diff --git a/keystone/common/cache/_memcache_pool.py b/keystone/common/cache/_memcache_pool.py
index bc559781ab..2bfcc3bb13 100644
--- a/keystone/common/cache/_memcache_pool.py
+++ b/keystone/common/cache/_memcache_pool.py
@@ -27,7 +27,7 @@ import time
 
 import memcache
 from oslo_log import log
-from six.moves import queue
+from six.moves import queue, zip
 
 from keystone import exception
 from keystone.i18n import _
diff --git a/keystone/common/kvs/backends/memcached.py b/keystone/common/kvs/backends/memcached.py
index b863cbc77b..edab16421d 100644
--- a/keystone/common/kvs/backends/memcached.py
+++ b/keystone/common/kvs/backends/memcached.py
@@ -23,6 +23,7 @@ from dogpile.cache import api
 from dogpile.cache.backends import memcached
 from oslo_config import cfg
 from oslo_log import log
+from six.moves import range
 
 from keystone.common.cache.backends import memcache_pool
 from keystone import exception
diff --git a/keystone/common/ldap/core.py b/keystone/common/ldap/core.py
index 866c2b8a62..3cb7e9dd1f 100644
--- a/keystone/common/ldap/core.py
+++ b/keystone/common/ldap/core.py
@@ -24,6 +24,7 @@ import ldap.filter
 import ldappool
 from oslo_log import log
 import six
+from six.moves import map, zip
 
 from keystone import exception
 from keystone.i18n import _
@@ -939,7 +940,7 @@ class KeystoneLDAPHandler(LDAPHandler):
             if attrlist is None:
                 attrlist_utf8 = None
             else:
-                attrlist_utf8 = map(utf8_encode, attrlist)
+                attrlist_utf8 = list(map(utf8_encode, attrlist))
             ldap_result = self.conn.search_s(base_utf8, scope,
                                              filterstr_utf8,
                                              attrlist_utf8, attrsonly)
@@ -990,7 +991,7 @@ class KeystoneLDAPHandler(LDAPHandler):
             attrlist_utf8 = None
         else:
             attrlist = [attr for attr in attrlist if attr is not None]
-            attrlist_utf8 = map(utf8_encode, attrlist)
+            attrlist_utf8 = list(map(utf8_encode, attrlist))
         msgid = self.conn.search_ext(base_utf8,
                                      scope,
                                      filterstr_utf8,
diff --git a/keystone/contrib/federation/utils.py b/keystone/contrib/federation/utils.py
index 6a575badca..251de93e80 100644
--- a/keystone/contrib/federation/utils.py
+++ b/keystone/contrib/federation/utils.py
@@ -509,8 +509,8 @@ class RuleProcessor(object):
         """
 
         def extract_groups(groups_by_domain):
-            for groups in groups_by_domain.values():
-                for group in {g['name']: g for g in groups}.values():
+            for groups in list(groups_by_domain.values()):
+                for group in list({g['name']: g for g in groups}.values()):
                     yield group
 
         def normalize_user(user):
diff --git a/keystone/contrib/revoke/model.py b/keystone/contrib/revoke/model.py
index 5e92042d9a..b13f9ed147 100644
--- a/keystone/contrib/revoke/model.py
+++ b/keystone/contrib/revoke/model.py
@@ -11,6 +11,7 @@
 # under the License.
 
 from oslo_utils import timeutils
+from six.moves import map
 
 
 # The set of attributes common between the RevokeEvent
@@ -111,7 +112,7 @@ class RevokeEvent(object):
 
 
 def attr_keys(event):
-    return map(event.key_for_name, _EVENT_NAMES)
+    return list(map(event.key_for_name, _EVENT_NAMES))
 
 
 class RevokeTree(object):
@@ -176,7 +177,7 @@ class RevokeTree(object):
                 del parent[key]
 
     def add_events(self, revoke_events):
-        return map(self.add_event, revoke_events or [])
+        return list(map(self.add_event, revoke_events or []))
 
     def is_revoked(self, token_data):
         """Check if a token matches the revocation event
diff --git a/keystone/tests/unit/filtering.py b/keystone/tests/unit/filtering.py
index 1a31a23f86..93087dd3c4 100644
--- a/keystone/tests/unit/filtering.py
+++ b/keystone/tests/unit/filtering.py
@@ -15,6 +15,7 @@
 import uuid
 
 from oslo_config import cfg
+from six.moves import range
 
 
 CONF = cfg.CONF
diff --git a/keystone/tests/unit/mapping_fixtures.py b/keystone/tests/unit/mapping_fixtures.py
index 0892ada54b..bb4884c39f 100644
--- a/keystone/tests/unit/mapping_fixtures.py
+++ b/keystone/tests/unit/mapping_fixtures.py
@@ -12,6 +12,9 @@
 
 """Fixtures for Federation Mapping."""
 
