roles: add new group role for ldap.