Comment 5 for bug 1762587

Indeed. Removing the requirement to have ldap-user and ldap-password leaves those fields blank in the /etc/keystone/domains/keystone.*.conf and keystone user works as expected. This behavior is documented in release notes (most recently fix in ocata) so I think it's reasonable to assume other functions work.

Submitting a quick patch, including notes in the readme.