This proposed upstream patch addresses

	18720708 Error: Unable to add userto primary project when adding user
		 via Horizon

and is tracked under Launchpad bug 1260439. Although it's been
addressed in the Juno trunk, the patch below is still not yet released
for Havana.  It has been modified to apply cleanly into our current
Havana implementation

commit f5ded29d9a73db4c225cbfb664e7d85e5aa0996b
Author: Matthias Runge <[email protected]>
Date:   Fri May 23 11:36:54 2014 +0200

    Prevent error message when creating a user
    
    keystone changed behaviour and didn't add the user
    to the specified role. Now it does; this patch
    prevents an exception popping up without breaking
    with previous versions.
    
    Change-Id: I115a5126b70ae3c7733aa065bf55104f88cc42e5
    Closes-Bug: #1260439

--- horizon-2013.2.3/openstack_dashboard/dashboards/admin/users/forms.py.~1~	2014-04-03 11:45:53.000000000 -0700
+++ horizon-2013.2.3/openstack_dashboard/dashboards/admin/users/forms.py	2014-06-11 12:54:51.517905246 -0700
@@ -122,15 +122,21 @@
                              _('User "%s" was successfully created.')
                              % data['name'])
             if data['role_id']:
-                try:
-                    api.keystone.add_tenant_user_role(request,
-                                                      data['project'],
-                                                      new_user.id,
-                                                      data['role_id'])
-                except Exception:
-                    exceptions.handle(request,
-                                      _('Unable to add user '
-                                        'to primary project.'))
+                roles = api.keystone.roles_for_user(request,
+                                        new_user.id,
+                                        data['project']) or []
+                assigned = [role for role in roles if role.id == str(
+                    data['role_id'])]
+                if not assigned:
+                    try:
+                        api.keystone.add_tenant_user_role(request,
+                                                        data['project'],
+                                                        new_user.id,
+                                                        data['role_id'])
+                    except Exception:
+                        exceptions.handle(request,
+                                        _('Unable to add user '
+                                            'to primary project.'))
             return new_user
         except Exception:
             exceptions.handle(request, _('Unable to create user.'))
--- horizon-2013.2.3/openstack_dashboard/dashboards/admin/users/tests.py.~1~	2014-04-03 11:45:53.000000000 -0700
+++ horizon-2013.2.3/openstack_dashboard/dashboards/admin/users/tests.py	2014-06-11 13:44:29.437187509 -0700
@@ -81,6 +81,7 @@
                                        'tenant_list',
                                        'add_tenant_user_role',
                                        'get_default_role',
+                                       'roles_for_user',
                                        'role_list')})
     def test_create(self):
         user = self.users.get(id="1")
@@ -102,6 +103,7 @@
                                  domain=domain_id).AndReturn(user)
         api.keystone.role_list(IgnoreArg()).AndReturn(self.roles.list())
         api.keystone.get_default_role(IgnoreArg()).AndReturn(role)
+        api.keystone.roles_for_user(IgnoreArg(), user.id, self.tenant.id)
         api.keystone.add_tenant_user_role(IgnoreArg(), self.tenant.id,
                                           user.id, role.id)