Role based authorization using Keycloak and .NET core

Having a few minor issues with role based authorization with dotnet core 2.2.3 and Keycloak 4.5.0.

In Keycloak, I've defined a role of 'tester' and a client role 'developer' with appropriate role mappings for an 'admin' user. After authenticating to Keycloak; if I look at the JWT in jwt.io, I can see the following:

"realm_access": {
        "roles": [
            "tester"
        ]
    },
    "resource_access": {
        "template": {
            "roles": [
                "developer"
            ]
    },
    ...
},

In .NET core, I've tried a bunch of things such as adding [Authorize(Roles = "tester")] or [Authorize(Roles = "developer")] to my controller method as well as using a policy based authorization where I check context.User.IsInRole("tester") inside my AuthorizationHandler<TRequirement> implementation.

If I set some breakpoints in the auth handler. When it gets hit, I can see the 'tester' and 'developer' roles listed as items under the context.user.Claims IEnumerable as follows.

{realm_access: {"roles":["tester"]}}
{resource_access: {"template":{"roles":["developer"]}}}

So I should be able to successfully do the authorization in the auth handler by verifying the values for realm_access and resource_access in the context.user.Claims collection, but this would require me to deserialize the claim values, which just seem to be JSON strings.

I'm thinking there has to be better way, or I'm not doing something quite right.