WSo2 API Manager and Keyrock - issue with roles

I have deployed WSo2 API Manager 4.1.0 on a Debian 10 machine using the ZIP archive.

I have configured my Keyrock instance as an external identity provider in the Management Console.

When I log in with the Keyrock admin account, I can access the Publisher of the API Manager.
However, with any other account, I get the following error:

Error 403 : Forbidden - The server could not verify that you are authorized to access the requested resource.

After many verifications, I think I have correctly configured WSo2:

WSo2 API Manager configuration:

Basic Claim Configuration

Role Configuration (I also tried to give all roles to the user)

Federated Authenticators / OAuth2/OpenID Connect Configuration

Just-in-Time Provisioning

Keyrock configuration:

Application configuration

Users authorization

I have no log for WSo2 when the error is displayed.

Here is the content of the JWT token that Keyrock sends back to WSo2:

{
  "organizations": [],
  "displayName": "",
  "roles": [
    {
      "id": "1a209432-7bfe-4055-9028-a42524fc5418",
      "name": "publisher"
    },
    {
      "id": "8192fef7-d77d-4389-a618-082ccddd33ad",
      "name": "apim_publisher"
    }
  ],
  "app_id": "babab169-10ea-4283-a64a-7fba4aca6ce9",
  "trusted_apps": [],
  "isGravatarEnabled": false,
  "id": "1a8f660f-d32f-46c1-a5f5-80a5cbffd219",
  "authorization_decision": "",
  "app_azf_domain": "",
  "eidas_profile": {},
  "attributes": {},
  "shared_attributes": "",
  "username": "pierre.josselin",
  "email": "[email protected]",
  "image": "",
  "gravatar": "",
  "extra": "",
  "iss": "http://localhost:3000",
  "sub": "1a8f660f-d32f-46c1-a5f5-80a5cbffd219",
  "aud": "babab169-10ea-4283-a64a-7fba4aca6ce9",
  "exp": 1657904225,
  "iat": 1657900625,
  "at_hash": "9zTg2zPtFlbJpLmKE8Izsg=="
}

Thank you very much

Solution

In order to answer this question, there was an incompatibility between the format of the roles returned by Keyrock, and the format expected by the API manager. At least that was the case for the versions I used. I've found a "hacky" solution by adding a server between Keyrock and the API manager responsible for converting the roles to the expected format.