src/authentic2/manager/tables.py

@@ -269,7 +269,7 @@ class OuUserRolesTable(Table):
             gettext_noop('This role is synchronised from LDAP, changing members is not allowed.'),
         ),
         verbose_name=_('Member'),
-        order_by=('member', 'via', 'name'),
+        order_by=('-member', 'name'),
         attrs={'td': {'class': 'member'}},
     )
 

src/authentic2/manager/user_views.py

@@ -708,12 +708,13 @@ class UserRolesView(HideOUColumnMixin, BaseSubTableView):
     def get_table_queryset(self):
         if self.is_ou_specified():
             roles = self.object.roles.all()
-            User = get_user_model()
             rp_qs = RoleParenting.alive.filter(child__in=roles)
             qs = Role.objects.all()
             qs = qs.prefetch_related(models.Prefetch('child_relation', queryset=rp_qs, to_attr='via'))
-            qs = qs.prefetch_related(
-                models.Prefetch('members', queryset=User.objects.filter(pk=self.object.pk), to_attr='member')
+            qs = qs.annotate(
+                member=models.Exists(
+                    Role.members.through.objects.filter(role_id=models.OuterRef('pk'), user_id=self.object.pk)
+                )
             )
             qs2 = self.request.user.filter_by_perm('a2_rbac.manage_members_role', qs)
             managable_ids = [str(pk) for pk in qs2.values_list('pk', flat=True)]
@@ -723,12 +724,6 @@ class UserRolesView(HideOUColumnMixin, BaseSubTableView):
         else:
             return self.object.roles_and_parents()
 
-    def get_table_data(self):
-        qs = super().get_table_data()
-        if self.is_ou_specified():
-            qs = list(qs)
-        return qs
-
     def dispatch(self, request, *args, **kwargs):
         response = super().dispatch(request, *args, **kwargs)  # pylint: disable=assignment-from-no-return
         if response is not None: