tokenmanagerclient supports roles