diff --git a/keystone/common/sql/migrate_repo/versions/019_fixup_role.py b/keystone/common/sql/migrate_repo/versions/019_fixup_role.py
new file mode 100644
index 0000000000..11fa0a40ad
--- /dev/null
+++ b/keystone/common/sql/migrate_repo/versions/019_fixup_role.py
@@ -0,0 +1,37 @@
+import json
+import uuid
+
+import sqlalchemy as sql
+from sqlalchemy import orm
+
+from keystone import config
+from keystone import exception
+
+
+CONF = config.CONF
+
+
+def upgrade(migrate_engine):
+    meta = sql.MetaData()
+    meta.bind = migrate_engine
+
+    role_table = sql.Table('role', meta, autoload=True)
+    # name should be 255 characters to match fresh database
+    role_table.c.name.alter(type=sql.String(length=255))
+
+    # blank 'extra' field should be "{}"
+    none = None
+    update = role_table.update().where(role_table.c.extra == none).values(
+        {role_table.c.extra: "{}"})
+    migrate_engine.execute(update)
+
+
+def downgrade(migrate_engine):
+    # this fixes bugs in migration 001 and 007 that result in discrepancies
+    # between fresh databases and databases updated from 004 (folsom).
+    # the changes fixing 007 will be rolled back in 007's rollback if
+    # the user desires to return to a state before the existence of the extra
+    # column.
+    # the name length change reflects the current default and should not be
+    # rolled back.
+    pass
diff --git a/tests/test_sql_upgrade.py b/tests/test_sql_upgrade.py
index dc7cce5e7f..32bb3aad99 100644
--- a/tests/test_sql_upgrade.py
+++ b/tests/test_sql_upgrade.py
@@ -538,6 +538,23 @@ class SqlUpgradeTests(test.TestCase):
         self.assertTableColumns("trust_role",
                                 ["trust_id", "role_id"])
 
+    def test_fixup_role(self):
+        session = self.Session()
+        self.assertEqual(self.schema.version, 0, "DB is at version 0")
+        self.upgrade(1)
+        self.insert_dict(session, "role", {"id": "test", "name": "test"})
+        self.upgrade(18)
+        self.insert_dict(session, "role", {"id": "test2",
+                                           "name": "test2",
+                                           "extra": None})
+        r = session.execute('select count(*) as c from role '
+                            'where extra is null')
+        self.assertEqual(r.fetchone()['c'], 2)
+        self.upgrade(19)
+        r = session.execute('select count(*) as c from role '
+                            'where extra is null')
+        self.assertEqual(r.fetchone()['c'], 0)
+
     def populate_user_table(self, with_pass_enab=False,
                             with_pass_enab_domain=False):
         # Populate the appropriate fields in the user