Keycloak RBAC for nginx reverse proxy

I started to work with keycloak, and here is a setup I want to test.

I want to test this scenario:

It works, but I want to implement role-based access to apps behind Nginx proxy and I can't understand how exactly payload of jwt token generates.

Here is my JWT tokens payload:

  "jti": "f5f07b6f-ccae-4f57-a8ea-ae02ebb3cb12",
  "exp": 1569263630,
  "nbf": 0,
  "iat": 1569227630,
  "iss": "https://keycloak.domain.local/auth/realms/LDAP_test",
  "sub": "fedc6baf-4ba4-4fa6-924c-9501edf070f7",
  "typ": "Serialized-ID",
  "auth_time": 0,
  "session_state": "aa0052ee-b5e1-45cc-bee4-e7bccdfa4a59",
  "state_checker": "sC_nvlDXfjUDHhC15ZDpPauX5JkxhvVtYUOn62PhtV8"

I want my token to contain roles, username and email and i run out of ideas how to put it there. Is client somehow related to the content of the token or keycloak always gives everything he have into it?

Here are my Nginx client settings:

server {
    server_name demo-a.domain.local;
    location / {
      proxy_pass http://10.10.10.168/index.html;
           access_by_lua '
             local opts = {
               redirect_uri_path = "/redirect_uri",
               accept_none_alg = true,
               discovery = "https:/keycloak.domain.local/auth/realms/LDAP_test/.well-known/openid-configuration",
               client_id = "nginx-gateway",
               client_secret = "19fe43bc-4167-4433-816a-eb96da33f9a3",
               redirect_uri_scheme = "https",
               logout_path = "/logout",
               redirect_after_logout_uri = "https://keycloak.domain.local/auth/realms/LDAP_test/protocol/openid-connect/logout?redirect_uri=https://www.nginx-gateway.domain.local/",
               redirect_after_logout_with_id_token_hint = false,
               session_contents = {id_token=true}
             }
             -- call introspect for OAuth 2.0 Bearer Access Token validation
             local res, err = require("resty.openidc").authenticate(opts)
             if err then
               ngx.status = 403
               ngx.say(err)
               ngx.exit(ngx.HTTP_FORBIDDEN)
             end
          ';
          }

Thanks in advance!