diff --git a/charmhelpers/contrib/openstack/templates/section-keystone-authtoken b/charmhelpers/contrib/openstack/templates/section-keystone-authtoken
index 0b6da25c..5dcebe7c 100644
--- a/charmhelpers/contrib/openstack/templates/section-keystone-authtoken
+++ b/charmhelpers/contrib/openstack/templates/section-keystone-authtoken
@@ -1,20 +1,12 @@
 {% if auth_host -%}
-{% if api_version == '3' -%}
 [keystone_authtoken]
-auth_url = {{ service_protocol }}://{{ service_host }}:{{ service_port }}
+auth_uri = {{ service_protocol }}://{{ service_host }}:{{ service_port }}
+auth_url = {{ auth_protocol }}://{{ auth_host }}:{{ auth_port }}
+auth_plugin = password
+project_domain_id = default
+user_domain_id = default
 project_name = {{ admin_tenant_name }}
 username = {{ admin_user }}
 password = {{ admin_password }}
-project_domain_name = default
-user_domain_name = default
-auth_plugin = password
-{% else -%}
-[keystone_authtoken]
-identity_uri = {{ auth_protocol }}://{{ auth_host }}:{{ auth_port }}/{{ auth_admin_prefix }}
-auth_uri = {{ service_protocol }}://{{ service_host }}:{{ service_port }}/{{ service_admin_prefix }}
-admin_tenant_name = {{ admin_tenant_name }}
-admin_user = {{ admin_user }}
-admin_password = {{ admin_password }}
 signing_dir = {{ signing_dir }}
 {% endif -%}
-{% endif -%}
diff --git a/charmhelpers/contrib/openstack/templates/section-keystone-authtoken-legacy b/charmhelpers/contrib/openstack/templates/section-keystone-authtoken-legacy
new file mode 100644
index 00000000..9356b2be
--- /dev/null
+++ b/charmhelpers/contrib/openstack/templates/section-keystone-authtoken-legacy
@@ -0,0 +1,10 @@
+{% if auth_host -%}
+[keystone_authtoken]
+# Juno specific config (Bug #1557223)
+auth_uri = {{ service_protocol }}://{{ service_host }}:{{ service_port }}/{{ service_admin_prefix }}
+identity_uri = {{ auth_protocol }}://{{ auth_host }}:{{ auth_port }}
+admin_tenant_name = {{ admin_tenant_name }}
+admin_user = {{ admin_user }}
+admin_password = {{ admin_password }}
+signing_dir = {{ signing_dir }}
+{% endif -%}
diff --git a/hooks/manager.py b/hooks/manager.py
index 2267d268..2bd6f88f 100644
--- a/hooks/manager.py
+++ b/hooks/manager.py
@@ -2,7 +2,15 @@
 from keystoneclient.v2_0 import client
 from keystoneclient.v3 import client as keystoneclient_v3
 from keystoneclient.auth import token_endpoint
-from keystoneclient import session
+from keystoneclient import session, exceptions
+from charmhelpers.core.decorators import retry_on_exception
+
+# Early versions of keystoneclient lib do not have an explicit
+# ConnectionRefused
+if hasattr(exceptions, 'ConnectionRefused'):
+    econnrefused = exceptions.ConnectionRefused
+else:
+    econnrefused = exceptions.ConnectionError
 
 
 def _get_keystone_manager_class(endpoint, token, api_version):
@@ -19,12 +27,15 @@ def _get_keystone_manager_class(endpoint, token, api_version):
     raise ValueError('No manager found for api version {}'.format(api_version))
 
 
+@retry_on_exception(5, base_delay=3, exc_type=econnrefused)
 def get_keystone_manager(endpoint, token, api_version=None):
     """Return a keystonemanager for the correct API version
 
     If api_version has not been set then create a manager based on the endpoint
     Use this manager to query the catalogue and determine which api version
-    should actually be being used. Return the correct client based on that
+    should actually be being used. Return the correct client based on that.
+    Function is wrapped in a retry_on_exception to catch the case where the
+    keystone service is still initialising and not responding to requests yet.
     XXX I think the keystone client should be able to do version
         detection automatically so the code below could be greatly
         simplified
diff --git a/tests/charmhelpers/contrib/amulet/utils.py b/tests/charmhelpers/contrib/amulet/utils.py
index 2591a9b1..3e159039 100644
--- a/tests/charmhelpers/contrib/amulet/utils.py
+++ b/tests/charmhelpers/contrib/amulet/utils.py
@@ -782,15 +782,20 @@ class AmuletUtils(object):
 
 # amulet juju action helpers:
     def run_action(self, unit_sentry, action,
-                   _check_output=subprocess.check_output):
+                   _check_output=subprocess.check_output,
+                   params=None):
         """Run the named action on a given unit sentry.
 
+        params a dict of parameters to use
         _check_output parameter is used for dependency injection.
 
         @return action_id.
         """
         unit_id = unit_sentry.info["unit_name"]
         command = ["juju", "action", "do", "--format=json", unit_id, action]
+        if params is not None:
+            for key, value in params.iteritems():
+                command.append("{}={}".format(key, value))
         self.log.info("Running command: %s\n" % " ".join(command))
         output = _check_output(command, universal_newlines=True)
         data = json.loads(output)