How to evaluate role attributes during KC login/authorization?

By default KC supports custom attributes for roles.

I want to add two attributes – role validation datetime from and role validation datetime to.

How it would be possible during KC authorization mechanism/flow to evaluate those custom attributes (to check role validity)? Where to start read from?

Ez-pz. Clients->Mappers->Script mapper. Do what you want, return as you need.