extract ldap role mapping
reverse role lookup
map roles to ldap groups