create ldap user
constraints on roles table