It's not barbican client and issue, but how Octavia does create token out of application credentials.

We've also catched that issue and tried to solve it from keystone side [1], but seems that code refactoring is required.

While proposed workaround for keystone kind of works, I guess it might cause more serious security concerns, as basically creating token from application credentials token seems to be never supported by keystone.

[1] https://bugs.launchpad.net/keystone/+bug/1959674