You have to do a role mapping when you configure the external IDP. This will map a claim coming from the external IDP to a local role (say test-role). See the section 'Add the following role mapping under the Role Configuration section:' in [1]

[1] https://apim.docs.wso2.com/en/latest/install-and-setup/setup/sso/configuring-identity-server-as-external-idp-using-oidc/#configure-the-api-manager