When configuring Foreman to utilize openstack compute resources (under Infrastructure tab), you must select a single account to create this resource. This means everyone will have access to only the tenants for which that account has access to. I'd like to request a feature so that users logged into foreman (via AD/LDAP) can only provision hosts within the tenants for which they're a member of in Openstack. Both Openstack and Foreman use the same AD/LDAP credentials so it would be GREAT there was a feature to enable LDAP credential passthrough so that each user only had access to create/destroy resources to which the appropriate permissions, regardless of what account the compute resource was created with.