OpenStack keystone supports several types of identity federation, but it needs work. Some of the things that it needs:

• Fix the federation protocol API:
  • https://bugs.launchpad.net/keystone/+bug/1724645
  • https://bugs.launchpad.net/keystone/+bug/1585472
  • https://bugs.launchpad.net/keystone/+bug/1643112
• Get the federation devstack plugin to work on opensuse
  • https://bugs.launchpad.net/keystone/+bug/1757000
• Enhance the keystone docs for configuring federation
  • Content (especially diagrams) can be pulled from http://www.gazlene.net/demystifying-keystone-federation.html
• Package mod_auth_mellon in Factory
• Fix application credentials and trusts to work properly with group role assignments
  • https://bugs.launchpad.net/keystone/+bug/1773967
  • https://bugs.launchpad.net/keystone/+bug/1589993
• Other federation-related bugs, see https://bugs.launchpad.net/keystone and search for 'federation'