Hello Steve,

I am able to reproduce a very similar comportment as Joe reported. 

Name: python-keystoneclient
Version: 3.10.0
Name: python-openstackclient
Version: 3.8.1
Name: keystoneauth1
Version: 2.18.0

$ openstack token issue \
 --os-auth-type v3oidcpassword \
 --os-auth-url http://keystone:5000/v3 \
 --os-identity-provider idp \
 --os-protocol oidc \
 --os-client-id CLIENTID \
 --os-client-secret CLIENTSECRET \
 --os-discovery-endpoint https://ID_HOST/openam/oauth2/REALM/.well-known/openid-configuration \
 --os-username USER \
 --os-password PASSWD \
 --debug

options: Namespace(access_token='***', access_token_endpoint='', access_token_type='', auth_type=u'v3oidcpassword', auth_url=u'http://keystone:5000/v3', cacert=None, cert='', client_id=u'CLIENTID', client_secret=***'CLIENTSECRET', cloud='', code='', debug=True, default_domain='default', default_domain_id='', default_domain_name='', deferred_help=False, discovery_endpoint=u'https://ID_HOST/openam/oauth2/REALM/.well-known/openid-configuration', domain_id='', domain_name='', endpoint='', identity_provider=u'idp', insecure=None, interface='public', key='', log_file=None, openid_scope='', os_beta_command=False, os_compute_api_version='', os_identity_api_version='3', os_image_api_version='', os_network_api_version='', os_object_api_version='', os_project_id=None, os_project_name=None, os_volume_api_version='2', passcode='', password=***'PASSWD', project_domain_id='default', project_domain_name='', project_id='a41cafce0fd34990b2c0992001051745', project_name='admin', protocol=u'oidc', redirect_uri='', region_name='RegionOne', timing=False, token='***', trust_id='', url='', user_domain_id='default', user_domain_name='Default', user_id='', username=u'USER', verbose_level=3, verify=None)
Auth plugin v3oidcpassword selected
auth_config_hook(): {'auth_type': u'v3oidcpassword', 'beta_command': False, u'compute_api_version': u'2', 'client_id': u'CLIENTID', u'database_api_version': u'1.0', 'cacert': None, 'auth_url': u'http://keystone:5000/v3', u'network_api_version': u'2', 'protocol': u'oidc', u'message': u'', u'image_format': u'qcow2', 'discovery_endpoint': u'https://ID_HOST/openam/oauth2/REALM/.well-known/openid-configuration', 'networks': [], u'image_api_version': u'2', 'verify': True, 'identity_provider': u'idp', u'dns_api_version': u'2', u'object_store_api_version': u'1', 'username': u'USER', u'container_infra_api_version': u'1', 'verbose_level': 3, 'region_name': 'RegionOne', 'api_timeout': None, u'baremetal_api_version': u'1', 'auth': {'project_id': 'a41cafce0fd34990b2c0992001051745', 'user_domain_name': 'Default', 'project_name': 'admin', 'user_domain_id': 'default', 'project_domain_id': 'default'}, 'default_domain': 'default', u'container_api_version': u'1', u'image_api_use_tasks': False, u'floating_ip_source': u'neutron', 'key': None, 'timing': False, 'password': u'***', u'application_catalog_api_version': u'1', u'key_manager_api_version': u'v1', u'metering_api_version': u'2', u'orchestration_api_version': u'1', u'identity_api_version': '3', u'volume_api_version': '2', 'deferred_help': False, 'cert': None, u'secgroup_source': u'neutron', u'status': u'active', 'debug': True, 'client_secret': u'***', u'interface': 'public', u'disable_vendor_agent': {}}
defaults: {u'auth_type': 'password', u'status': u'active', u'compute_api_version': u'2', 'key': None, u'database_api_version': u'1.0', 'api_timeout': None, u'baremetal_api_version': u'1', u'image_api_version': u'2', u'container_infra_api_version': u'1', u'metering_api_version': u'2', u'image_api_use_tasks': False, u'floating_ip_source': u'neutron', u'orchestration_api_version': u'1', 'cacert': None, u'network_api_version': u'2', u'message': u'', u'image_format': u'qcow2', u'application_catalog_api_version': u'1', u'key_manager_api_version': u'v1', 'verify': True, u'identity_api_version': u'2.0', u'volume_api_version': u'2', 'cert': None, u'secgroup_source': u'neutron', u'container_api_version': u'1', u'dns_api_version': u'2', u'object_store_api_version': u'1', u'interface': None, u'disable_vendor_agent': {}}
