How does OpenStack Glance work with Keystone and what exactly are these configuration options for?

I am configuring Glance to authenticate against Keystone. It works but I am unsure exactly how some of the authentication options interact.

I started with the configuring glance documentation, but this doesn't actually document any of these options. I found the authentication documentation, which discusses some of them, but does not actually document auth_uri.

The example glance configuration in the OpenStack Install and Deploy Manual looks like this:

[filter:authtoken]
paste.filter_factory = keystone.middleware.auth_token:filter_factory
service_protocol = http
service_host = 127.0.0.1
service_port = 5000
auth_host = 127.0.0.1
auth_port = 35357
auth_protocol = http
auth_uri = http://127.0.0.1:5000/
admin_token = 012345SECRET99TOKEN012345

The authentication documentation says:

Those variables beginning with auth_ point to the Keystone Admin service. This information is used by the middleware to actually query Keystone about the validity of the authentication tokens.

Okay. So how does auth_uri interact with auth_host, auth_port, and auth_protocol? Can one simply provide auth_uri and discard the other options? Is there a corresponding service_uri configuration option? And why does the port in auth_uri correspond to the service_port in the above configuration instead of the auth_port?

Keystone refers to port 35357 as the "admin" port, which to me suggests that this would only be required for administration of keystone (creating/deleting services, tenants, etc). Glance instead refers to this as the "auth" port, which suggests a different use. What exactly is provided by the service on port 35357 that is not provided by the service on port 5000?