diff --git a/bin/keystone-all b/bin/keystone-all
index 7e6711b5df..53b50199f6 100755
--- a/bin/keystone-all
+++ b/bin/keystone-all
@@ -1,7 +1,6 @@
 #!/usr/bin/env python
 # vim: tabstop=4 shiftwidth=4 softtabstop=4
 
-import greenlet
 import logging
 import os
 import signal
@@ -21,8 +20,8 @@ if os.path.exists(os.path.join(possible_topdir,
 from paste import deploy
 import pbr.version
 
+from keystone.common import environment
 from keystone.common import utils
-from keystone.common import wsgi_server
 from keystone import config
 from keystone.openstack.common import gettextutils
 from keystone.openstack.common import importutils
@@ -33,7 +32,7 @@ CONF = config.CONF
 
 def create_server(conf, name, host, port):
     app = deploy.loadapp('config:%s' % conf, name=name)
-    server = wsgi_server.Server(app, host=host, port=port)
+    server = environment.Server(app, host=host, port=port)
     if CONF.ssl.enable:
         server.set_ssl(CONF.ssl.certfile, CONF.ssl.keyfile,
                        CONF.ssl.ca_certs, CONF.ssl.cert_required)
@@ -64,10 +63,7 @@ def serve(*servers):
                 logging.exception('Failed to execute onready command')
 
     for server in servers:
-        try:
-            server.wait()
-        except greenlet.GreenletExit:
-            pass
+        server.wait()
 
 
 if __name__ == '__main__':
@@ -100,7 +96,7 @@ if __name__ == '__main__':
         # http://lists.openstack.org/pipermail/openstack-dev/2012-August/
         # 000794.html
         monkeypatch_thread = False
-    wsgi_server.monkey_patch_eventlet(monkeypatch_thread=monkeypatch_thread)
+    environment.use_eventlet(monkeypatch_thread)
 
     servers = []
     servers.append(create_server(paste_config,
diff --git a/bin/keystone-manage b/bin/keystone-manage
index 89ada5bded..3eedea3b4d 100755
--- a/bin/keystone-manage
+++ b/bin/keystone-manage
@@ -14,11 +14,13 @@ if os.path.exists(os.path.join(possible_topdir,
     sys.path.insert(0, possible_topdir)
 
 from keystone import cli
+from keystone.common import environment
 from keystone.openstack.common import gettextutils
 
 
 if __name__ == '__main__':
     gettextutils.install('keystone')
+    environment.use_stdlib()
 
     dev_conf = os.path.join(possible_topdir,
                             'etc',
diff --git a/httpd/keystone.py b/httpd/keystone.py
index 8b1ab74016..65298409d9 100644
--- a/httpd/keystone.py
+++ b/httpd/keystone.py
@@ -2,6 +2,7 @@ import os
 
 from paste import deploy
 
+from keystone.common import environment
 from keystone.common import logging
 from keystone import config
 
@@ -9,6 +10,7 @@ LOG = logging.getLogger(__name__)
 CONF = config.CONF
 CONF(project='keystone')
 
+environment.use_stdlib()
 name = os.path.basename(__file__)
 
 if CONF.debug:
diff --git a/keystone/auth/token_factory.py b/keystone/auth/token_factory.py
index 43a23ce6dd..64f945fae9 100644
--- a/keystone/auth/token_factory.py
+++ b/keystone/auth/token_factory.py
@@ -17,12 +17,12 @@
 """Token Factory"""
 
 import json
-import subprocess
 import uuid
 import webob
 
 from keystone import catalog
 from keystone.common import cms
+from keystone.common import environment
 from keystone.common import logging
 from keystone.common import utils
 from keystone import config
@@ -310,7 +310,7 @@ def create_token(context, auth_context, auth_info):
             token_id = cms.cms_sign_token(json.dumps(token_data),
                                           CONF.signing.certfile,
                                           CONF.signing.keyfile)
-        except subprocess.CalledProcessError:
+        except environment.subprocess.CalledProcessError:
             raise exception.UnexpectedError(_(
                 'Unable to sign token.'))
     else:
diff --git a/keystone/common/cms.py b/keystone/common/cms.py
index 307542b40f..6ec740f8e9 100644
--- a/keystone/common/cms.py
+++ b/keystone/common/cms.py
@@ -1,46 +1,31 @@
 import hashlib
 
+from keystone.common import environment
 from keystone.common import logging
 
 
-subprocess = None
 LOG = logging.getLogger(__name__)
 PKI_ANS1_PREFIX = 'MII'
 
