One Keystone to Rule them all

Traditionally, the focus has been on configuring and deploying Keystone in single cloud / single data center. The enterprise clouds are generally spread across multiple data centers. What happens to authentication and authorization platform across multiple data centers? How do users from one data center access resources in 10 other data centers?