proxy role is required to check user reference into acl_user