start of role-user-claims assigning