The documentation of the Federation API [1] brings a lot of examples where the local part of the rule does not have the user object with the name property, such as:
{
"user": {
"name": "user name"
}
}
However one cannot get a token with Federation if the mapping doesn't have such rule, because of the lines below: [2]
mapped_properties = self._transform(identity_values)
if mapped_properties.get('name') is None:
raise exception.Unauthorized(_("Could not map user"))
and the implementation of the method _transform, that is not lenient about the lack of the aforementioned object [3].
[1] https://github.com/openstack/identity-api/blob/master/openstack-identity-api/v3/src/markdown/identity-api-v3-os-federation-ext.md
[2] https://github.com/openstack/keystone/blob/01eea87dea766714015a62f5d24f07d2407f9612/keystone/contrib/federation/utils.py#L223
[3] https://github.com/openstack/keystone/blob/01eea87dea766714015a62f5d24f07d2407f9612/keystone/contrib/federation/utils.py#L228
Some new documentation just landed this last week concerning Federation documentation.
https:/