Disabling roles in the connector configuration does not actually do anything. The roles tab is visible for users of the directory and the ldap queries for the roles are run. If you don't enable the roles and insert a "sane" value for the role DN then the roles will be queried with just the base DN which in our case results in slow performance as user details will only open after the search times out when browsing individual users in the directory.