diff --git a/ansible/roles/horizon/defaults/main.yml b/ansible/roles/horizon/defaults/main.yml
index 58a2894043..9f975a8392 100644
--- a/ansible/roles/horizon/defaults/main.yml
+++ b/ansible/roles/horizon/defaults/main.yml
@@ -60,6 +60,7 @@ horizon_image_full: "{{ horizon_image }}:{{ horizon_tag }}"
 # OpenStack
 ####################
 horizon_logging_debug: "{{ openstack_logging_debug }}"
+horizon_keystone_url: "{{ keystone_internal_url }}"
 
 
 ####################
diff --git a/ansible/roles/horizon/templates/local_settings.j2 b/ansible/roles/horizon/templates/local_settings.j2
index a8ff82cceb..9ce7357066 100644
--- a/ansible/roles/horizon/templates/local_settings.j2
+++ b/ansible/roles/horizon/templates/local_settings.j2
@@ -206,7 +206,7 @@ AVAILABLE_REGIONS = [
 
 OPENSTACK_HOST = "{{ kolla_internal_fqdn }}"
 
-OPENSTACK_KEYSTONE_URL = "{{ keystone_internal_url }}"
+OPENSTACK_KEYSTONE_URL = "{{ horizon_keystone_url }}"
 OPENSTACK_KEYSTONE_DEFAULT_ROLE = "{{ keystone_default_user_role }}"
 
 # Enables keystone web single-sign-on if set to True.
diff --git a/releasenotes/notes/horizon-keystone-url-97dcc26389f6d025.yaml b/releasenotes/notes/horizon-keystone-url-97dcc26389f6d025.yaml
new file mode 100644
index 0000000000..fcacc624a7
--- /dev/null
+++ b/releasenotes/notes/horizon-keystone-url-97dcc26389f6d025.yaml
@@ -0,0 +1,6 @@
+---
+features:
+  - |
+    Introduces a new variable, horizon_keystone_url, which facilitates
+    overriding the URL used by Horizon to talk to the identity service
+    (Keystone).  Defaults to the identity service's internal URL.