Index: lams_build/conf/unix/authentication/authentication.xml
===================================================================
diff -u -r2f70901e70bedfd5bafb0d850b7f461205690b1a -r48b4a2b4dc664ec5176ba9a62c505d59aed16f44
--- lams_build/conf/unix/authentication/authentication.xml	(.../authentication.xml)	(revision 2f70901e70bedfd5bafb0d850b7f461205690b1a)
+++ lams_build/conf/unix/authentication/authentication.xml	(.../authentication.xml)	(revision 48b4a2b4dc664ec5176ba9a62c505d59aed16f44)
@@ -21,15 +21,27 @@
 <Method Name="LAMS-Database" Enabled="true">
 	<Param Name="dsJndiName">java:/jdbc/lams-ds</Param>
 	<Param Name="principalsQuery">select password from lams_user where login=?</Param>
-	<Param Name="rolesQuery">select name,'Roles' from lams_role, lams_user where login=?</Param>
+	<Param Name="rolesQuery">
+	            SELECT DISTINCT  r.name,'Roles' FROM
+             	lams_user u LEFT OUTER JOIN lams_user_organisation uo USING(user_id)
+             	LEFT OUTER JOIN lams_user_organisation_role urr USING(user_organisation_id)
+             	LEFT OUTER JOIN lams_role r USING (role_id)
+             	WHERE u.login=?
+	</Param>
 </Method>
 
 <Method Name="Oxford-WebAuth" Enabled="true">
 	<Param Name="WebAuthTokenName">WEBAUTH_USER</Param>
 	<Param Name="WebAuthTriggerPage">https://array00.melcoe.mq.edu.au/webauth.html</Param>
 	<Param Name="DummyPasswordForWebAuthUser">dummy</Param>
 	<Param Name="dsJndiName">java:/MySqlDS</Param>
-	<Param Name="rolesQuery">select name,'Roles' from lams_role, lams_user where login=?</Param>
+	<Param Name="rolesQuery">
+	            SELECT DISTINCT  r.name,'Roles' FROM
+             	lams_user u LEFT OUTER JOIN lams_user_organisation uo USING(user_id)
+             	LEFT OUTER JOIN lams_user_organisation_role urr USING(user_organisation_id)
+             	LEFT OUTER JOIN lams_role r USING (role_id)
+             	WHERE u.login=?
+	</Param>
 </Method>
 
 <!-- NOT in USE -->
@@ -47,7 +59,13 @@
 	<Param Name="com.lams.naming.import.ldap.factory.initial">com.sun.jndi.ldap.LdapCtxFactory</Param>
 	<Param Name="dsJndiName">java:/MySqlDS</Param>
 	<Param Name="principalsQuery">select password from lams_user where login=?</Param>
-	<Param Name="rolesQuery">select name,'Roles' from lams_role, lams_user where login=?</Param>
+	<Param Name="rolesQuery">
+	           	SELECT DISTINCT  r.name,'Roles' FROM
+             	lams_user u LEFT OUTER JOIN lams_user_organisation uo USING(user_id)
+             	LEFT OUTER JOIN lams_user_organisation_role urr USING(user_organisation_id)
+             	LEFT OUTER JOIN lams_role r USING (role_id)
+             	WHERE u.login=?
+	</Param>
 </Method>
 
 </Authentication>
Index: lams_build/conf/unix/jboss/login-config.xml
===================================================================
diff -u -rb67813d38e249ddd9819b003a333ebb57c033d97 -r48b4a2b4dc664ec5176ba9a62c505d59aed16f44
--- lams_build/conf/unix/jboss/login-config.xml	(.../login-config.xml)	(revision b67813d38e249ddd9819b003a333ebb57c033d97)
+++ lams_build/conf/unix/jboss/login-config.xml	(.../login-config.xml)	(revision 48b4a2b4dc664ec5176ba9a62c505d59aed16f44)
@@ -155,7 +155,13 @@
           <login-module code = "org.jboss.security.auth.spi.DatabaseServerLoginModule" flag = "required">
              <module-option name="dsJndiName">java:/MySqlDS</module-option>
              <module-option name="principalsQuery">select password from lams_user where login=?</module-option>
-             <module-option name="rolesQuery">select name,'Roles' from lams_role, lams_user where login=?</module-option>
+             <module-option name="rolesQuery">
+	            SELECT DISTINCT  r.name,'Roles' FROM
+             	lams_user u LEFT OUTER JOIN lams_user_organisation uo USING(user_id)
+             	LEFT OUTER JOIN lams_user_organisation_role urr USING(user_organisation_id)
+             	LEFT OUTER JOIN lams_role r USING (role_id)
+             	WHERE u.login=?
+             </module-option>
           </login-module>
        </authentication>
     </application-policy>
Index: lams_build/conf/windows/authentication/authentication.xml
===================================================================
diff -u -r2f70901e70bedfd5bafb0d850b7f461205690b1a -r48b4a2b4dc664ec5176ba9a62c505d59aed16f44
--- lams_build/conf/windows/authentication/authentication.xml	(.../authentication.xml)	(revision 2f70901e70bedfd5bafb0d850b7f461205690b1a)
+++ lams_build/conf/windows/authentication/authentication.xml	(.../authentication.xml)	(revision 48b4a2b4dc664ec5176ba9a62c505d59aed16f44)
@@ -12,7 +12,13 @@
 	<Param Name="principalDNSuffix">,ou=mams,dc=melcoe,dc=mq,dc=edu,dc=au</Param>
 	<Param Name="dsJndiName">java:/MySqlDS</Param>
 	<Param Name="principalsQuery">select password from lams_user where login=?</Param>
-	<Param Name="rolesQuery">select name,'Roles' from lams_role, lams_user where login=?</Param>
+	<Param Name="rolesQuery">
+             	SELECT DISTINCT  r.name,'Roles' FROM
+             	lams_user u LEFT OUTER JOIN lams_user_organisation uo USING(user_id)
+             	LEFT OUTER JOIN lams_user_organisation_role urr USING(user_organisation_id)
+             	LEFT OUTER JOIN lams_role r USING (role_id)
+             	WHERE u.login=?
+	</Param>
 	<Param Name="truststore.path">D:/MQLdapTrustStore</Param>
 	<Param Name="truststore.password">webauth</Param>
 </Method>
@@ -21,15 +27,27 @@
 <Method Name="LAMS-Database" Enabled="true">
 	<Param Name="dsJndiName">java:/jdbc/lams-ds</Param>
 	<Param Name="principalsQuery">select password from lams_user where login=?</Param>
-	<Param Name="rolesQuery">select name,'Roles' from lams_role, lams_user where login=?</Param>
+	<Param Name="rolesQuery">
+	            SELECT DISTINCT  r.name,'Roles' FROM
+             	lams_user u LEFT OUTER JOIN lams_user_organisation uo USING(user_id)
+             	LEFT OUTER JOIN lams_user_organisation_role urr USING(user_organisation_id)
+             	LEFT OUTER JOIN lams_role r USING (role_id)
+             	WHERE u.login=?
+	</Param>
 </Method>
 
