I have verified this on grizzly-2 and validation seems to be working fine.
$ keystone user-role-remove --user bd9c28b6e2794574b030ad5c3a7e4818 --tenant 97c5778a10f34b499a5abe1e2ecff24c --role 9fe2ff9ee4384b1894a90878d3e92bab
$ euca-describe-instances Unauthorized: Failure communicating with keystone
I have verified this on grizzly-2 and validation seems to be working fine.
$ keystone user-role-remove --user bd9c28b6e279457 4b030ad5c3a7e48 18 --tenant 97c5778a10f34b4 99a5abe1e2ecff2 4c --role 9fe2ff9ee4384b1 894a90878d3e92b ab
$ euca-describe- instances
Unauthorized: Failure communicating with keystone