Roles now get pulled in from LDAP