diff --git a/keystone/identity/core.py b/keystone/identity/core.py
index ee22526..91965d4 100644
--- a/keystone/identity/core.py
+++ b/keystone/identity/core.py
@@ -443,6 +443,7 @@ class RoleController(wsgi.Application):
         not implementing them in hopes that the idea will die off.
 
         """
+        self.assert_admin(context)
         if tenant_id is None:
             raise exception.NotImplemented(message='User roles not supported: '
                                                    'tenant ID required')