Comment 4 for bug 910456

Essex-3 reimplemented the CLI, and this was fixed (see keystone-manage list_roles --help); however, beyond essex-4, this functionality will be implemented by python-keystoneclient.