cloud cfg: {'auth_type': u'v3oidcpassword', 'beta_command': False, u'compute_api_version': u'2', 'client_id': u'CLIENTID', u'database_api_version': u'1.0', 'cacert': None, 'auth_url': u'http://keystone:5000/v3', u'network_api_version': u'2', 'protocol': u'oidc', u'message': u'', u'image_format': u'qcow2', 'discovery_endpoint': u'https://ID_HOST/openam/oauth2/REALM/.well-known/openid-configuration', 'networks': [], u'image_api_version': u'2', 'verify': True, 'identity_provider': u'idp', u'dns_api_version': u'2', u'object_store_api_version': u'1', 'username': u'USER', u'container_infra_api_version': u'1', 'verbose_level': 3, 'region_name': 'RegionOne', 'api_timeout': None, u'baremetal_api_version': u'1', 'auth': {'project_id': 'a41cafce0fd34990b2c0992001051745', 'user_domain_name': 'Default', 'project_name': 'admin', 'user_domain_id': 'default', 'project_domain_id': 'default'}, 'default_domain': 'default', u'container_api_version': u'1', u'image_api_use_tasks': False, u'floating_ip_source': u'neutron', 'key': None, 'timing': False, 'password': u'***', u'application_catalog_api_version': u'1', u'key_manager_api_version': u'v1', u'metering_api_version': u'2', u'orchestration_api_version': u'1', u'identity_api_version': '3', u'volume_api_version': '2', 'deferred_help': False, 'cert': None, u'secgroup_source': u'neutron', u'status': u'active', 'debug': True, 'client_secret': u'***', u'interface': 'public', u'disable_vendor_agent': {}}
compute API version 2, cmd group openstack.compute.v2
network API version 2, cmd group openstack.network.v2
image API version 2, cmd group openstack.image.v2
volume API version 2, cmd group openstack.volume.v2
identity API version 3, cmd group openstack.identity.v3
object_store API version 1, cmd group openstack.object_store.v1
neutronclient API version 2, cmd group openstack.neutronclient.v2
Auth plugin v3oidcpassword selected
auth_config_hook(): {'auth_type': u'v3oidcpassword', 'beta_command': False, u'compute_api_version': u'2', 'client_id': u'CLIENTID', u'database_api_version': u'1.0', 'cacert': None, 'auth_url': u'http://keystone:5000/v3', u'network_api_version': u'2', 'protocol': u'oidc', u'message': u'', u'image_format': u'qcow2', 'discovery_endpoint': u'https://ID_HOST/openam/oauth2/REALM/.well-known/openid-configuration', 'networks': [], u'image_api_version': u'2', 'verify': True, 'identity_provider': u'idp', u'dns_api_version': u'2', u'object_store_api_version': u'1', 'username': u'USER', u'container_infra_api_version': u'1', 'verbose_level': 3, 'region_name': 'RegionOne', 'api_timeout': None, u'baremetal_api_version': u'1', 'auth': {'project_id': 'a41cafce0fd34990b2c0992001051745', 'user_domain_name': 'Default', 'project_name': 'admin', 'user_domain_id': 'default', 'project_domain_id': 'default'}, 'default_domain': 'default', u'container_api_version': u'1', u'image_api_use_tasks': False, u'floating_ip_source': u'neutron', 'key': None, 'timing': False, 'password': u'***', u'application_catalog_api_version': u'1', u'key_manager_api_version': u'v1', u'metering_api_version': u'2', u'orchestration_api_version': u'1', u'identity_api_version': '3', u'volume_api_version': '2', 'deferred_help': False, 'cert': None, u'secgroup_source': u'neutron', u'status': u'active', 'debug': True, 'client_secret': u'***', u'interface': 'public', u'disable_vendor_agent': {}}
Auth plugin v3oidcpassword selected
auth_config_hook(): {'auth_type': u'v3oidcpassword', 'beta_command': False, u'compute_api_version': u'2', 'client_id': u'CLIENTID', u'database_api_version': u'1.0', 'cacert': None, 'auth_url': u'http://keystone:5000/v3', u'network_api_version': u'2', 'protocol': u'oidc', u'message': u'', u'image_format': u'qcow2', 'discovery_endpoint': u'https://ID_HOST/openam/oauth2/REALM/.well-known/openid-configuration', 'networks': [], u'image_api_version': u'2', 'verify': True, 'identity_provider': u'idp', u'dns_api_version': u'2', u'object_store_api_version': u'1', 'username': u'USER', u'container_infra_api_version': u'1', 'verbose_level': 3, 'region_name': 'RegionOne', 'api_timeout': None, u'baremetal_api_version': u'1', 'auth': {'project_id': 'a41cafce0fd34990b2c0992001051745', 'user_domain_name': 'Default', 'project_name': 'admin', 'user_domain_id': 'default', 'project_domain_id': 'default'}, 'default_domain': 'default', u'container_api_version': u'1', u'image_api_use_tasks': False, u'floating_ip_source': u'neutron', 'key': None, 'timing': False, 'password': u'***', u'application_catalog_api_version': u'1', u'key_manager_api_version': u'v1', u'metering_api_version': u'2', u'orchestration_api_version': u'1', u'identity_api_version': '3', u'volume_api_version': '2', 'deferred_help': False, 'cert': None, u'secgroup_source': u'neutron', u'status': u'active', 'debug': True, 'client_secret': u'***', u'interface': 'public', u'disable_vendor_agent': {}}
