Cloned from launchpad blueprint https://blueprints.launchpad.net/keystone/+spec/acls-userids-federation.

Description:

Temporary user entries created for the same federated user would normally get different user IDs assigned to them  by Keystone. Services that use user-ids in ACL would not normally work correctly in this environment as they would not know the user ID. This blueprint specifies a modification to Keystone that ensures that multiple sequential temporary entries created for the same federated user will get the same user-id assigned to them.

Specification URL (additional information):

https://wiki.openstack.org/wiki/Keystone/Federation/UserIDsInACLs#Handling_ACLs_that_use_UserIDs_in_Federated_Keystone