[keycloak-user] Does Keycloak have any provision for defining role based user associations ?