Nice work Adam, as usual.
I'm dropping some comments about how we could automate it in TripleO:
# Identity Provider Registration and Metadata
This script could be called by Puppet or Heat at the right time, but
now I don't have the best answer.
# Federation Operations
We can achieve it with
http://adam.younglogic.com/2016/08/ooo-ha-fed-poc/
It is painful, sloppy, Mitaka based. Have at it, and lets make
Federation a reality for Newton based deployments. Feedback eagerly sought.
Thanks for all the people that helped get me through this. Won't list
you all, as it would start