Map/filter role_id with ldap multi-value attribute