Extract puavo-ldap role from the playbook
display better error
use ExitOnForwardFailure on tunnel example