 
-def _ensure_subprocess():
-    # NOTE(vish): late loading subprocess so we can
-    #             use the green version if we are in
-    #             eventlet.
-    global subprocess
-    if not subprocess:
-        try:
-            from eventlet import patcher
-            if patcher.already_patched.get('os'):
-                from eventlet.green import subprocess
-            else:
-                import subprocess
-        except ImportError:
-            import subprocess  # nopep8
-
-
 def cms_verify(formatted, signing_cert_file_name, ca_file_name):
     """Verifies the signature of the contents IAW CMS syntax."""
-    _ensure_subprocess()
-    process = subprocess.Popen(["openssl", "cms", "-verify",
-                                "-certfile", signing_cert_file_name,
-                                "-CAfile", ca_file_name,
-                                "-inform", "PEM",
-                                "-nosmimecap", "-nodetach",
-                                "-nocerts", "-noattr"],
-                               stdin=subprocess.PIPE,
-                               stdout=subprocess.PIPE,
-                               stderr=subprocess.PIPE)
+    process = environment.subprocess.Popen(["openssl", "cms", "-verify",
+                                            "-certfile",
+                                            signing_cert_file_name,
+                                            "-CAfile", ca_file_name,
+                                            "-inform", "PEM",
+                                            "-nosmimecap", "-nodetach",
+                                            "-nocerts", "-noattr"],
+                                           stdin=environment.subprocess.PIPE,
+                                           stdout=environment.subprocess.PIPE,
+                                           stderr=environment.subprocess.PIPE)
     output, err = process.communicate(formatted)
     retcode = process.poll()
     if retcode:
         LOG.error(_('Verify error: %s') % err)
-        raise subprocess.CalledProcessError(retcode, "openssl", output=err)
+        raise environment.subprocess.CalledProcessError(retcode,
+                                                        "openssl", output=err)
     return output
 
 
@@ -117,16 +102,15 @@ def cms_sign_text(text, signing_cert_file_name, signing_key_file_name):
     Produces a Base64 encoding of a DER formatted CMS Document
     http://en.wikipedia.org/wiki/Cryptographic_Message_Syntax
     """
-    _ensure_subprocess()
-    process = subprocess.Popen(["openssl", "cms", "-sign",
-                                "-signer", signing_cert_file_name,
-                                "-inkey", signing_key_file_name,
-                                "-outform", "PEM",
-                                "-nosmimecap", "-nodetach",
-                                "-nocerts", "-noattr"],
-                               stdin=subprocess.PIPE,
-                               stdout=subprocess.PIPE,
-                               stderr=subprocess.PIPE)
+    process = environment.subprocess.Popen(["openssl", "cms", "-sign",
+                                            "-signer", signing_cert_file_name,
+                                            "-inkey", signing_key_file_name,
+                                            "-outform", "PEM",
+                                            "-nosmimecap", "-nodetach",
+                                            "-nocerts", "-noattr"],
+                                           stdin=environment.subprocess.PIPE,
+                                           stdout=environment.subprocess.PIPE,
+                                           stderr=environment.subprocess.PIPE)
     output, err = process.communicate(text)
     retcode = process.poll()
     if retcode or "Error" in err:
@@ -136,7 +120,7 @@ def cms_sign_text(text, signing_cert_file_name, signing_key_file_name):
                       "'keystone-manage pki_setup'"))
         else:
             LOG.error(_('Signing error: %s') % err)
-        raise subprocess.CalledProcessError(retcode, "openssl")
+        raise environment.subprocess.CalledProcessError(retcode, "openssl")
     return output
 
 
diff --git a/keystone/common/environment/__init__.py b/keystone/common/environment/__init__.py
new file mode 100644
index 0000000000..ac93e24f93
--- /dev/null
+++ b/keystone/common/environment/__init__.py
@@ -0,0 +1,78 @@
+import functools
+import os
+
+from keystone.common import config
+from keystone.common import logging
+
+CONF = config.CONF
+LOG = logging.getLogger(__name__)
+
+
+__all__ = ['Server', 'httplib', 'subprocess']
+
+_configured = False
+
+Server = None
+httplib = None
+subprocess = None
+
+
+def configure_once(name):
+    """Ensure that environment configuration is only run once.
+
+    If environment is reconfigured in the same way then it is ignored.
+    It is an error to attempt to reconfigure environment in a different way.
+    """
+    def decorator(func):
+        @functools.wraps(func)
+        def wrapper(*args, **kwargs):
+            global _configured
+            if _configured:
+                if _configured == name:
+                    return
+                else:
+                    raise SystemError("Environment has already been "
+                                      "configured as %s" % _configured)
+
+            LOG.info(_("Environment configured as: %s"), name)
+            _configured = name
+            return func(*args, **kwargs)
+
+        return wrapper
+    return decorator
+
+
+@configure_once('eventlet')
+def use_eventlet(monkeypatch_thread=None):
+    global httplib, subprocess, Server
+
+    # This must be set before the initial import of eventlet because if
+    # dnspython is present in your environment then eventlet monkeypatches
+    # socket.getaddrinfo() with an implementation which doesn't work for IPv6.
+    os.environ['EVENTLET_NO_GREENDNS'] = 'yes'
+
+    import eventlet
+    from eventlet.green import httplib as _httplib
+    from eventlet.green import subprocess as _subprocess
+    from keystone.common.environment import eventlet_server
+
+    if monkeypatch_thread is None:
+        monkeypatch_thread = not os.getenv('STANDARD_THREADS')
+
+    eventlet.patcher.monkey_patch(all=False, socket=True, time=True,
+                                  thread=monkeypatch_thread)
+
+    Server = eventlet_server.Server
+    httplib = _httplib
+    subprocess = _subprocess
+
+
+@configure_once('stdlib')
+def use_stdlib():
+    global httplib, subprocess
+
+    import httplib as _httplib
+    import subprocess as _subprocess
+
+    httplib = _httplib
+    subprocess = _subprocess
diff --git a/keystone/common/wsgi_server.py b/keystone/common/environment/eventlet_server.py
similarity index 80%
rename from keystone/common/wsgi_server.py
rename to keystone/common/environment/eventlet_server.py
index d8d2512fd1..18987d260a 100644
--- a/keystone/common/wsgi_server.py
+++ b/keystone/common/environment/eventlet_server.py
@@ -18,26 +18,13 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import os
 import socket
 import ssl
 import sys
 
