Comment 2 for bug 885755

Correct, I need to document this somewhere, it recently became an issue with Keystone changes.

When you register a child zone you need to do so with a user that has the KeystoneServiceAdmin role and no associated tenant. Otherwise the /token/xxxxx/endpoints call won't work.

That said, there were more keystone changes recently that even prevent this from working (no global endpoints are returned). I'm working with the Keystone team now to figure out a compromise.