Comment 2 for bug 1813183

After digging into this, I think I figured out why this is happening.

In the example, I configured keystone to have an external authentication method. This allows users to use x509 certificates to authenticate, offloading the validation of the certificate to apache plugins. The data is then passed into keystone in the form of a request context.

Keystone process the request context using middleware, which executes before the actual code in keystone's authentication API. The middleware determines if the request was authenticated using tokenless authentication methods and fires off a call to the tokenless authentication helper class, which handles its own mapping logic[0][1][2][3][4][5]. The tokenless helper class doesn't reuse the Mapped plugin that gets used for other protocols, like SAML. The Mapped plugin is what actually has support for auto-provisioning [6].

The auto-provisioning feature was implemented after the x509 authentication plugin. So this was likely due to the fact that there were two mapping implementations, and one wasn't as well known.

We could try and get all protocols using the same mapping implementation moving forward. This would make it so we're less susceptible to these kinds of issues moving forward and makes using x509 more useful.

[0] http://git.openstack.org/cgit/openstack/keystone/tree/keystone/server/flask/request_processing/middleware/auth_context.py?id=e647d6f69762523d0dfa28137a9f11010b550e72#n330
[1] http://git.openstack.org/cgit/openstack/keystone/tree/keystone/server/flask/request_processing/middleware/auth_context.py?id=e647d6f69762523d0dfa28137a9f11010b550e72#n360
[2] http://git.openstack.org/cgit/openstack/keystone/tree/keystone/server/flask/request_processing/middleware/auth_context.py?id=e647d6f69762523d0dfa28137a9f11010b550e72#n436
[3] http://git.openstack.org/cgit/openstack/keystone/tree/keystone/server/flask/request_processing/middleware/auth_context.py?id=e647d6f69762523d0dfa28137a9f11010b550e72#n248
[4] http://git.openstack.org/cgit/openstack/keystone/tree/keystone/server/flask/request_processing/middleware/auth_context.py?id=e647d6f69762523d0dfa28137a9f11010b550e72#n258
[5] http://git.openstack.org/cgit/openstack/keystone/tree/keystone/common/tokenless_auth.py?id=e647d6f69762523d0dfa28137a9f11010b550e72#n96
[6] http://git.openstack.org/cgit/openstack/keystone/tree/keystone/auth/plugins/mapped.py?id=e647d6f69762523d0dfa28137a9f11010b550e72#n109