Deferring keystone exception: __init__() got an unexpected keyword argument 'user_domain_id'
command: token issue -> openstackclient.identity.v3.token.IssueToken
Auth plugin v3oidcpassword selected
auth_config_hook(): {'auth_type': u'v3oidcpassword', 'beta_command': False, u'compute_api_version': u'2', 'client_id': u'CLIENTID', u'database_api_version': u'1.0', 'cacert': None, 'auth_url': u'http://keystone:5000/v3', u'network_api_version': u'2', 'protocol': u'oidc', u'message': u'', u'image_format': u'qcow2', 'discovery_endpoint': u'https://ID_HOST/openam/oauth2/REALM/.well-known/openid-configuration', 'networks': [], u'image_api_version': u'2', 'verify': True, 'identity_provider': u'idp', u'dns_api_version': u'2', u'object_store_api_version': u'1', 'username': u'USER', u'container_infra_api_version': u'1', 'verbose_level': 3, 'region_name': 'RegionOne', 'api_timeout': None, u'baremetal_api_version': u'1', 'auth': {'project_id': 'a41cafce0fd34990b2c0992001051745', 'user_domain_name': 'Default', 'project_name': 'admin', 'user_domain_id': 'default', 'project_domain_id': 'default'}, 'default_domain': 'default', u'container_api_version': u'1', u'image_api_use_tasks': False, u'floating_ip_source': u'neutron', 'key': None, 'timing': False, 'password': u'***', u'application_catalog_api_version': u'1', u'key_manager_api_version': u'v1', u'metering_api_version': u'2', u'orchestration_api_version': u'1', u'identity_api_version': '3', u'volume_api_version': '2', 'deferred_help': False, 'cert': None, u'secgroup_source': u'neutron', u'status': u'active', 'debug': True, 'client_secret': u'***', u'interface': 'public', u'disable_vendor_agent': {}}
Deferring keystone exception: __init__() got an unexpected keyword argument 'user_domain_id'
'token'
Traceback (most recent call last):
  File "/home/ajoga/venv/default/local/lib/python2.7/site-packages/cliff/app.py", line 393, in run_subcommand
    self.prepare_to_run_command(cmd)
  File "/home/ajoga/venv/default/local/lib/python2.7/site-packages/openstackclient/shell.py", line 198, in prepare_to_run_command
    return super(OpenStackShell, self).prepare_to_run_command(cmd)
  File "/home/ajoga/venv/default/local/lib/python2.7/site-packages/osc_lib/shell.py", line 452, in prepare_to_run_command
    self.client_manager.setup_auth()
  File "/home/ajoga/venv/default/local/lib/python2.7/site-packages/openstackclient/common/clientmanager.py", line 84, in setup_auth
    self._fallback_load_auth_plugin(e)
  File "/home/ajoga/venv/default/local/lib/python2.7/site-packages/openstackclient/common/clientmanager.py", line 93, in _fallback_load_auth_plugin
    if self._cli_options.config['auth']['token'] == 'x':
KeyError: 'token'
clean_up IssueToken: 'token'
Traceback (most recent call last):
  File "/home/ajoga/venv/default/local/lib/python2.7/site-packages/osc_lib/shell.py", line 135, in run
    ret_val = super(OpenStackShell, self).run(argv)
  File "/home/ajoga/venv/default/local/lib/python2.7/site-packages/cliff/app.py", line 279, in run
    result = self.run_subcommand(remainder)
  File "/home/ajoga/venv/default/local/lib/python2.7/site-packages/osc_lib/shell.py", line 180, in run_subcommand
    ret_value = super(OpenStackShell, self).run_subcommand(argv)
  File "/home/ajoga/venv/default/local/lib/python2.7/site-packages/cliff/app.py", line 393, in run_subcommand
    self.prepare_to_run_command(cmd)
  File "/home/ajoga/venv/default/local/lib/python2.7/site-packages/openstackclient/shell.py", line 198, in prepare_to_run_command
    return super(OpenStackShell, self).prepare_to_run_command(cmd)
  File "/home/ajoga/venv/default/local/lib/python2.7/site-packages/osc_lib/shell.py", line 452, in prepare_to_run_command
    self.client_manager.setup_auth()
  File "/home/ajoga/venv/default/local/lib/python2.7/site-packages/openstackclient/common/clientmanager.py", line 84, in setup_auth
    self._fallback_load_auth_plugin(e)
  File "/home/ajoga/venv/default/local/lib/python2.7/site-packages/openstackclient/common/clientmanager.py", line 93, in _fallback_load_auth_plugin
    if self._cli_options.config['auth']['token'] == 'x':
KeyError: 'token'

END return value: 1