From the mailing list [1]:
> How does the delegate know which role to request? This is unintuitive. A delegator (rather than delegate) knows the role he wants to delegate. One would normally expect the delegator to request Keystone to delegate this role to the named delegate, rather than the delegate asking for a role to be delegated to it, since it requires an out of band communications between the delegator and delegate to take place before the delegation, in which the delegator tells the delegate its un/pw and the role it should ask for. This seems to be a rather contrived exchange of messages.
This design fault is present in both the spec and the current implementation.
[1]: http://lists.openstack.org/pipermail/openstack-dev/2013-June/010402.html
But we keep the consumer requesting the project id?