https://bugs.launchpad.net/keystone/+bug/968696/comments/39 1. Add a config value ADMIN_PROJECT_ID 2. In token creation, if ADMIN_PROJECT_ID is not None: only add the admin role to the token if the id of the scoped project == ADMIN_PROJECT_ID Does this work?