Do not push user-role changes to LDAP if roles are marked as readonly