-# NOTE(mikal): All of this is because if dnspython is present in your
-# environment then eventlet monkeypatches socket.getaddrinfo() with an
-# implementation which doesn't work for IPv6. What we're checking here is
-# that the magic environment variable was set when the import happened.
-if ('eventlet' in sys.modules and
-        os.environ.get('EVENTLET_NO_GREENDNS', '').lower() != 'yes'):
-    raise ImportError('eventlet imported before '
-                      'keystone.common.wsgi_server '
-                      '(EVENTLET_NO_GREENDNS env var set to %s)'
-                      % os.environ.get('EVENTLET_NO_GREENDNS'))
-
-os.environ['EVENTLET_NO_GREENDNS'] = 'yes'
-
 import eventlet
 import eventlet.wsgi
+import greenlet
 
 from keystone.common import logging
 from keystone.common import wsgi
@@ -46,14 +33,6 @@ from keystone.common import wsgi
 LOG = logging.getLogger(__name__)
 
 
-def monkey_patch_eventlet(monkeypatch_thread=None):
-    if monkeypatch_thread is None:
-        monkeypatch_thread = not os.getenv('STANDARD_THREADS')
-
-    eventlet.patcher.monkey_patch(all=False, socket=True, time=True,
-                                  thread=monkeypatch_thread)
-
-
 class Server(object):
     """Server class to manage multiple WSGI sockets and applications."""
 
@@ -121,6 +100,8 @@ class Server(object):
             self.pool.waitall()
         except KeyboardInterrupt:
             pass
+        except greenlet.GreenletExit:
+            pass
 
     def _run(self, application, socket):
         """Start a WSGI server in a new green thread."""
diff --git a/keystone/common/openssl.py b/keystone/common/openssl.py
index 47ac5aa69c..427202ae5d 100644
--- a/keystone/common/openssl.py
+++ b/keystone/common/openssl.py
@@ -16,8 +16,8 @@
 
 import os
 import stat
-import subprocess
 
+from keystone.common import environment
 from keystone.common import logging
 from keystone import config
 
@@ -77,7 +77,7 @@ class BaseCertificateConfigure(object):
     def exec_command(self, command):
         to_exec = command % self.ssl_dictionary
         LOG.info(to_exec)
-        subprocess.check_call(to_exec.rsplit(' '))
+        environment.subprocess.check_call(to_exec.rsplit(' '))
 
     def build_ssl_config_file(self):
         if not file_exists(self.ssl_config_file_name):
diff --git a/keystone/common/utils.py b/keystone/common/utils.py
index fc62de97da..fd2d756754 100644
--- a/keystone/common/utils.py
+++ b/keystone/common/utils.py
@@ -21,12 +21,12 @@
 import hashlib
 import json
 import os
-import subprocess
 import time
 
 import passlib.hash
 
 from keystone.common import config
+from keystone.common import environment
 from keystone.common import logging
 from keystone import exception
 
@@ -160,14 +160,15 @@ def check_output(*popenargs, **kwargs):
     if 'stdout' in kwargs:
         raise ValueError('stdout argument not allowed, it will be overridden.')
     LOG.debug(' '.join(popenargs[0]))
-    process = subprocess.Popen(stdout=subprocess.PIPE, *popenargs, **kwargs)
+    process = environment.subprocess.Popen(stdout=environment.subprocess.PIPE,
+                                           *popenargs, **kwargs)
     output, unused_err = process.communicate()
     retcode = process.poll()
     if retcode:
         cmd = kwargs.get('args')
         if cmd is None:
             cmd = popenargs[0]
-        raise subprocess.CalledProcessError(retcode, cmd)
+        raise environment.subprocess.CalledProcessError(retcode, cmd)
     return output
 
 
diff --git a/keystone/middleware/ec2_token.py b/keystone/middleware/ec2_token.py
index 7cd007c722..265ccaa6e6 100644
--- a/keystone/middleware/ec2_token.py
+++ b/keystone/middleware/ec2_token.py
@@ -24,7 +24,6 @@ Starting point for routing EC2 requests.
 
