idp: roles are inserted after schema creation