Comment 10 for bug 1496840

I am setting it as "won't fix" for 7.0 and 8.0 because the workaround with limiting turned out to be a whole new feature. The proper fix is very complex too and will require rewriting id_mapping_api.

As a workaround, I suggest you to filter users using filters in keystone.conf. If you want to fix it in code, I suggest you to have a look at function _set_domain_id_and_mapping_for_single_ref and how it's used. The problem is that public id is being queried per user, so for N users there will be N queries.