when using keystone federation an error is raised in the keystone ansible plugin:
failed: [aio1_keystone_container-12c3ddec] (item={u'project': u'fedproject', u'group': u'fedgroup', u'domain': u'Default', u'role': u'_member_'}) => {"failed": true, "item": {"domain": "Default", "group": "fedgroup", "project": "fedproject", "role": "_member_"}, "module_stderr": "mesg: ttyname failed: Inappropriate ioctl for device\nTraceback (most recent call last):\n File \"/tmp/ansible_5jk8kW/ansible_module_keystone.py\", line 1458, in <module>\n main()\n File \"/tmp/ansible_5jk8kW/ansible_module_keystone.py\", line 1452, in main\n km.command_router()\n File \"/tmp/ansible_5jk8kW/ansible_module_keystone.py\", line 484, in command_router\n facts = action(variables=action_command['variables'])\n File \"/tmp/ansible_5jk8kW/ansible_module_keystone.py\", line 966, in ensure_group_role\n name=role_name, group=group, project=project, domain=domain\nTypeError: _get_group_roles() got an unexpected keyword argument 'domain'\n", "module_stdout": "", "msg": "MODULE FAILURE"}
In the keystone library the function _get_group_roles() is missing the domain parameter.
I have a patch coming for this and will need it to go all the way back to Newton because we have a customer install next week that will depend on this.