Hi Jerry.
It's most likely your user has not enough authorization to read org. data. This is why this step may fail. Trace user's authorization.
PFCG role is used to find a business role which has this PFCG role assigned. But again if the user has no authorization to read his own PFCG roles this step may fail. The authorization trace will be a good help here too.