Comment 3 for bug 1719141

This sounds partially related to the shadow mapping work, or auto-provisioning [0], which seems to address the first example in the description. What would be a more specific example of the second case with LDAP?

Also - I tend to agree this would be something best suited for the notification system. In that case, there wouldn't be anything to do in keystone would there?

[0] https://docs.openstack.org/keystone/latest/advanced-topics/federation/federated_identity.html#auto-provisioning