When mapping roles directly from the identity:

<access-control provider="rbac" use-identity-roles="true"/>

If the identity has a role that is not known, a UnknowRoleException is thrown.

Ideally, we should just ignore unknown roles. Or is there any reason for this check ?