Ok, I see what you mean. This sounds like a lot of "round trip" to me and object creation. If for any reason people have simple user class and already extends "Identity", then you'll extract from the identity to create another identity.

In all cases, User will implement "IdentityInterface", so you'll get roles from an IdentityInterface to create another IdentityInterface. I think you really complicate the workflow here, even when debugging, it's not clear because you loose the relationship of the Identity to the User, when people add a breakpoint to Rbac, they'll discover a new Identity class that comes "from nowhere".