Comment 4 for bug 1724645

For Federation, we can't cleanly demarcates configuration from (API) operation, as we have other third party dependencies (i.e. Apache, mellon, shibd, haproxy, etc). In other words, you can't just add a new provider, protocol, and mapping via API, and whalah things just magically work. You'll also need to adjust the 3rd party services before the data even gets to the Keystone app.

While being able to dynamically configure the remote_id_attribute is nice, but I am not sure it is a giant leap for mankind, so to speak. :-) I am OK with making the documentation more intuitive.