Solved it....I think...amazing what hot water on your head in the shower does.

a) count the number of rows for each role type from the roles table.

b) do the join on group between the role and LDAP table.

c) count the number of times a distinct user appears per role.

d) if that count is the same as the count of groups per role then it's a match.

I'll code it up later and see if it works, got to tile a roof now.

Part of the problem is that I was trying to do something impossible and/or unwarranted which was to isolate the "biggest" role a user had, by that I mean if they were a member of a role who's groups were a superset of another role then I was trying to only extract the superset role....not required!