I have recently worked with khoros to find a 'fix' for the issue that stopped us being able to send multiple roles in the SAML assertion at user log in.
Currently we are using the method using Okta rules / Workflows to push this via API to Khoros, which is triggered by the user being added to the Okta group.
The 'fix' requires a ticket with Khoros who can change the expected format from CSV to JSON obejct list and then you can push multiple roles to a user on log in by matching up Okta group membership name to role name in Khoros.
this same method can be used to remove roles / access too.