moving tdar role creation earlier so install phase won't fail