The keystone-v3 Fetch Service secret only rewrote password-method Keystone v3 auth requests (identity.password.user.{name,password}). A request using the application_credential method silently failed injection (injectKeystoneV3Secret returned an error that was only debug-logged) and was forwarded upstream with the caller's original, unsubstituted secret intact - which Keystone then rejects, and since processResponse only records artifacts for 200 OK responses, the failure left no trace at all in the session's metadata.json. Add an ApplicationCredential identity shape and dispatch on which method the original request used: application_credential auth is rewritten by substituting identity.application_credential.{id,secret} directly (it carries no domain/user scope, since the credential is already project-scoped), while password auth keeps its existing domain-preserving rewrite. - [ ] Have you signed the [CLA](http://www.ubuntu.com/legal/contributors/)? -----