Comment 1 for bug 1488538

This is already supported with the current code. You specify it like this::

    keystone_user_role { 'username::user_domain_name@projectname::project_domain_name': }

This assumes you have the following resources defined in your manifest::

    keystone_tenant { 'projectname::project_domain_name': ...}
    keystone_user { 'username::user_domain_name': ...}