You want to know which role name is treated as "admin" in keystone. There is no way to do this programatically unless we know the role name. In current default policy file it is defined as "admin_required": "role:admin or is_admin:1"," . So any role whose name is "admin" is admin role.

If someone defines "admin_required": "role:not_admin or is_admin:1"," in the deployed keystone policy file then the role name "not_admin" becomes admin role. Given a role id , you can get role name, but you can't say that the role name is admin in keystone unless you manually look at policy file definition. By convention the role with name "admin" is used as admin role.

To answer your question, use the rest-api to get the role details for the role-id or try keystone role-get/role-list to get the role name for the role id. In keystone role name is global uiqnue. You can assign any role to be an admin role.

hmm, mebbe not the best way but this should do the check.

1. create a user using keystone client
2. create a tenant using keystone client
3. assign the role_id for test to the user created in step1 and scoped with tenant created in step2.
4. try to use this user to do user-list using keystone user-list if you can get the user-list you the role_id tested should be the admin role defined in the policy.json.

Hope that helps!

Vic