Comment 1 for bug 1809267

After some more debugging the issue seems to come from lack of project scoped token that horizon uses.
I'm not sure that when using SSO, you should get a project scoped token when working with horizon, but in our case it seems we don't have one, and calling the keystone application_credential create with an unscoped token, gives you an unscoped application token, which is useless.

fix is either to use project scoped token in horizon when using SSO; or when the application_credential create is called, to get one and use the new scoped token to create the credential.