+from six.moves import range, zip
+
+
 EMPLOYEE_GROUP_ID = "0cd5e9"
 CONTRACTOR_GROUP_ID = "85a868"
 TESTER_GROUP_ID = "123"
@@ -989,8 +992,8 @@ MALFORMED_TESTER_ASSERTION = {
     'LastName': 'Account',
     'orgPersonType': 'Tester',
     'object': object(),
-    'dictionary': dict(zip('teststring', xrange(10))),
-    'tuple': tuple(xrange(5))
+    'dictionary': dict(zip('teststring', range(10))),
+    'tuple': tuple(range(5))
 }
 
 DEVELOPER_ASSERTION = {
diff --git a/keystone/tests/unit/test_backend.py b/keystone/tests/unit/test_backend.py
index 10ad36b6b6..4761cdfb2d 100644
--- a/keystone/tests/unit/test_backend.py
+++ b/keystone/tests/unit/test_backend.py
@@ -22,6 +22,7 @@ import mock
 from oslo_config import cfg
 from oslo_utils import timeutils
 import six
+from six.moves import range
 from testtools import matchers
 
 from keystone.catalog import core
diff --git a/keystone/tests/unit/test_backend_endpoint_policy.py b/keystone/tests/unit/test_backend_endpoint_policy.py
index cc41d97798..6c2181aa6a 100644
--- a/keystone/tests/unit/test_backend_endpoint_policy.py
+++ b/keystone/tests/unit/test_backend_endpoint_policy.py
@@ -14,6 +14,7 @@
 
 import uuid
 
+from six.moves import range
 from testtools import matchers
 
 from keystone import exception
diff --git a/keystone/tests/unit/test_backend_ldap.py b/keystone/tests/unit/test_backend_ldap.py
index 36f7bb1e66..22ee1fae7c 100644
--- a/keystone/tests/unit/test_backend_ldap.py
+++ b/keystone/tests/unit/test_backend_ldap.py
@@ -20,6 +20,7 @@ import uuid
 import ldap
 import mock
 from oslo_config import cfg
+from six.moves import range
 from testtools import matchers
 
 from keystone.common import cache
diff --git a/keystone/tests/unit/test_backend_sql.py b/keystone/tests/unit/test_backend_sql.py
index 437cf37d46..54879543f3 100644
--- a/keystone/tests/unit/test_backend_sql.py
+++ b/keystone/tests/unit/test_backend_sql.py
@@ -20,6 +20,7 @@ import mock
 from oslo_config import cfg
 from oslo_db import exception as db_exception
 from oslo_db import options
+from six.moves import range
 import sqlalchemy
 from sqlalchemy import exc
 from testtools import matchers
diff --git a/keystone/tests/unit/test_backend_templated.py b/keystone/tests/unit/test_backend_templated.py
index 89e72992b3..d61dfde744 100644
--- a/keystone/tests/unit/test_backend_templated.py
+++ b/keystone/tests/unit/test_backend_templated.py
@@ -15,6 +15,8 @@
 import os
 import uuid
 
+from six.moves import zip
+
 from keystone.tests import unit as tests
 from keystone.tests.unit import default_fixtures
 from keystone.tests.unit.ksfixtures import database
diff --git a/keystone/tests/unit/test_cache_backend_mongo.py b/keystone/tests/unit/test_cache_backend_mongo.py
index 8afd5e8eb8..1d8b607da9 100644
--- a/keystone/tests/unit/test_cache_backend_mongo.py
+++ b/keystone/tests/unit/test_cache_backend_mongo.py
@@ -20,6 +20,7 @@ import uuid
 from dogpile.cache import api
 from dogpile.cache import region as dp_region
 import six
+from six.moves import range
 
 from keystone.common.cache.backends import mongo
 from keystone import exception
diff --git a/keystone/tests/unit/test_cli.py b/keystone/tests/unit/test_cli.py
index 3d63870947..a949d59c77 100644
--- a/keystone/tests/unit/test_cli.py
+++ b/keystone/tests/unit/test_cli.py
@@ -17,6 +17,7 @@ import uuid
 
 import mock
 from oslo_config import cfg
+from six.moves import range
 
 from keystone import cli
 from keystone.common import dependency
diff --git a/keystone/tests/unit/test_ldap_livetest.py b/keystone/tests/unit/test_ldap_livetest.py
index 5b449362c5..044cd76008 100644
--- a/keystone/tests/unit/test_ldap_livetest.py
+++ b/keystone/tests/unit/test_ldap_livetest.py
@@ -18,6 +18,7 @@ import uuid
 import ldap
 import ldap.modlist
 from oslo_config import cfg
+from six.moves import range
 
 from keystone import exception
 from keystone.identity.backends import ldap as identity_ldap
diff --git a/keystone/tests/unit/test_revoke.py b/keystone/tests/unit/test_revoke.py
index fbbc4c4bd3..a2f69c31fd 100644
--- a/keystone/tests/unit/test_revoke.py
+++ b/keystone/tests/unit/test_revoke.py
@@ -16,6 +16,7 @@ import uuid
 
