MDM integration is fortchoming in the next release I believe (5.x) for UAC (8.x) for SSL. The rumor mill says Airwatch and Mobile Iron. Last I heard was this is slated for November. It will function like host check. So role mapping can be based on MDM attribute matching.