"sql_address" is the wrong choice here I think. I should be either '%' or the admin address of the host that keystone is running on. (the cinder barclamp is using '%' currently).