 import urlparse
 
-from eventlet.green import httplib
 import webob.dec
 import webob.exc
 
@@ -32,6 +31,7 @@ from nova import flags
 from nova import utils
 from nova import wsgi
 
+from keystone.common import environment
 
 FLAGS = flags.FLAGS
 flags.DEFINE_string('keystone_ec2_url',
@@ -75,9 +75,9 @@ class EC2Token(wsgi.Middleware):
         # pylint: disable-msg=E1101
         o = urlparse.urlparse(FLAGS.keystone_ec2_url)
         if o.scheme == 'http':
-            conn = httplib.HTTPConnection(o.netloc)
+            conn = environment.httplib.HTTPConnection(o.netloc)
         else:
-            conn = httplib.HTTPSConnection(o.netloc)
+            conn = environment.httplib.HTTPSConnection(o.netloc)
         conn.request('POST', o.path, body=creds_json, headers=headers)
         response = conn.getresponse().read()
         conn.close()
diff --git a/keystone/middleware/s3_token.py b/keystone/middleware/s3_token.py
index 74be586436..a5eff28947 100644
--- a/keystone/middleware/s3_token.py
+++ b/keystone/middleware/s3_token.py
@@ -33,13 +33,13 @@ This WSGI component:
 
 """
 
-import httplib
-
 import webob
 
-from keystone.openstack.common import jsonutils
 from swift.common import utils as swift_utils
 
+from keystone.common import environment
+from keystone.openstack.common import jsonutils
+
 
 PROTOCOL_NAME = 'S3 Token Authentication'
 
@@ -62,9 +62,9 @@ class S3Token(object):
         self.auth_port = int(conf.get('auth_port', 35357))
         self.auth_protocol = conf.get('auth_protocol', 'https')
         if self.auth_protocol == 'http':
-            self.http_client_class = httplib.HTTPConnection
+            self.http_client_class = environment.httplib.HTTPConnection
         else:
-            self.http_client_class = httplib.HTTPSConnection
+            self.http_client_class = environment.httplib.HTTPSConnection
         # SSL
         self.cert_file = conf.get('certfile')
         self.key_file = conf.get('keyfile')
diff --git a/keystone/test.py b/keystone/test.py
index 3fc0b301b9..d0570ca7c7 100644
--- a/keystone/test.py
+++ b/keystone/test.py
@@ -19,7 +19,6 @@ import errno
 import os
 import socket
 import StringIO
-import subprocess
 import sys
 import time
 
@@ -31,12 +30,16 @@ from paste import deploy
 import stubout
 import unittest2 as unittest
 
+gettext.install('keystone', unicode=1)
+
+from keystone.common import environment
+environment.use_eventlet()
+
 from keystone import catalog
 from keystone.common import kvs
 from keystone.common import logging
 from keystone.common import utils
 from keystone.common import wsgi
-from keystone.common import wsgi_server
 from keystone import config
 from keystone import credential
 from keystone import exception
@@ -47,11 +50,6 @@ from keystone import token
 from keystone import trust
 
 
-wsgi_server.monkey_patch_eventlet()
-
-
-gettext.install('keystone', unicode=1)
-
 LOG = logging.getLogger(__name__)
 ROOTDIR = os.path.dirname(os.path.abspath(os.curdir))
 VENDOR = os.path.join(ROOTDIR, 'vendor')
@@ -115,7 +113,7 @@ def checkout_vendor(repo, rev):
         # write out a modified time
         with open(modcheck, 'w') as fd:
             fd.write('1')
-    except subprocess.CalledProcessError:
+    except environment.subprocess.CalledProcessError:
         LOG.warning(_('Failed to checkout %s'), repo)
     cd(working_dir)
     return revdir
@@ -320,7 +318,7 @@ class TestCase(NoModule, unittest.TestCase):
     def serveapp(self, config, name=None, cert=None, key=None, ca=None,
                  cert_required=None, host="127.0.0.1", port=0):
         app = self.loadapp(config, name=name)
-        server = wsgi_server.Server(app, host, port)
+        server = environment.Server(app, host, port)
         if cert is not None and ca is not None and key is not None:
             server.set_ssl(certfile=cert, keyfile=key, ca_certs=ca,
                            cert_required=cert_required)
diff --git a/keystone/token/controllers.py b/keystone/token/controllers.py
index 2d4297426a..68a3ebcd3c 100644
--- a/keystone/token/controllers.py
+++ b/keystone/token/controllers.py
@@ -1,10 +1,10 @@
 import json
-import subprocess
 import uuid
 
