We aren't trying to match an account name, provided by client as a part of X-Auth-User, against the implicit tenant that is driven by rgw_keystone_implicit_tenants. In consequence, clients are required to explicitly specify the tenant part using the *$* infix.
PR: https://github.com/ceph/ceph/pull/17047. Though, I would prefer to have a fix for this bug as a part of bigger refactoring of the TempAUTH implementation.