We've setup external access to Keystone and Nova-API and I'm testing that access. What I find, when doing the command 'keystone --debug service-list' is that the keystone client authenticates to the purlicURL, gets a token, then tries to communicate to the adminURL instead of continuing to talk to the publicURL.

Obviously we have only opened the publicURL for the services for access, so this causes a failure.

Why would it be trying to access the adminURL instead of the publicURL?

Environment: Essex, multi-node