Eh, found it.
What I needed to do is to enable security subpanel (see thread above) and only then I was able to assing appropriate security group (which included my users and roles).
So the trick was that security subpanel was not visible and therefore rights could not be assigned.