Tenant ID is a required parameter of user-role-add, but this command display is optional parameter.

Tenant ID is a required parameter of user-role-add, but command display is optional parameter.

The following is the display of when the keystone user-role-add command is executed.

usage: keystone user-role-add --user-id <user-id> --role-id <role-id>
                              [--tenant-id <tenant-id>]
keystone user-role-add: error: argument --user-id/--user_id is required

In /opt/stack/keystone/keystone/identity/core.py

    def add_role_to_user(self, context, user_id, role_id, tenant_id=None):
        """Add a role to a user and tenant pair.

        Since we're trying to ignore the idea of user-only roles we're
        not implementing them in hopes that the idea will die off.

        """
        self.assert_admin(context)
        if tenant_id is None:
            raise exception.NotImplemented(message='User roles not supported: '
                                                   'tenant_id required')

Because not yet implemented it return an error if you do not specify tenant ID.
This case tenant ID should fix to a required parameter display.