Description of problem:

While editing quota from a project in Horizon , this action is removing users from the project.

We are using Keystone v3 with multi domains setup.

I create a project in "Default" Keystone domain:

keystone]# openstack project create test
+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description |                                  |
| domain_id   | default                          |
| enabled     | True                             |
| id          | ceae5812586c4d7e915199c6dd5f4868 |
| is_domain   | False                            |
| name        | test                             |
| parent_id   | None                             |
+-------------+----------------------------------+

I add a user from a *different* domain (TESTDOM, an LDAP domain) like this:
keystone]# openstack role add --project test --user-domain TESTDOM --user domuser2 _member_

I verify the user is properly located in the project:
keystone]# openstack user list --project test
+------------------------------------------------------------------+-----------+
| ID                                                               | Name      |
+------------------------------------------------------------------+-----------+
| 13e3a99ae7410be0e41167d3d6fae7dea1b6d0c99362507c5c3b8c26a7b3bc1f | domuser1  |
| e9adb93931a3356afbb817f9c2a17046d1ac9127f1112f9751fdb09efe5046fb | domuser2  |
+------------------------------------------------------------------+-----------+

At this point the user can connect to Horizon with the TESTDOM domain and it's LDAP credential and do actions in OpenStack.

Then I log in the Horizon dashboard by using my account (which is admin) ldap credential and TESTDOM domain.
I go in identity -> Projects -> on test project I do "Edit quota" -> I modify the number of instance from 10 to 15 -> update.

At this point Horizon *removed* all the  users not belonging to the Default domain and that were assigned to this tenant!

keystone]# openstack user list --project test

keystone]#


Version-Release number of selected component (if applicable):
* OSP8
* python-django-horizon-8.0.1-2.el7ost.noarch
* openstack-dashboard-8.0.1-2.el7ost.noarch
* openstack-dashboard-theme-8.0.1-2.el7ost.noarch

How reproducible:
always

Steps to Reproduce:
1) # openstack project create redhatdebug

+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description |                                  |
| domain_id   | default                          |
| enabled     | True                             |
| id          | 9abb68e68ab8489096005004e38e1001 |
| is_domain   | False                            |
| name        | redhatdebug                      |
| parent_id   | None                             |
+-------------+----------------------------------+
2) # openstack role add --project redhatdebug --user-domain TESTDOM --user user1 _member_

3) # openstack user list --project redhatdebug
+------------------------------------------------------------------+----------+
| ID                                                               | Name     |
+------------------------------------------------------------------+----------+
| e9adb93931a3356afbb817f9c2a17046d1ac9127f1112f9751fdb09efe5046fb | user1    |
+------------------------------------------------------------------+----------+

4) modify quota using horizon

5) # openstack user list --project redhatdebug

---> No more LDAP user in the project

Actual results:
No more LDAP user in the project

Expected results:
LDAP users stay in the project

Additional info:
[1] introduced a change in _update_project_members to not remove roles for users who have roles on the project but aren't in the domain:

+            # TODO(bpokorny): The following lines are needed to make sure we
+            # only modify roles for users who are in the current domain.
+            # Otherwise, we'll end up removing roles for users who have roles
+            # on the project but aren't in the domain.  For now, Horizon won't
+            # support managing roles across domains.  The Keystone CLI
+            # supports it, so we may want to add that in the future.
+            all_users = api.keystone.user_list(request,
+                                               domain=data['domain_id'])
+            users_dict = {user.id: user.name for user in all_users}
+
             for user_id in users_roles.keys():
+                # Don't remove roles if the user isn't in the domain
+                if user_id not in users_dict:
+                    users_to_modify -= 1
+                    continue
+

[1] https://github.com/openstack/horizon/commit/2b846515f388278e2bf8d0198a4f821309e08e69#diff-58479fd50b8eddb273d41ad9c15dafa4R738