title: Keycloak Identity Provider role sync
body: <p>I would like to map external openid-connect provider roles to my keycloak client roles.</p>
  <p>In order to do this I have configured Identity Provider (in my case it's another Keycloak instance). Logging in to the main keycloak through the second instance works like a charm.</p>
  <p>We have a requirement to assign roles in our server based on the external roles. In order to that I have configured for <code>Role mapper</code> of type <code>External role to role</code> for my Identity Provider. Works like a charm.</p>
  <p>User John want to log in <code>Keycloak A</code>, goes to external IDP (<code>Keycloak B</code>). <code>Keycloak B</code> authenticates user and return JWT token with role <code>X</code>. My <code>Keycloak A</code> is configured to map role <code>X</code> to role <code>Y</code>.</p>
  <p>The problem is that once <code>Keycloak B</code> administrator removes John from role <code>X</code> he can still log in through to my system (as intended) but role <code>Y</code> is not removed. Any chance to sync roles instead of only mapping it once?</p>