Validates principal, role
Creating a group global role also creates global role for members.
  Follows standard group roles implementation and allows scm
  permissions helper to observe group permissions
Destroy global roles when destroying user
Destroy global roles when destroy group