those are permissions that are stored in the master database. If any of your logins have any server-level permissions on primary, you need to grant those permissions on secondary replica to these logins. ScriptLoginPermissions procedure helps you to generate T-SQL for that, it can be found here:
https://github.com/aleksey-vitsko/Database-Administrator-Tools

Database level permissions, that are granted at user-database level, you do not need to grant those at secondary replica.
And you do not need to do login to user mapping at secondary replica. Because any permission or user changes at primary, are copied to secondaries automatically, in Availability Groups.

You do not need to do any failover, all database-level permissions on primary, are also synchronized to secondary replica. You can't do any changes to permissions on secondary replica's, because user databases there are in read-only state
p.s. Important to have logins on primary and secondary replicas with matching SID (security identifiers, which can be seen at sys.server_principals)