assuming I have bought 5 User CALs and now I need to tag these licenses, can some tell me how to determine this?
Microsoft SQL Server CAL licence is used by physical user that accesses the database. If the application that uses the database can differentiate users they need CALs. Even if all your users are using the same database login (which is very common with web apps) but they are differentiable by the application (again, majority of web apps) they they all use CALs.
In other words, if you set some set of "users", be it in application using SQL Server or in SQL Server itself (when the application is smart enough to use database authentication), each and every one of them needs a CAL. In most cases this means that any employee using the system needs to have a CAL assigned.
What's more, with SQL Server, you need CALs on the Windows Server running underneath (and it has to be Windows Server, desktop version licences disallow running network services other than file and printing to other computers) unless it's Windows Web Server.
As with all licensing questions: don't believe me, contact your local MS representative, they're the authoritative guys.