Dear @trotman23
I am very grateful for your hint. Your words from point #3 should really make it into Keycloak documentation.
I first tried the mapper and it worked, then I dropped the mapper and simply added “roles” from list to Assigned Default Client Scopes in my OIDC client.
Many many thanks.
Peter