[keycloak-user] Best practice for getting roles for all users