fix for domain-server allowed roles