Note:

By default, Publisher allows every LDAP user to log in to the system even when no Publisher-specific roles are assigned to the user. Users cannot perform any functions that require roles, such as creating reports or data models; however if a user is assigned a role assigned permissions on catalog objects (such as traverse and open) the user can perform those tasks.

To prevent users from logging in to Publisher unless they have a Publisher role assigned, see Disable Users Without Publisher-Specific Roles from Logging In.