 from keystone.common import cms
 from keystone.common import controller
 from keystone.common import dependency
+from keystone.common import environment
 from keystone.common import logging
 from keystone.common import utils
 from keystone import config
@@ -117,7 +117,7 @@ class Auth(controller.V2Controller):
                 token_id = cms.cms_sign_token(json.dumps(token_data),
                                               CONF.signing.certfile,
                                               CONF.signing.keyfile)
-            except subprocess.CalledProcessError:
+            except environment.subprocess.CalledProcessError:
                 raise exception.UnexpectedError(_(
                     'Unable to sign token.'))
         else:
diff --git a/tests/test_auth.py b/tests/test_auth.py
index e7c9704a2c..465a08961c 100644
--- a/tests/test_auth.py
+++ b/tests/test_auth.py
@@ -16,11 +16,12 @@ import copy
 import datetime
 import uuid
 
+from keystone import test
+
 from keystone import auth
 from keystone import config
 from keystone import exception
 from keystone.openstack.common import timeutils
-from keystone import test
 from keystone import token
 from keystone import trust
 
diff --git a/tests/test_auth_plugin.py b/tests/test_auth_plugin.py
index 47080b53c0..2235747174 100644
--- a/tests/test_auth_plugin.py
+++ b/tests/test_auth_plugin.py
@@ -16,9 +16,10 @@
 
 import uuid
 
+from keystone import test
+
 from keystone import auth
 from keystone import exception
-from keystone import test
 
 
 # for testing purposes only
diff --git a/tests/test_backend.py b/tests/test_backend.py
index bd9d53caac..7cb1e1acf1 100644
--- a/tests/test_backend.py
+++ b/tests/test_backend.py
@@ -18,11 +18,12 @@ import datetime
 import default_fixtures
 import uuid
 
+from keystone import test
+
 from keystone.catalog import core
 from keystone import config
 from keystone import exception
 from keystone.openstack.common import timeutils
-from keystone import test
 
 
 CONF = config.CONF
diff --git a/tests/test_backend_kvs.py b/tests/test_backend_kvs.py
index 3a4e2da876..dce1f756f8 100644
--- a/tests/test_backend_kvs.py
+++ b/tests/test_backend_kvs.py
@@ -17,11 +17,12 @@ import uuid
 
 import nose.exc
 
+from keystone import test
+
 from keystone import catalog
 from keystone.catalog.backends import kvs as catalog_kvs
 from keystone import exception
 from keystone import identity
-from keystone import test
 from keystone.token.backends import kvs as token_kvs
 from keystone.trust.backends import kvs as trust_kvs
 
diff --git a/tests/test_backend_ldap.py b/tests/test_backend_ldap.py
index ee02c7a446..16530f1034 100644
--- a/tests/test_backend_ldap.py
+++ b/tests/test_backend_ldap.py
@@ -19,11 +19,12 @@ import uuid
 
 import nose.exc
 
+from keystone import test
+
 from keystone.common.ldap import fakeldap
 from keystone import config
 from keystone import exception
 from keystone import identity
-from keystone import test
 
 import default_fixtures
 import test_backend
diff --git a/tests/test_backend_memcache.py b/tests/test_backend_memcache.py
index 5391d7f9a8..e31f157671 100644
--- a/tests/test_backend_memcache.py
+++ b/tests/test_backend_memcache.py
@@ -20,11 +20,12 @@ import uuid
 
 import memcache
 
+from keystone import test
+
 from keystone.common import utils
 from keystone import exception
 from keystone.openstack.common import jsonutils
 from keystone.openstack.common import timeutils
-from keystone import test
 from keystone import token
 from keystone.token.backends import memcache as token_memcache
 
diff --git a/tests/test_backend_pam.py b/tests/test_backend_pam.py
index a8f4e5759a..3a66f01458 100644
--- a/tests/test_backend_pam.py
+++ b/tests/test_backend_pam.py
@@ -16,9 +16,10 @@
 
 import uuid
 
+from keystone import test
+
 from keystone import config
 from keystone.identity.backends import pam as identity_pam
-from keystone import test
 
 
 CONF = config.CONF
diff --git a/tests/test_backend_sql.py b/tests/test_backend_sql.py
index e4a19ef9d0..3136bacb31 100644
--- a/tests/test_backend_sql.py
+++ b/tests/test_backend_sql.py
@@ -16,13 +16,14 @@
 
 import uuid
 
+from keystone import test
+
 from keystone import catalog
 from keystone.common import sql
 from keystone import config
 from keystone import exception
 from keystone import identity
 from keystone import policy
-from keystone import test
 from keystone import token
 from keystone import trust
 
diff --git a/tests/test_backend_templated.py b/tests/test_backend_templated.py
index 31d77acd78..72dd21a772 100644
--- a/tests/test_backend_templated.py
+++ b/tests/test_backend_templated.py
@@ -16,10 +16,11 @@
 
 import os
 
+from keystone import test
+
 from keystone import catalog
 from keystone.catalog.backends import templated as catalog_templated
 from keystone import exception
-from keystone import test
 
 import default_fixtures
 import test_backend
diff --git a/tests/test_cert_setup.py b/tests/test_cert_setup.py
index fb7326b359..74e5466a48 100644
--- a/tests/test_cert_setup.py
+++ b/tests/test_cert_setup.py
@@ -18,9 +18,10 @@
 import os
 import shutil
 
