LDAP Group to Role issue with user in two groups that have overlapping roles

Given two group mapping files and a user that is in both LDAP groups.
The user authenticates to StackStorm and only has the roles from groupB.

$ st2 --version
st2 2.3.2

/opt/stackstorm/rbac/mappings/groupA.yaml
---
  group: CN=groupA,OU=Groups,DC=corp,DC=company,DC=test
  description: GroupA Users
  roles:
    - base_permissions
    - role1
    - role2
    - role3

/opt/stackstorm/rbac/mappings/groupB.yaml
---
  group: CN=groupB,OU=Groups,DC=corp,DC=company,DC=test
  description: GroupB Users
  roles:
    - base_permissions
    - role4
    - role5

This is evident by running st2 role-assignment list commands as well as the action_context.rbac.roles within an action:

$ st2 role-assignment list -t 786689b58f5747139c18780c3237d40d|grep userA
| 59c19829968d09215be615e8| base_permissions       | userA             | True      | Automatic role         |
| 59c19829968d09215be615e9| role4                  | userA             | True      | Automatic role         |
| 59c19829968d09215be615ea| role5                  | userA             | True      | Automatic role         |

Mongo queries:

> db.user_role_assignment_d_b.find({"user": "userA"})
{ "_id" : ObjectId("59c19829968d09215be615e8"), "user" : "userA", "role" : "base_permissions", "description" : "Automatic role assignment based on the remote user membership in group \"CN=groupB,OU=Groups,DC=corp,DC=company,DC=test\"", "is_remote" : true }
{ "_id" : ObjectId("59c19829968d09215be615e9"), "user" : "userA", "role" : "role4", "description" : "Automatic role assignment based on the remote user membership in group \"CN=groupB,OU=Groups,DC=corp,DC=company,DC=test\"", "is_remote" : true }
{ "_id" : ObjectId("59c19829968d09215be615ea"), "user" : "userA", "role" : "role5", "description" : "Automatic role assignment based on the remote user membership in group \"CN=groupB,OU=Groups,DC=corp,DC=company,DC=test\"", "is_remote" : true }

We also see an error in the st2auth.log:

$ tail -f /var/log/st2/st2auth.log
  File "/opt/stackstorm/st2/lib/python2.7/site-packages/st2auth/handlers.py", line 202, in handle_auth
    syncer.sync(user_db=user_db, groups=user_groups)
  File "/opt/stackstorm/st2/lib/python2.7/site-packages/st2common/rbac/syncer.py", line 423, in sync

  File "/opt/stackstorm/st2/lib/python2.7/site-packages/st2common/services/rbac.py", line 207, in assign_role_to_user
    role_assignment_db = UserRoleAssignment.add_or_update(role_assignment_db)
  File "/opt/stackstorm/st2/lib/python2.7/site-packages/st2common/persistence/base.py", line 185, in add_or_update
    model_object=model_object)
StackStormDBObjectConflictError: Tried to save duplicate unique keys (E11000 duplicate key error collection: st2.user_role_assignment_d_b index: role_1_user_1 dup key: { : "base_permissions", : "userA" }) [...]

If the common base_permissions role is removed from one of the groups and st2-apply-rbac-definitions is run again and user logs out/in again, all roles will be activated:

$ st2 role-assignment list -t 786689b58f5747139c18780c3237d40d|grep userA
| 59c192ad968d09215be615e1 | base_permissions       | userA             | True      | Automatic role         |
| 59c192ad968d09215be615e2 | role4                  | userA             | True      | Automatic role         |
| 59c192ad968d09215be615e3 | role5                  | userA             | True      | Automatic role         |
| 59c192ad968d09215be615e4 | role1                  | userA             | True      | Automatic role         |
| 59c192ad968d09215be615e5 | role2                  | userA             | True      | Automatic role         |
| 59c192ad968d09215be615e6 | role3                  | userA             | True      | Automatic role         |

Mongo queries:

> db.user_role_assignment_d_b.find({"user": "userA"})
{ "_id" : ObjectId("59c192ad968d09215be615e1"), "user" : "userA", "role" : "base_permissions", "description" : "Automatic role assignment based on the remote user membership in group \"CN=groupB,OU=Groups,DC=corp,DC=company,DC=test\"", "is_remote" : true }
{ "_id" : ObjectId("59c192ad968d09215be615e2"), "user" : "userA", "role" : "role4", "description" : "Automatic role assignment based on the remote user membership in group \"CN=groupB,OU=Groups,DC=corp,DC=company,DC=test\"", "is_remote" : true }
{ "_id" : ObjectId("59c192ad968d09215be615e3"), "user" : "userA", "role" : "role5", "description" : "Automatic role assignment based on the remote user membership in group \"CN=groupB,OU=Groups,DC=corp,DC=company,DC=test\"", "is_remote" : true }
{ "_id" : ObjectId("59c192ad968d09215be615e4"), "user" : "userA", "role" : "role1", "description" : "Automatic role assignment based on the remote user membership in group \"CN=groupA,OU=Groups,DC=corp,DC=company,DC=test\"", "is_remote" : true }
{ "_id" : ObjectId("59c192ad968d09215be615e5"), "user" : "userA", "role" : "role2", "description" : "Automatic role assignment based on the remote user membership in group \"CN=groupA,OU=Groups,DC=corp,DC=company,DC=test\"", "is_remote" : true }
{ "_id" : ObjectId("59c192ad968d09215be615e6"), "user" : "userA", "role" : "role3", "description" : "Automatic role assignment based on the remote user membership in group \"CN=groupA,OU=Groups,DC=corp,DC=company,DC=test\"", "is_remote" : true }

Start with st2auth/handlers.py, st2common/rbac/syncer.py, and st2common/services/rbac.py, following the reported authentication traceback and duplicate-key error. Reproduce a user mapped to both groups, then verify that role synchronization handles overlapping roles without failing and preserves roles from both groups.