"Must be able to" necessity reference

"User must be able to login through google SSO"

Does this rule express a necessity for the user or application? I mean that the USER must have the ability for login, or application must let users to login through google?

Without context, it's impossible to say. Ask for clarification.

It could mean:

• Application users must have a Google account they can use for authentication.
• The application must allow Google SSO for users who have it.
• Only Google SSO will be allowed for application login.

It could also mean something else entirely. Badly-written requirements are regrettably common.