difference between KeystoneServiceAdmin and Admin role

You are right. If both roles are being assigned it is redundant.

Devstack assigns these in https://github.com/cloudbuilders/devstack/blob/master/files/keystone_data.sh, and I had the same question. My best guess is that since Devstack is used for testing, there is some edge case they are seeking with that particular role. Sorry that's not exactly an answer but it does let you safely ignore it for your setup. :)

Thanks for the answers, I read the code recently and my guess is right, the KeystoneServiceAdmin role is just a subset of the Admin role.

Hi,

  I have some doubts about user roles in Keystone, i think this doubt comes because i get used to tempauth and swauth roles and a couldn't map this roles to Keystone...

  the doubt is this:

    In tempauth e swauth there are 3 types of user's roles: user, admin e resseler admin. The first have the acess to object in a container limited to what is admin set for him (container acl permission). The admin has full control over the container in his account and the resselr admin has full control over then accounts, containers and objects in a cluster.

 In keystone, we can create the tenant and the role (http://docs.openstack.org/essex/openstack-compute/starter/content/Creating_Keystone_Roles-d1e460.html) . So if I create the role, how do i set that one role is the "admin" role? How do i set that the role i create is is a role under the admin role? ("user" role)

wops, a posted the question in the wrong place, sorry.