We employ the user catalog with the "role=" option. This works well for all users except one, for whom the role is not found. What could be the reason?

Quite possibly the user's PC has the the wrong date. The roles in the SAP system are always valid during a certain period of time, and GuiXT checks the validity of a role using the date returned by the frontend PC.