Keystone to Keystone federation

CERN has one openstack cloud setup ("internal cloud") within their data center. They have the keystone sitting on top of an LDAP instance. They would like to burst cloud workload between multiple public cloud service providers ("CSP") should their internal cloud not have enough bandwidth or storage. They would like to provide seamless access for their internal cloud identities. Those identities currently use openstack clients (nova-client, keystone-client) and would like to continue to do so without many changes.
Flow:
a. AuthN against CERN keystone using my credentials
b. Get a token back with a service catalog showing CERN openstack services (nova, swift, etc) and the CSP service catalog
c. Attempt to use the token against CSP nova service
d. CSP nova service calls CSP keystone (no change)
e. CSP keystone deciphers the token belonging to the CERN keystone IdP (which it sees as being setup as a trusted identity provider with attribute mappings we need to use)
f. CSP keystone calls CERN keystone (SAML or other federation protocol request and negotiation)
g. CERN keystone shows CSP setup as a trusted service provider (with attribute mappings it should expect)
h. CERN Keystone returns back a SAML (or other federation protocol) assertion to CSP Keystone
i. CSP keystone deciphers the assertion and provisions a temporary user. The token is deemed valid and stored in CSP keystone for future validation calls until expiration