When a user enters geoNetwork through ECAS, it checks if it is already on the database (and create it, if not). If it is a new user, it assigns the role GUEST. It does not yet connect to LDAP for profiles and roles.