adding support for ignore-tenant-roles