---
features:
  - >
    [`blueprint shadow-mapping <https://blueprints.launchpad.net/keystone/+spec/shadow-mapping>`_]
    The federated identity mapping engine now supports the ability to
    automatically provision ``projects`` for ``federated users``. A role assignment
    will automatically be created for the user on the specified project. If the
    project specified within the mapping does not exist, it will be automatically
    created in the ``domain`` associated with the ``identity provider``.
    This behavior can be triggered using a specific syntax within the ``local``
    rules section of a mapping. For more information see:
    `mapping combinations <https://docs.openstack.org/developer/keystone/federation/federated_identity.html#mapping-combinations>`_