The mapping is one to one. You will not be able to easily map N domains that come as attributes from the IdP to a user in Keystone via the current identity federation implementation. We started an initiative to make that more flexible, but the specs were never accepted. You can see specs [1] and [2]. The spec [1] is not about this per se, but it is the base to enable us to better evolve the attribute mapping process without causing backwards impacts. However, it was never accepted. Also, the spec [2] is something that we did to achieve what you want with the domain, but applied at a project level. Therefore, if we had those in, it would be easy to expand to other use cases, such as the one you are describing.