def update_user(user, profile, roles):
    """Updates user with current profile information and associated roles.

    :param user:
    :param profile:
    :param roles:
    """
    # if we get an sso user create them an account
    if not user:
        user = user_service.create(
            profile["email"],
            get_psuedo_random_string(),
            profile["email"],
            True,
            profile.get("thumbnailPhotoUrl"),
            roles,
        )

    else:
        # we add 'lemur' specific roles, so they do not get marked as removed
        removed_roles = []
        for ur in user.roles:
            if not ur.third_party:
                roles.append(ur)
            elif ur not in roles:
                # This is a role assigned in lemur, but not returned by sso during current login
                removed_roles.append(ur.name)

        if removed_roles:
            log_service.audit_log("unassign_role", user.username, f"Un-assigning roles {removed_roles}")
        # update any changes to the user
        user_service.update(
            user.id,
            profile["email"],
            profile["email"],
            True,
            profile.get("thumbnailPhotoUrl"),  # profile isn't google+ enabled
            roles,
        )

    return user
Updates user with current profile information and associated roles.

    :param user:
    :param profile:
    :param roles:
    
lemur/auth/views.py