File:Cross-Keystone-Validation.png

Diagram illustrating the issue of token validation when the calling user and the target service are "owned" by different Keystones.