diff --git a/authfilters/src/main/java/cz/incad/kramerius/auth/thirdparty/shibb/internal/InternalAuthenticatedUsersImpl.java b/authfilters/src/main/java/cz/incad/kramerius/auth/thirdparty/shibb/internal/InternalAuthenticatedUsersImpl.java
index e441796871..233cb18ea0 100644
--- a/authfilters/src/main/java/cz/incad/kramerius/auth/thirdparty/shibb/internal/InternalAuthenticatedUsersImpl.java
+++ b/authfilters/src/main/java/cz/incad/kramerius/auth/thirdparty/shibb/internal/InternalAuthenticatedUsersImpl.java
@@ -1,8 +1,12 @@
 package cz.incad.kramerius.auth.thirdparty.shibb.internal;
 
 import java.sql.SQLException;
+import java.util.ArrayList;
+import java.util.Arrays;
 import java.util.List;
+import java.util.stream.Collectors;
 
+import cz.incad.kramerius.security.Role;
 import org.apache.commons.configuration.ConfigurationException;
 import org.json.JSONException;
 
@@ -36,10 +40,19 @@ protected String updateExistingUser(String userName, ShibbolethUserWrapper w) th
         UserUtils.associateGroups(u, this.usersManager);
         UserUtils.associateCommonGroup(u, this.usersManager);
         String password = GeneratePasswordUtils.generatePswd();
-        List<String> roles = w.getRoles();
-        this.usersManager.saveUserPassword(u, password);
-        if (roles.size() > 0) {
-            this.usersManager.changeRoles(u, roles);
+
+        User userByLoginName = this.usersManager.findUserByLoginName(userName);
+        Role[] groups = userByLoginName.getGroups();
+
+        List<String> fromDb = Arrays.stream(groups).map(Role::getName).collect(Collectors.toList());
+        List<String> fromSettings = new ArrayList<>(w.getRoles());
+
+        int max = Math.min(fromDb.size(), fromSettings.size());
+        for(int i=0;i<max;i++) {
+            fromDb.remove(fromSettings.remove(0));
+        }
+        if (!fromDb.isEmpty() || !fromSettings.isEmpty()) {
+            this.usersManager.changeRoles(u, w.getRoles());
         }
         return password;
     }
diff --git a/rest/src/main/java/cz/incad/kramerius/rest/api/guice/ApiServletModule.java b/rest/src/main/java/cz/incad/kramerius/rest/api/guice/ApiServletModule.java
index 5862c5ba70..ab6d941cdc 100644
--- a/rest/src/main/java/cz/incad/kramerius/rest/api/guice/ApiServletModule.java
+++ b/rest/src/main/java/cz/incad/kramerius/rest/api/guice/ApiServletModule.java
@@ -30,6 +30,7 @@
 import cz.incad.kramerius.rest.api.k5.admin.vc.VirtualCollectionsResource;
 import cz.incad.kramerius.rest.api.k5.client.JSONDecorator;
 import cz.incad.kramerius.rest.api.k5.client.SolrMemoization;
+import cz.incad.kramerius.rest.api.k5.client.debug.HTTPHeaders;
 import cz.incad.kramerius.rest.api.k5.client.feedback.FeedbackResource;
 import cz.incad.kramerius.rest.api.k5.client.feeder.FeederResource;
 import cz.incad.kramerius.rest.api.k5.client.feeder.decorators.FeederSolrAuthorDecorate;
@@ -96,6 +97,9 @@ protected void configureServlets() {
 
         bind(StatisticsResource.class);
 
+        // debug resource
+        bind(HTTPHeaders.class);
+
         bind(SolrMemoization.class).to(SolrMemoizationImpl.class)
                 .asEagerSingleton();
 
diff --git a/rest/src/main/java/cz/incad/kramerius/rest/api/k5/client/debug/HTTPHeaders.java b/rest/src/main/java/cz/incad/kramerius/rest/api/k5/client/debug/HTTPHeaders.java
new file mode 100644
index 0000000000..2b2631c459
--- /dev/null
+++ b/rest/src/main/java/cz/incad/kramerius/rest/api/k5/client/debug/HTTPHeaders.java
@@ -0,0 +1,48 @@
+package cz.incad.kramerius.rest.api.k5.client.debug;
+
+import com.google.inject.Inject;
+import com.google.inject.Provider;
+import cz.incad.kramerius.ObjectPidsPath;
+import cz.incad.kramerius.rest.api.exceptions.ActionNotAllowedXML;
+import cz.incad.kramerius.rest.api.k5.client.item.exceptions.PIDNotFound;
+import cz.incad.kramerius.security.SecuredActions;
+import cz.incad.kramerius.service.ReplicateException;
+import cz.incad.kramerius.service.replication.FormatType;
+import cz.incad.kramerius.utils.IOUtils;
+
+import javax.servlet.http.HttpServletRequest;
+import javax.ws.rs.*;
+import javax.ws.rs.core.MediaType;
+import javax.ws.rs.core.Response;
+import javax.ws.rs.core.StreamingOutput;
+import java.io.ByteArrayInputStream;
+import java.io.IOException;
+import java.io.OutputStream;
+import java.io.StringWriter;
+import java.util.Enumeration;
+import java.util.Properties;
+
+@Path("/v5.0/debug")
+public class HTTPHeaders {
+
+    @Inject
+    Provider<HttpServletRequest> requestProvider;
+
+    @GET
+    @Path("headers")
+    @Produces({ MediaType.TEXT_PLAIN + ";charset=utf-8" })
+    public String headers() throws IOException {
+        Properties properties = new Properties();
+        HttpServletRequest httpServletRequest = requestProvider.get();
+        Enumeration headerNames = httpServletRequest.getHeaderNames();
+        while (headerNames.hasMoreElements()) {
+            Object o = headerNames.nextElement();
+            String val = httpServletRequest.getHeader(o.toString());
+            properties.put(o, val);
+        }
+        StringWriter writer = new StringWriter();
+        properties.store(writer,"HTTP Request headers");
+        return writer.toString();
+    }
+
+}