LDAP user gains wrong role and created before LDAP sync.

Description:

New LDAP users on our univention server get synchronized over to our rocketchat server (v3.9.3) about every 20 minutes or when triggered manually by an admin of our rocketchat instance.
So users that are eligible to be synced and did not exist on our rocketchat instance pre-sync will be synced.
Depending on the properties of the ldap user, the rocketchat user will have the role 'guest' or 'user'. The default is 'guest'.

So the rocketchat user creation via sync is working totally fine. Here comes the problem:

Logging in to rocketchat with that newly created ldap user before it is synced over to rocketchat / created on our rocketchat instance will cause it to be created and gain the 'user' role instead of 'guest' role.

Causing it to gain more access than it should.

Steps to reproduce:

1. Create an ldap user that is eligible to be synced to rocketchat and gains the 'guest' role when it is synced.
2. Login to rocketchat with that ldap user before the sync has started.
3. Now the user has the role 'user' instead of 'guest'

Expected behavior:

1. Create an ldap user that is eligible to be synced to rocketchat and gains the 'guest' role when it is synced.
2. Login to rocketchat with that ldap user before the sync has started.
3. Now the user has the role 'guest'.

Actual behavior:

1. Create an ldap user that is eligible to be synced to rocketchat and gains the 'guest' role when it is synced.
2. Login to rocketchat with that ldap user before the sync has started.
3. Now the user has the role 'user'.

Server Setup Information:

• Version of Rocket.Chat Server: 3.9.3
• Operating System: Debian GNU/Linux 9.13 (stretch)
• Deployment Method: docker
• Number of Running Instances: 3
• DB Replicaset Oplog:
• NodeJS Version: v12.20.0
• MongoDB Version: 3.6.21

Client Setup Information

• Desktop App or Browser Version: both
• Operating System: Windows 10 Pro, Ubuntu [16.04,18.04,20.04]

Start by reproducing the documented sequence: create an LDAP user eligible for the guest role, log in before synchronization, and compare the resulting role with a post-sync login. Trace the LDAP synchronization and login-created user paths; done means the user receives the guest role and does not gain the additional access associated with the user role.