diff --git a/accounts/pkg/storage/cs3.go b/accounts/pkg/storage/cs3.go
index b02d750fd..5c253c5c0 100644
--- a/accounts/pkg/storage/cs3.go
+++ b/accounts/pkg/storage/cs3.go
@@ -302,7 +302,7 @@ func AuthenticateCS3(ctx context.Context, su config.ServiceUser, tm token.Manage
 		UidNumber: su.UID,
 		GidNumber: su.GID,
 	}
-	s, err := scope.GetOwnerScope()
+	s, err := scope.AddOwnerScope(nil)
 	if err != nil {
 		return
 	}
diff --git a/ocs/pkg/server/http/svc_test.go b/ocs/pkg/server/http/svc_test.go
index 9a284d0c1..7d3ea6a2c 100644
--- a/ocs/pkg/server/http/svc_test.go
+++ b/ocs/pkg/server/http/svc_test.go
@@ -654,7 +654,7 @@ func mintToken(ctx context.Context, su *User, roleIds []string) (token string, e
 		UidNumber: int64(su.UIDNumber),
 		GidNumber: int64(su.GIDNumber),
 	}
-	s, _ := scope.GetOwnerScope()
+	s, _ := scope.AddOwnerScope(nil)
 	return tokenManager.MintToken(ctx, u, s)
 }
 
diff --git a/ocs/pkg/service/v0/users.go b/ocs/pkg/service/v0/users.go
index 3cabff977..d76722059 100644
--- a/ocs/pkg/service/v0/users.go
+++ b/ocs/pkg/service/v0/users.go
@@ -490,7 +490,7 @@ func (o Ocs) mintTokenForUser(ctx context.Context, account *accounts.Account) (s
 		UidNumber:                account.UidNumber,
 		GidNumber:                account.GidNumber,
 	}
-	s, err := scope.GetOwnerScope()
+	s, err := scope.AddOwnerScope(nil)
 	if err != nil {
 		return "", err
 	}
diff --git a/proxy/pkg/middleware/account_resolver.go b/proxy/pkg/middleware/account_resolver.go
index 6aa829c49..3bfa4e7f3 100644
--- a/proxy/pkg/middleware/account_resolver.go
+++ b/proxy/pkg/middleware/account_resolver.go
@@ -92,7 +92,7 @@ func (m accountResolver) ServeHTTP(w http.ResponseWriter, req *http.Request) {
 		m.logger.Debug().Interface("claims", claims).Interface("user", u).Msgf("associated claims with uuid")
 	}
 
-	s, err := scope.GetOwnerScope()
+	s, err := scope.AddOwnerScope(nil)
 	if err != nil {
 		m.logger.Error().Err(err).Msgf("could not get owner scope")
 		return
diff --git a/proxy/pkg/user/backend/cs3.go b/proxy/pkg/user/backend/cs3.go
index 3443667a8..8a49616e3 100644
--- a/proxy/pkg/user/backend/cs3.go
+++ b/proxy/pkg/user/backend/cs3.go
@@ -53,9 +53,12 @@ func (c *cs3backend) GetUserByClaims(ctx context.Context, claim, value string, w
 		return user, nil
 	}
 
-	roleIDs, err := loadRolesIDs(ctx, user.Id.OpaqueId, c.settingsRoleService)
-	if err != nil {
-		c.logger.Error().Err(err).Msg("Could not load roles")
+	var roleIDs []string
+	if user.Id.Type != cs3.UserType_USER_TYPE_LIGHTWEIGHT {
+		roleIDs, err = loadRolesIDs(ctx, user.Id.OpaqueId, c.settingsRoleService)
+		if err != nil {
+			c.logger.Error().Err(err).Msgf("Could not load roles")
+		}
 	}
 
 	if len(roleIDs) == 0 {
diff --git a/settings/pkg/service/v0/validator.go b/settings/pkg/service/v0/validator.go
index f5d35685f..246b71c66 100644
--- a/settings/pkg/service/v0/validator.go
+++ b/settings/pkg/service/v0/validator.go
@@ -9,7 +9,7 @@ import (
 )
 
 var (
-	regexForAccountUUID = regexp.MustCompile(`^[A-Za-z0-9\-_.+@]+$`)
+	regexForAccountUUID = regexp.MustCompile(`^[A-Za-z0-9\-_.+@:]+$`)
 	requireAccountID    = []validation.Rule{
 		// use rule for validation error message consistency (".. must not be blank" on empty strings)
 		validation.Required,