Besides using DTO's, you should probably also separate user creation and role assignment so that you can re-use that code that assigns a role without having to create a user before.