I'm trying to configure an application that can only parse "Roles" from the access token (not "Groups) and have set up an role-ldap-mapper to grab a set of specific LDAP groups begining with say (cn=foo-*) and create client roles. This works, except that users are not showing as a member of this client role unless I specifically add them in KC. Is this not supposed to be automatic using the configured mapper "memberOf" user attribute for a user with that particular LDAP group?