It's very common that a LDAP login module is linked together with a org.jboss.security.auth.spi.RoleMappingLoginModule.
Very often LDAP roles are not mapped directly with the roles defined for the business central or kie server application and you need an explicit mapping (with a property file).
RHPAM openshift templates for PAM currently don't support properties to add a org.jboss.security.auth.spi.RoleMappingLoginModule configuration.