Here is a draft patch that seems to work with some simple tests. I've yetto look into the role name side of things.
-- nathan