I did everything you wrote, but the result was the same - no roles in the access token.

{
  "aud": "",
  "iss": "",
  "iat": 174,
  "nbf": 174,
  "exp": 174,
  "aio": "",
  "azp": "",
  "azpacr": "0",
  "email": "",
  "family_name": "",
  "given_name": "",
  "name": "",
  "oid": "",
  "preferred_username": "",
  "rh": "",
  "scp": "Api.Access",
  "sid": "",
  "sub": "",
  "tid": "",
  "uti": "",
  "ver": "2.0"
}

What was wrong?