+from keystone import test
+
 from keystone.common import openssl
 from keystone import exception
-from keystone import test
 from keystone import token
 
 import default_fixtures
diff --git a/tests/test_config.py b/tests/test_config.py
index ae134b681f..3165a4f469 100644
--- a/tests/test_config.py
+++ b/tests/test_config.py
@@ -1,6 +1,7 @@
+from keystone import test
+
 from keystone import config
 from keystone import exception
-from keystone import test
 
 
 CONF = config.CONF
diff --git a/tests/test_content_types.py b/tests/test_content_types.py
index fd99eae838..820dc0ddb8 100644
--- a/tests/test_content_types.py
+++ b/tests/test_content_types.py
@@ -21,9 +21,10 @@ from lxml import etree
 import nose.exc
 import webtest
 
+from keystone import test
+
 from keystone.common import serializer
 from keystone.openstack.common import jsonutils
-from keystone import test
 
 import default_fixtures
 
diff --git a/tests/test_contrib_s3_core.py b/tests/test_contrib_s3_core.py
index c76bc898e2..e2c328b535 100644
--- a/tests/test_contrib_s3_core.py
+++ b/tests/test_contrib_s3_core.py
@@ -16,11 +16,12 @@
 
 import uuid
 
+from keystone import test
+
 from keystone.contrib import ec2
 from keystone.contrib import s3
 
 from keystone import exception
-from keystone import test
 
 
 class S3ContribCore(test.TestCase):
diff --git a/tests/test_exception.py b/tests/test_exception.py
index e479f61cc2..ef06f6338c 100644
--- a/tests/test_exception.py
+++ b/tests/test_exception.py
@@ -16,11 +16,12 @@
 
 import uuid
 
+from keystone import test
+
 from keystone.common import wsgi
 from keystone import config
 from keystone import exception
 from keystone.openstack.common import jsonutils
-from keystone import test
 
 
 CONF = config.CONF
diff --git a/tests/test_import_legacy.py b/tests/test_import_legacy.py
index 50bf22f919..bc7f347a8c 100644
--- a/tests/test_import_legacy.py
+++ b/tests/test_import_legacy.py
@@ -21,13 +21,14 @@ try:
 except ImportError:
     from pysqlite2 import dbapi2 as dbapi
 
+from keystone import test
+
 from keystone.catalog.backends import templated as catalog_templated
 from keystone.common.sql import legacy
 from keystone.common.sql import util as sql_util
 from keystone import config
 from keystone import identity
 from keystone.identity.backends import sql as identity_sql
-from keystone import test
 
 
 CONF = config.CONF
diff --git a/tests/test_ipv6.py b/tests/test_ipv6.py
index 0973648f23..9825a5fad6 100644
--- a/tests/test_ipv6.py
+++ b/tests/test_ipv6.py
@@ -15,11 +15,11 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-import httplib
-
-from keystone import config
 from keystone import test
 
+from keystone.common import environment
+from keystone import config
+
 
 CONF = config.CONF
 
@@ -40,12 +40,12 @@ class IPv6TestCase(test.TestCase):
         self.admin_server = self.serveapp('keystone', name='admin',
                                           host="::1", port=0)
         # Verify Admin
-        conn = httplib.HTTPConnection('::1', CONF.admin_port)
+        conn = environment.httplib.HTTPConnection('::1', CONF.admin_port)
         conn.request('GET', '/')
         resp = conn.getresponse()
         self.assertEqual(resp.status, 300)
         # Verify Public
-        conn = httplib.HTTPConnection('::1', CONF.public_port)
+        conn = environment.httplib.HTTPConnection('::1', CONF.public_port)
         conn.request('GET', '/')
         resp = conn.getresponse()
         self.assertEqual(resp.status, 300)
diff --git a/tests/test_keystoneclient.py b/tests/test_keystoneclient.py
index bd53870077..b982855915 100644
--- a/tests/test_keystoneclient.py
+++ b/tests/test_keystoneclient.py
@@ -19,10 +19,11 @@ import webob
 
 import nose.exc
 
+from keystone import test
+
 from keystone import config
 from keystone.openstack.common import jsonutils
 from keystone.openstack.common import timeutils
-from keystone import test
 
