Why
So UPS knows the appropriate permissions to apply to API calls from users who logged in with their OpenShift credentials

Suggestions

See the proposal here for the suggested mapping of permissions

• https://github.com/aerogear/proposals/pull/31/files#diff-c182d8cdedd6f2f1a144e5955fd1f785R47

See how these permission mappings are checked in the Jenkins login plugins

• https://github.com/openshift/jenkins-openshift-login-plugin#openshift-role-to-jenkins-permission-mapping
• https://github.com/openshift/jenkins-openshift-login-plugin/blob/e4b242d623dbe4a3c40e61da2ea67f64a075e3ea/src/main/java/org/openshift/jenkins/plugins/openshiftlogin/OpenShiftOAuth2SecurityRealm.java#L802-L862