network user/group can have role (refs #3857)