This is specific to the case when (for example) AD admin disabled a user. Keystone never knows the user was disabled because no api call was made to disable the user via keystone.
This is specific to the case when (for example) AD admin disabled a user. Keystone never knows the user was disabled because no api call was made to disable the user via keystone.