[solved] pas.plugin.ldap - when/where happens the assiginment of memberrole?

I'm a bit slow today. I have two Installations of Plone 5.2.2 with pas.plugin.ldap. After login, in the first system the user has the member role, in the second system the same user is only authenticated, but is not a member. has anyone a hint, where i looking or find the assingment to member-role? What is the default - only Authenticated or Member Role?

If in acl_users -> plugins -> roles plugins the pasldap plugin not activated, the memberrole is not assigned