 import default_fixtures
 
diff --git a/tests/test_keystoneclient_sql.py b/tests/test_keystoneclient_sql.py
index 30f590229b..5706bef5e2 100644
--- a/tests/test_keystoneclient_sql.py
+++ b/tests/test_keystoneclient_sql.py
@@ -18,9 +18,10 @@ import uuid
 
 import nose.exc
 
+from keystone import test
+
 from keystone.common import sql
 from keystone import config
-from keystone import test
 
 import test_keystoneclient
 
diff --git a/tests/test_middleware.py b/tests/test_middleware.py
index eafdcb92f0..38ba09e981 100644
--- a/tests/test_middleware.py
+++ b/tests/test_middleware.py
@@ -16,10 +16,11 @@
 
 import webob
 
+from keystone import test
+
 from keystone import config
 from keystone import middleware
 from keystone.openstack.common import jsonutils
-from keystone import test
 
 
 CONF = config.CONF
diff --git a/tests/test_migrate_nova_auth.py b/tests/test_migrate_nova_auth.py
index a4ad0fb491..97709b891c 100644
--- a/tests/test_migrate_nova_auth.py
+++ b/tests/test_migrate_nova_auth.py
@@ -16,13 +16,14 @@
 
 import uuid
 
+from keystone import test
+
 from keystone.common.sql import nova
 from keystone.common.sql import util as sql_util
 from keystone import config
 from keystone.contrib.ec2.backends import sql as ec2_sql
 from keystone import identity
 from keystone.identity.backends import sql as identity_sql
-from keystone import test
 
 
 CONF = config.CONF
diff --git a/tests/test_policy.py b/tests/test_policy.py
index 465fd69a5b..010a5abffa 100644
--- a/tests/test_policy.py
+++ b/tests/test_policy.py
@@ -19,11 +19,12 @@ import StringIO
 import tempfile
 import urllib2
 
+from keystone import test
+
 from keystone import config
 from keystone import exception
 from keystone.openstack.common import policy as common_policy
 from keystone.policy.backends import rules
-from keystone import test
 
 
 CONF = config.CONF
diff --git a/tests/test_sizelimit.py b/tests/test_sizelimit.py
index aec57ecfe3..abd2b639dc 100644
--- a/tests/test_sizelimit.py
+++ b/tests/test_sizelimit.py
@@ -14,10 +14,11 @@
 
 import webob
 
+from keystone import test
+
 from keystone import config
 from keystone import exception
 from keystone import middleware
-from keystone import test
 
 CONF = config.CONF
 MAX_REQUEST_BODY_SIZE = CONF.max_request_body_size
diff --git a/tests/test_sql_upgrade.py b/tests/test_sql_upgrade.py
index 59a8800cb2..ac4e5637de 100644
--- a/tests/test_sql_upgrade.py
+++ b/tests/test_sql_upgrade.py
@@ -32,10 +32,11 @@ import uuid
 from migrate.versioning import api as versioning_api
 import sqlalchemy
 
+from keystone import test
+
 from keystone.common import sql
 from keystone.common.sql import migration
 from keystone import config
-from keystone import test
 
 import default_fixtures
 
diff --git a/tests/test_ssl.py b/tests/test_ssl.py
index da9e4c0614..8de5cc1940 100644
--- a/tests/test_ssl.py
+++ b/tests/test_ssl.py
@@ -15,13 +15,13 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
-import httplib
 import os
 import ssl
 
