diff -r 4be1f488dda8 -r db0cec748ec0 components/openstack/keystone/patches/launchpad-1404354.patch
--- /dev/null	Thu Jan 01 00:00:00 1970 +0000
+++ b/components/openstack/keystone/patches/launchpad-1404354.patch	Tue Apr 07 13:31:20 2015 -0700
@@ -0,0 +1,32 @@
+commit 600c236e2111a770e478040a8a78bb62ef27ac39
+Author: Brant Knudson <bknudson@us.ibm.com>
+Date:   Fri Dec 19 14:11:00 2014 -0600
+
+    Fix to not use empty IN clause
+    
+    When an empty IN clause is used with sqlalchemy, a warning is
+    printed:
+    
+     SAWarning: The IN-predicate on "assignment.actor_id" was invoked
+     with an empty sequence. ...
+    
+    With this fix, these warnings should no longer be printed.
+    
+    The tests are changed to convert these warnings into errors.
+    
+    Change-Id: I58c7e5f11fdac9bbc1e9a970ce690ea113e2bd95
+    Closes-Bug: #1404354
+
+--- keystone-2014.2.2/keystone/assignment/backends/sql.py.orig	2014-12-04 21:03:56.000000000 -0800
++++ keystone-2014.2.2/keystone/assignment/backends/sql.py	2015-01-25 20:44:40.377007906 -0800
+@@ -356,6 +356,10 @@ class Assignment(keystone_assignment.Dri
+
+     def _get_group_project_roles(self, session, groups, project_id,
+                                  project_domain_id):
++        if not groups:
++            # If there's no groups then there will be no project roles.
++            return []
++
+         sql_constraints = sqlalchemy.and_(
+             RoleAssignment.type == AssignmentType.GROUP_PROJECT,
+             RoleAssignment.target_id == project_id)