NEXUS-5998: no need to (re)fetch group membership unless using static mapping (because with dynamic mapping the membership details are already populated)
NEXUS-5998: short-circuit LDAP role-search if none of the roles exist in LDAP