As of Pike, OpenStack Keystone supports auto-provisioning of projects and/or groups for Federated users.

https://docs.openstack.org/keystone/pike/advanced-topics/federation/federated_identity.html#auto-provisioning

In order to support this feature, Clarity should be modified to support specifying project / group access when creating a Federated mapping.