'Ultimate hack to get around having to make role_refs first-class.
This will basically iterate over the various roles the user has in
all tenants the user is a member of and create fake role_refs where
the id encodes the user-tenant-role information so we can look
up the appropriate data when we need to delete them.'

@controller.v2_deprecated
def get_role_refs(self, request, user_id):

    self.assert_admin(request)
    tenants = self.assignment_api.list_projects_for_user(user_id)
    o = []
    for tenant in tenants:
        if (tenant['domain_id'] != CONF.identity.default_domain_id):
            continue
        role_ids = self.assignment_api.get_roles_for_user_and_project(user_id, tenant['id'])
        for role_id in role_ids:
            ref = {'roleId': role_id, 'tenantId': tenant['id'], 'userId': user_id}
            ref['id'] = urllib.parse.urlencode(ref)
            o.append(ref)
    return {'roles': o}
