raise and catch correct authenticate error

keystone/service.py

@@ -149,11 +149,14 @@ class TokenController(wsgi.Application):
             else:
                 tenant_id = auth.get('tenantId', None)
 
+            try:
                 (user_ref, tenant_ref, metadata_ref) = \
                         self.identity_api.authenticate(context=context,
                                                        user_id=user_id,
                                                        password=password,
                                                        tenant_id=tenant_id)
+            except AssertionError as e:
+                raise webob.exc.HTTPForbidden(e.message)
             token_ref = self.token_api.create_token(
                     context, token_id, dict(expires='',
                                             id=token_id,

tests/test_keystoneclient.py

@@ -212,8 +212,7 @@ class KcMasterTestCase(CompatTestCase):
         user = client.users.get(user.id)
         self.assertFalse(user.enabled)
 
-        # TODO(ja): test that you can't login
-        self.assertRaises(client_exceptions.Forbidden,
+        self.assertRaises(client_exceptions.AuthorizationFailure,
                   self._client,
                   username=test_username,
                   password='password')