two-stage join on LocalUserRoles