-from keystone import config
 from keystone import test
 
+from keystone.common import environment
+from keystone import config
 
 CONF = config.CONF
 
@@ -45,12 +45,14 @@ class SSLTestCase(test.TestCase):
         self.admin_server = self.serveapp('keystone', name='admin',
                                           cert=CERT, key=KEY, ca=CA)
         # Verify Admin
-        conn = httplib.HTTPSConnection('127.0.0.1', CONF.admin_port)
+        conn = environment.httplib.HTTPSConnection('127.0.0.1',
+                                                   CONF.admin_port)
         conn.request('GET', '/')
         resp = conn.getresponse()
         self.assertEqual(resp.status, 300)
         # Verify Public
-        conn = httplib.HTTPSConnection('127.0.0.1', CONF.public_port)
+        conn = environment.httplib.HTTPSConnection('127.0.0.1',
+                                                   CONF.public_port)
         conn.request('GET', '/')
         resp = conn.getresponse()
         self.assertEqual(resp.status, 300)
@@ -67,13 +69,13 @@ class SSLTestCase(test.TestCase):
             'keystone', name='admin', cert=CERT,
             key=KEY, ca=CA, cert_required=True)
         # Verify Admin
-        conn = httplib.HTTPSConnection(
+        conn = environment.httplib.HTTPSConnection(
             '127.0.0.1', CONF.admin_port, CLIENT, CLIENT)
         conn.request('GET', '/')
         resp = conn.getresponse()
         self.assertEqual(resp.status, 300)
         # Verify Public
-        conn = httplib.HTTPSConnection(
+        conn = environment.httplib.HTTPSConnection(
             '127.0.0.1', CONF.public_port, CLIENT, CLIENT)
         conn.request('GET', '/')
         resp = conn.getresponse()
@@ -89,12 +91,12 @@ class SSLTestCase(test.TestCase):
                                           cert=CERT, key=KEY, ca=CA,
                                           host="::1", port=0)
         # Verify Admin
-        conn = httplib.HTTPSConnection('::1', CONF.admin_port)
+        conn = environment.httplib.HTTPSConnection('::1', CONF.admin_port)
         conn.request('GET', '/')
         resp = conn.getresponse()
         self.assertEqual(resp.status, 300)
         # Verify Public
-        conn = httplib.HTTPSConnection('::1', CONF.public_port)
+        conn = environment.httplib.HTTPSConnection('::1', CONF.public_port)
         conn.request('GET', '/')
         resp = conn.getresponse()
         self.assertEqual(resp.status, 300)
@@ -114,13 +116,13 @@ class SSLTestCase(test.TestCase):
             key=KEY, ca=CA, cert_required=True,
             host="::1", port=0)
         # Verify Admin
-        conn = httplib.HTTPSConnection(
+        conn = environment.httplib.HTTPSConnection(
             '::1', CONF.admin_port, CLIENT, CLIENT)
         conn.request('GET', '/')
         resp = conn.getresponse()
         self.assertEqual(resp.status, 300)
         # Verify Public
-        conn = httplib.HTTPSConnection(
+        conn = environment.httplib.HTTPSConnection(
             '::1', CONF.public_port, CLIENT, CLIENT)
         conn.request('GET', '/')
         resp = conn.getresponse()
@@ -135,14 +137,16 @@ class SSLTestCase(test.TestCase):
             'keystone', name='admin', cert=CERT,
             key=KEY, ca=CA, cert_required=True)
         # Verify Admin
-        conn = httplib.HTTPSConnection('127.0.0.1', CONF.admin_port)
+        conn = environment.httplib.HTTPSConnection('127.0.0.1',
+                                                   CONF.admin_port)
         try:
             conn.request('GET', '/')
             self.fail('Admin API shoulda failed with SSL handshake!')
         except ssl.SSLError:
             pass
         # Verify Public
-        conn = httplib.HTTPSConnection('127.0.0.1', CONF.public_port)
+        conn = environment.httplib.HTTPSConnection('127.0.0.1',
+                                                   CONF.public_port)
         try:
             conn.request('GET', '/')
             self.fail('Public API shoulda failed with SSL handshake!')
diff --git a/tests/test_url_middleware.py b/tests/test_url_middleware.py
index d5c2eef128..2a36e8c2f5 100644
--- a/tests/test_url_middleware.py
+++ b/tests/test_url_middleware.py
@@ -16,9 +16,10 @@
 
 import webob
 
-from keystone import middleware
 from keystone import test
 
+from keystone import middleware
+
 
 class FakeApp(object):
     """Fakes a WSGI app URL normalized."""
diff --git a/tests/test_utils.py b/tests/test_utils.py
index 15ef51a5ec..4a65bea1e7 100644
--- a/tests/test_utils.py
+++ b/tests/test_utils.py
@@ -29,9 +29,10 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-from keystone.common import utils
 from keystone import test
 
+from keystone.common import utils
+
 
 class UtilsTestCase(test.TestCase):
     def test_hash(self):
diff --git a/tests/test_v3.py b/tests/test_v3.py
index 8373ae9842..93293b6c91 100644
--- a/tests/test_v3.py
+++ b/tests/test_v3.py
@@ -4,13 +4,14 @@ import uuid
 from lxml import etree
 import webtest
 
+from keystone import test
+
 from keystone import auth
 from keystone.common import serializer
 from keystone.common.sql import util as sql_util
 from keystone import config
 from keystone.openstack.common import timeutils
 from keystone.policy.backends import rules
-from keystone import test
 
 import test_content_types
 
diff --git a/tests/test_versions.py b/tests/test_versions.py
index 2a53952f88..c0d712f027 100644
--- a/tests/test_versions.py
+++ b/tests/test_versions.py
@@ -15,10 +15,11 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+from keystone import test
+
 from keystone import config
 from keystone import controllers
 from keystone.openstack.common import jsonutils
-from keystone import test
 
 
 CONF = config.CONF
diff --git a/tests/test_wsgi.py b/tests/test_wsgi.py
index 0cd6a73379..8e266749a4 100644
--- a/tests/test_wsgi.py
+++ b/tests/test_wsgi.py
@@ -16,10 +16,11 @@
 
 import webob
 
+from keystone import test
+
 from keystone.common import wsgi
 from keystone import exception
 from keystone.openstack.common import jsonutils
-from keystone import test
 
 
 class FakeApp(wsgi.Application):