Try both annotations...

@AllowAnyRole()

@Roles('user','admin')

The way nest-keycloak-connect' library handle the logic to check roles is bit strange when passing multiple roles. Anyway if you use like above your problem will be solved. Now your endpoint will work for any of the roles you are passing inside @Roles. You can debug the canActivate() method inside role.guard.js to check what is happening there. You can get clear idea once you debug it.