ldap role mapping; referral support