add role association for groups and resources