Deleting Roles at Sign In

We are allowing Self Service outside the network. There is a requirement, if user is accessing Self Service from outside the network, they should not have non-self service roles. So I modified  LDAP_AUTHENTICATION() function to check URL, if they are using external self service URL, delete all the non-selfservice roles using SQLEXEC Delete command. Delete command works fine from SQL but even though it gets executed from  LDAP_AUTHENTICATION(), it doesn't save deletions in the database. Do I need to use CI code to make these changes? Or SQLExec delete should be able to delete roles at the time of sign