title: Keycloak-Gatekeeper does not populate roles or groups when authenticating against external OIDC provider
body: <p>I'm trying to set up keycloak-gatekeeper as a reverse-proxy in front of a docker container in order to provide authentication and authorization against the container. I am using FusionAuth as the OIDC compatible identity provider, and have managed to get keycloak-getekeeper to use this, using the Authorization flow. 
  The problem comes when I try to restrict which users can access a resource based on their role or group membership.</p>
  
  <p>Currently, all requests are denied. When I look into the logs on the server I can see the following messages: </p>
  
  <pre><code>1.5548202388823931e+09  info    keycloak-gatekeeper/middleware.go:90    client request  {"latency": 0.039427852, "status": 403, "bytes": 0, "client_ip": "127.0.0.1:40866", "method": "GET", "path": "/"}
  1.5548202614442139e+09  error   keycloak-gatekeeper/middleware.go:108   no session found in request, redirecting for authorization  {"error": "authentication session not found"}
  1.5548202614443152e+09  info    keycloak-gatekeeper/middleware.go:90    client request  {"latency": 0.000108426, "status": 307, "bytes": 95, "client_ip": "127.0.0.1:40866", "method": "GET", "path": "/"}
  1.5548202614823494e+09  debug   keycloak-gatekeeper/handlers.go:88  incoming authorization request from client address  {"access_type": "", "auth_url": "https://identity.***********.io/oauth2/authorize?client_id=********&amp;redirect_uri=https%3A%2F%2F********.io%2Foauth%2Fcallback&amp;response_type=code&amp;scope=openid+email+profile&amp;state=********", "client_ip": "127.0.0.1:40866"}
  1.554820261482426e+09   info    keycloak-gatekeeper/middleware.go:90    client request  {"latency": 0.000132558, "status": 307, "bytes": 298, "client_ip": "127.0.0.1:40866", "method": "GET", "path": "/oauth/authorize"}
  1.5548203051960323e+09  info    keycloak-gatekeeper/handlers.go:167 issuing access token for user   {"email": "someuser@domain.com", "expires": "2019-04-09T15:31:45Z", "duration": "59m59.803970144s"}
  1.5548203051961453e+09  info    keycloak-gatekeeper/middleware.go:90    client request  {"latency": 0.099124835, "status": 307, "bytes": 37, "client_ip": "127.0.0.1:40866", "method": "GET", "path": "/oauth/callback"}
  1.5548203052413428e+09  debug   keycloak-gatekeeper/session.go:51   found the user identity {"id": "5f165d68-9350-47e6-9152-d76260cabd7c", "name": "someuser@domain.com", "email": "someuser@domain.com", "roles": "", "groups": ""}
  1.5548203052417035e+09  warn    keycloak-gatekeeper/middleware.go:307   access denied, invalid roles    {"access": "denied", "email": "someuser@domain.com", "resource": "/*", "roles": "role-1,role-3"}
  1.5548203052417736e+09  info    keycloak-gatekeeper/middleware.go:90    client request  {"latency": 0.000509757, "status": 403, "bytes": 0, "client_ip": "127.0.0.1:40866", "method": "GET", "path": "/"}
  </code></pre>
  
  <p>As far as I can see, the reason for my denials is because the roles are not populated.
  I have also run a client to obtain a JWT (via the implicit flow) for the user which comes back looking something like this: </p>
  
  <pre><code>{
    "aud": "************************",
    "exp": 1554822076,
    "iat": 1554818476,
    "iss": "https://identity.*******.io",
    "sub": "****************",
    "authenticationType": "PASSWORD",
    "email": "someuser@domain.com",
    "email_verified": true,
    "applicationId": "*****************",
    "roles": [
      "role-1",
      "role-3"
    ]
  }
  </code></pre>
  
  <p>From this, I can see that the user is in the correct roles.</p>
  
  <p>At the moment I am at a bit of a loss as to where the problem lies, or how to debug the keycloak-gatekeeper instance in more detail</p>