Howard Miller

I'm not sure that this helps, but users are assigned to role within contexts (site, course category, course and so on). Roles are not given to users. It's an important distinction if you are trying to find that mapping. It's also important to realise that somebody can be a teacher in one course and a student in another. So this is complicated by what your roles in Keycloak actually mean in Moodle.

You mean that you don't even want them to know it exists?

You're going to be disappointed, I'm afraid - https://tracker.moodle.org/browse/MDL-31219

Essentially, you only enrol users in the courses that they want to see. That's fundamentally how Moodle works.

If you want to automate that somewhat, you probably need to be looking at Cohorts and Cohort_sync

Hit uninstall on the plugins list. It certainly can't hurt.