map ldap group to roleId with role label without prefix (correct)