fix for domain-server allowed roleS