search expanded role list, not just explicit roles

Change-Id: I98258c979114dc8305c9957119a15c045c444f4e