In my keycloak instance the problem was that "Add to userinfo" was not selected in client scope "client roles". Ticking this checkbox solved the issue for me.