How to evaluate role attributes during KC login/authorization?

Getting advice
1

By default KC supports custom attributes for roles.

I want to add two attributes – role validation datetime from and role validation datetime to.

How it would be possible during KC authorization mechanism/flow to evaluate those custom attributes (to check role validity)? Where to start read from?

2

Ez-pz. Clients->Mappers->Script mapper. Do what you want, return as you need.