The roles checking in mod_auth_josso only checks the first of the users' roles. It should check to see if any of the roles for the user match what are required by the httpd configuration
Per Forum post: https://sourceforge.net/forum/forum.php?thread_id=3221262&forum_id=399715