ArgoCD通过Dex集成LDAP时RBAC策略无法正常分配问题求助

大家好，我目前在做ArgoCD和LDAP的集成（通过Dex），遇到了一个很棘手的权限问题，想请教下各位：

用LDAP用户登录ArgoCD后，完全获取不到我在argocd-rbac-cm的policy.csv里指定的自定义权限策略，但奇怪的是，这个用户却能正常继承我设置的policy.default对应的角色权限！

问题复现相关配置 #

以下是我当前的关键配置内容：

argocd-cm配置：

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-cm
  namespace: argocd
  labels:
    app.kubernetes.io/component: server
    app.kubernetes.io/instance: argocd
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: argocd-cm
    app.kubernetes.io/part-of: argocd
    app.kubernetes.io/version: v2.10.6
    helm.sh/chart: argo-cd-6.7.11
    k8slens-edit-resource-version: v1
  annotations:
    meta.helm.sh/release-name: argocd
    meta.helm.sh/release-namespace: argocd
data:
  admin.enabled: 'true'
  application.instanceLabelKey: argocd.argoproj.io/instance
  dex.config: |
    connectors:
    - type: ldap
      id: ldap
      name: LDAP
      config:
        host: ldap.example.com:389
        bindDN: cn=admin,dc=example,dc=com
        bindPW: password
        userSearch:
          baseDN: ou=users,dc=example,dc=com
          filter: "(objectClass=inetOrgPerson)"
          username: uid
          idAttr: DN
          emailAttr: mail
          nameAttr: cn
        groupSearch:
          baseDN: ou=groups,dc=example,dc=com
          filter: "(objectClass=groupOfNames)"
          userMatchers:
          - userAttr: DN
            groupAttr: member
          nameAttr: cn
  url: https://argocd.example.com

argocd-rbac-cm配置：

apiVersion: v1
kind: ConfigMap
metadata:
  name: argocd-rbac-cm
  namespace: argocd
  labels:
    app.kubernetes.io/component: server
    app.kubernetes.io/instance: argocd
    app.kubernetes.io/managed-by: Helm
    app.kubernetes.io/name: argocd-rbac-cm
    app.kubernetes.io/part-of: argocd
    app.kubernetes.io/version: v2.10.6
    helm.sh/chart: argo-cd-6.7.11
    k8slens-edit-resource-version: v1
  annotations:
    meta.helm.sh/release-name: argocd
    meta.helm.sh/release-namespace: argocd
data:
  policy.csv: |
    p, role:dev, applications, *, */*, allow
    p, role:dev, clusters, get, *, allow
    p, role:dev, repositories, get, *, allow
    g, cn=dev-team,ou=groups,dc=example,dc=com, role:dev
  policy.default: role:readonly

我已经确认登录的LDAP用户确实属于dev-team组，但登录后只能拿到readonly角色的权限，完全没有dev角色的权限。有没有大佬遇到过类似的问题，或者能帮我排查下哪里配置出错了？

备注：内容来源于stack exchange，提问作者Behnia FB