OpenID RoleMapping not working

Description:

I connected Keycloak via OpenID Connect to RocketChat via a custom OAuth Provider according to these instructions. I added a RoleMapping to map the roles defined in Keycloak onto the roles in RocketChat. But none of the roles are actually mapped in RocketChat. Every user gets the default role "user" only.

Steps to reproduce:

1. Add RocketChat as Client to Keycloak with the following settings:
   a. Client Protocol: openid-connect
   b. Access Type: confidential
   c: Standard Flow Enabled: On
   d: Valid Redirect URIs: https://myserver.de/_oauth/keycloak
2. Added some Roles to the Keycloak Client:
   a. Admin
   b. moderator
   c. Owner
3. Added a Mapper in Keycloak:
   a. Mapper Type: User Client Role
   b. Multivalued: On
   c. Token Claim Name: roles
   d. Add to ID token: ON
   e. Add to access token: ON
   f. Add to userinfo: ON
4. Assign the roles to some user.
5. Evaluate if user gets roles and role is added to token:
   
6. Add Keycloak to RocketChat via OpenID Connect as a custom OAuth Provider according to these instructions.
7. Added role and group mappings:
   
8. Login with user
9. Check role mappings, which shows only the default role:
   

Expected behavior:

The Roles defined in Keycloak are mapped into RocketChat.

Actual behavior:

No Roles are mapped to RocketChat. Every user gets the default role "user" only.

Server Setup Information:

• Version of Rocket.Chat Server: 4.7.4 Community Edition
• Operating System: Ubuntu 20.04
• Deployment Method: Helm Chart v4.7.4
• Number of Running Instances: 1
• DB Replicaset Oplog:
• NodeJS Version: v14.18.3
• MongoDB Version: 4.4.11

Client Setup Information

• Desktop App or Browser Version: Firefox 101.0.1 (64-Bit)
• Operating System: Windows 11 21H2

Relevant logs:

Server-Logs don't show any error.

{"level":40,"time":"2022-06-13T10:31:06.018Z","pid":1,"hostname":"rocketchat-rocketchat-ff9c99894-z9zvt","name":"API","msg":"attribute query is deprecated"}

Reproduce the Keycloak custom OAuth Provider setup described in the issue, including the roles claim and Rocket.Chat role/group mappings. Start by checking how the configured token claims are consumed during login; done means assigned Keycloak roles appear as the corresponding Rocket.Chat roles instead of only the default user role.