 <Method Name="Oxford-WebAuth" Enabled="true">
 	<Param Name="WebAuthTokenName">WEBAUTH_USER</Param>
 	<Param Name="WebAuthTriggerPage">https://array00.melcoe.mq.edu.au/webauth.html</Param>
 	<Param Name="DummyPasswordForWebAuthUser">dummy</Param>
 	<Param Name="dsJndiName">java:/MySqlDS</Param>
-	<Param Name="rolesQuery">select name,'Roles' from lams_role, lams_user where login=?</Param>
+	<Param Name="rolesQuery">
+             	SELECT DISTINCT  r.name,'Roles' FROM
+             	lams_user u LEFT OUTER JOIN lams_user_organisation uo USING(user_id)
+             	LEFT OUTER JOIN lams_user_organisation_role urr USING(user_organisation_id)
+             	LEFT OUTER JOIN lams_role r USING (role_id)
+             	WHERE u.login=?
+	</Param>
 </Method>
 
 <!-- NOT in USE -->
@@ -47,7 +65,13 @@
 	<Param Name="com.lams.naming.import.ldap.factory.initial">com.sun.jndi.ldap.LdapCtxFactory</Param>
 	<Param Name="dsJndiName">java:/MySqlDS</Param>
 	<Param Name="principalsQuery">select password from lams_user where login=?</Param>
-	<Param Name="rolesQuery">select name,'Roles' from lams_role, lams_user where login=?</Param>
+	<Param Name="rolesQuery">
+	           	SELECT DISTINCT  r.name,'Roles' FROM
+             	lams_user u LEFT OUTER JOIN lams_user_organisation uo USING(user_id)
+             	LEFT OUTER JOIN lams_user_organisation_role urr USING(user_organisation_id)
+             	LEFT OUTER JOIN lams_role r USING (role_id)
+             	WHERE u.login=?
+	</Param>
 </Method>
 
 </Authentication>
Index: lams_build/conf/windows/jboss/login-config.xml
===================================================================
diff -u -rb67813d38e249ddd9819b003a333ebb57c033d97 -r48b4a2b4dc664ec5176ba9a62c505d59aed16f44
--- lams_build/conf/windows/jboss/login-config.xml	(.../login-config.xml)	(revision b67813d38e249ddd9819b003a333ebb57c033d97)
+++ lams_build/conf/windows/jboss/login-config.xml	(.../login-config.xml)	(revision 48b4a2b4dc664ec5176ba9a62c505d59aed16f44)
@@ -155,7 +155,13 @@
           <login-module code = "org.jboss.security.auth.spi.DatabaseServerLoginModule" flag = "required">
              <module-option name="dsJndiName">java:/MySqlDS</module-option>
              <module-option name="principalsQuery">select password from lams_user where login=?</module-option>
-             <module-option name="rolesQuery">select name,'Roles' from lams_role, lams_user where login=?</module-option>
+             <module-option name="rolesQuery">
+             	SELECT DISTINCT  r.name,'Roles' FROM
+             	lams_user u LEFT OUTER JOIN lams_user_organisation uo USING(user_id)
+             	LEFT OUTER JOIN lams_user_organisation_role urr USING(user_organisation_id)
+             	LEFT OUTER JOIN lams_role r USING (role_id)
+             	WHERE u.login=?
+             </module-option>
           </login-module>
        </authentication>
     </application-policy>