I was probably not specific enough in describing the problem. They might also want to filter by properties that are not roles but business-related attributes. The issue is that the filtering criteria could be a mix of business data and Keycloak data.