Due to code [1] Keystone produces a confusing message when:

* We're using python- openstackclient
* We're creating a trust with a role name that exists in more that one domain.

"role %s is not defined" suggests that there isn't a role like that. What actually happens, Keystone cannot decide which role is the user's choice.

python- openstackclient automatically converts role ids to role names when sending a POST request, so specifying roles using an id doesn't help at all.

[1] https:/ /github. com/openstack/ keystone/ blob/03319d1/ keystone/ trust/controlle rs.py#L90- L94