It looks to me like if there are 2 incoming requests for a new user requests at roughly the same time and the role hasn't been created yet the 2 requests will race to create the role. I'll push out a fix soon that'll just add a lock to make sure this doesn't happen and only one can create the role.
Looking at the code in:
http:// git.openstack. org/cgit/ openstack/ keystone/ tree/keystone/ assignment/ core.py# n236
It looks to me like if there are 2 incoming requests for a new user requests at roughly the same time and the role hasn't been created yet the 2 requests will race to create the role. I'll push out a fix soon that'll just add a lock to make sure this doesn't happen and only one can create the role.