GWT-590: assinging users to group/role combinations