How to link users and logins in an Availability Group?

Question

I've got an Availability Group going and need to map some logins to database users on an active secondary replica. (Node2) Unfortunately, when I try to exec sp_change_users_login or alter user with login, I get an error message telling me the database is read-only. That's no surprise, but I'm not sure how to fix it. I tried failing over last night, fixing the logins on Node2, and then failing back to Node1, but then the login/user mappings just end up wrong on Node1. When I fix those, Node2's logins get out of whack again.

This is a production system, so I can't do anything I want until later tonight. I didn't run into this problem in our test lab. The difference may be that I created the logins before joining the databases before, whereas this time I tried to create them afterwards, and failed to document the process correctly. Taking the AG down and rebuilding it is something I'd rather avoid if I can.

The problem makes sense to me, I just don't really know how to fix it.