I think as long as the auth system (keystone or otherwise) issued a valid token (either UUID or PKI based), it should be possible to use it.  If the alternate barbican endpoint receives a valid token, it should still validate the token successfully (assuming its using the same keystone service that issued the token originally). I don't think the contents of the service catalog are used for authorization purposes.

I ran across this issue when doing some testing with an auth system that did not yet have a barbican entry in the catalog, so I specified the endpoint on the 'keep' command line thinking that it should work as a backup.

In this fix, the catalog value in the original auth request would take precedence if it was available.