Horizon does not allow domain admin to create users

Hi,

I have a user (rallyadmin) that is given the admin role to the domain (rally). If I pull in the keystone v3 policy.json file to horizon (copy it to the location holding keystone_policy.json) I can create projects within the domain.

However, for some reason, I cannot create users. I can do this from the command line just fine, only if I use the domain ID in the command.

Example:

openstack user create --domain ec52643a4652460d86de1cea5807ac07 --password rally01 rally01
+---------------------+----------------------------------+
| Field | Value |
+---------------------+----------------------------------+
| domain_id | ec52643a4652460d86de1cea5807ac07 |
| enabled | True |
| id | 9fe967f27c594c75a4d08d8fde48873e |
| name | rally01 |
| options | {} |
| password_expires_at | None |
+---------------------+----------------------------------+

This puts the user inside the rally domain, as expected.

It appears that Horizon is missing the "Create User" button from the Users list, if you login as the rallyadmin account. I am unsure why it is doing this - perhaps we are checking something that we shouldn't.

I will clear out anything in my memcache to see if that caused the problem, but I do not remember having this issue in the past. Please advise on how to resolve or if you need additional items, such as viewing my policy file (we're tentative on dropping this information to the wild right now).

Thank you - and please, apologies if anything got misfiled or done incorrectly with the bug filing.