Comment 14 for bug 1717918

This might be something we can improve in the keystone documentation. It appears keystone has some limitations on what you can do with impersonation and redelegation [0].

Unfortunately, I can't seem to find clear documentation on it. I'll dig a bit more, but this might classify as a documentation fix for keystone.

[0] https://github.com/openstack/keystone/blob/master/keystone/tests/unit/test_v3_trust.py#L383-L386