Single Sign on Users must have an identity in keystone

[Sachin]

Single sign on (SSO) users from an external identity provider (IDP) are mapped to keystone group/user with a mapping rule. The identity of such a user is lost in context of OpenStack. Once the operation makes it to OpenStack services, only group is available in the context. This poses multiple problems
1. The owners of various objects like VMs, Volumes, Networks are not identifiable as that specific SSO user.
2. The user-quota api for various projects like nova, cinder and neutron does not work.

[Steve Martinelli (stevemar)]

So this was mostly solved in Mitaka and we will continue to work on this issue in Newton. The shadow users spec is now storing all federated users in a keystone database (https://blueprints.launchpad.net/keystone/+spec/shadow-users), we will start allowing individual role assignments to these users in Newton (https://blueprints.launchpad.net/keystone/+spec/shadow-users-newton)

[Steve Martinelli (stevemar)]

If it's alright with you, I'd prefer to mark this bug as invalid since we are tracking the blueprints

[Dolph Mathews (dolph)]

Marking this as incomplete unless there are additional specifics beyond what is tracked in the shadow users specs that should cause this bug to remain open.

[Launchpad Janitor (janitor)]

[Expired for OpenStack Identity (keystone) because there has been no activity for 60 days.]