I think this is going to break on mysql, when the database is running on a different host than keystone. The database users provider for mysql creates the users as "user@localhost" by default. That means that user will only be allowed to connect from localhost. I think you need to add a "host" attribute here. The glance barclamp currently uses "%" (which translates to any host). (See also: https://github.com/crowbar/barclamp-glance/pull/81)