Are you using domain scoped token? If so it may be due to roles not returned for fernet tokens for domain scoped token
https://bugs.launchpad.net/keystone/+bug/1430433
I was able to reproduce yours only with domain scoped token
Are you using domain scoped token? If so it may be due to roles not returned for fernet tokens for domain scoped token
https:/ /bugs.launchpad .net/keystone/ +bug/1430433
I was able to reproduce yours only with domain scoped token