 import mock
 from oslo_utils import timeutils
+from six.moves import range
 from testtools import matchers
 
 from keystone.contrib import revoke
diff --git a/keystone/tests/unit/test_v2_keystoneclient.py b/keystone/tests/unit/test_v2_keystoneclient.py
index d311870983..4e59d2f776 100644
--- a/keystone/tests/unit/test_v2_keystoneclient.py
+++ b/keystone/tests/unit/test_v2_keystoneclient.py
@@ -21,6 +21,7 @@ import mock
 from oslo_config import cfg
 from oslo_serialization import jsonutils
 from oslo_utils import timeutils
+from six.moves import range
 import webob
 
 from keystone.tests import unit as tests
diff --git a/keystone/tests/unit/test_v3_assignment.py b/keystone/tests/unit/test_v3_assignment.py
index 4ac16f263e..cfec22835a 100644
--- a/keystone/tests/unit/test_v3_assignment.py
+++ b/keystone/tests/unit/test_v3_assignment.py
@@ -15,6 +15,7 @@ import uuid
 
 from oslo_config import cfg
 import six
+from six.moves import range
 
 from keystone.common import controller
 from keystone import exception
diff --git a/keystone/tests/unit/test_v3_auth.py b/keystone/tests/unit/test_v3_auth.py
index 5a25a8b9a6..edd6259d67 100644
--- a/keystone/tests/unit/test_v3_auth.py
+++ b/keystone/tests/unit/test_v3_auth.py
@@ -23,6 +23,7 @@ import mock
 from oslo_config import cfg
 from oslo_utils import timeutils
 import six
+from six.moves import range
 from testtools import matchers
 from testtools import testcase
 
@@ -2921,7 +2922,7 @@ class TestTrustChain(test_v3.RestfulTestCase):
         # Create trust chain
         self.user_chain = list()
         self.trust_chain = list()
-        for _ in xrange(3):
+        for _ in range(3):
             user_ref = self.new_user_ref(domain_id=self.domain_id)
             user = self.identity_api.create_user(user_ref)
             user['password'] = user_ref['password']
diff --git a/keystone/tests/unit/test_v3_controller.py b/keystone/tests/unit/test_v3_controller.py
index 3ac4ba5a04..eef64a8263 100644
--- a/keystone/tests/unit/test_v3_controller.py
+++ b/keystone/tests/unit/test_v3_controller.py
@@ -15,6 +15,7 @@
 import uuid
 
 import six
+from six.moves import range
 from testtools import matchers
 
 from keystone.common import controller
diff --git a/keystone/tests/unit/test_v3_federation.py b/keystone/tests/unit/test_v3_federation.py
index 29e9a96318..96daee923a 100644
--- a/keystone/tests/unit/test_v3_federation.py
+++ b/keystone/tests/unit/test_v3_federation.py
@@ -25,7 +25,7 @@ from oslotest import mockpatch
 import saml2
 from saml2 import saml
 from saml2 import sigver
-from six.moves import urllib
+from six.moves import range, urllib, zip
 import xmldsig
 
 from keystone.auth import controllers as auth_controllers
@@ -2155,7 +2155,7 @@ class FederatedTokenTests(FederationTests, FederatedSetupMixin):
         context = {
             'environment': {
                 'malformed_object': object(),
-                'another_bad_idea': tuple(xrange(10)),
+                'another_bad_idea': tuple(range(10)),
                 'yet_another_bad_param': dict(zip(uuid.uuid4().hex,
                                                   range(32)))
             }
diff --git a/keystone/tests/unit/test_v3_filters.py b/keystone/tests/unit/test_v3_filters.py
index 9e87cc7cd1..668a23089d 100644
--- a/keystone/tests/unit/test_v3_filters.py
+++ b/keystone/tests/unit/test_v3_filters.py
@@ -17,6 +17,7 @@ import uuid
 
 from oslo_config import cfg
 from oslo_serialization import jsonutils
+from six.moves import range
 
 from keystone.tests.unit import filtering
 from keystone.tests.unit.ksfixtures import temporaryfile
diff --git a/keystone/tests/unit/token/test_token_model.py b/keystone/tests/unit/token/test_token_model.py
index b24742894c..da082ef16a 100644
--- a/keystone/tests/unit/token/test_token_model.py
+++ b/keystone/tests/unit/token/test_token_model.py
@@ -15,6 +15,7 @@ import uuid
 
 from oslo_config import cfg
 from oslo_utils import timeutils
+from six.moves import range
 
 from keystone import exception
 from keystone.models import token_model
diff --git a/keystone/token/providers/fernet/token_formatters.py b/keystone/token/providers/fernet/token_formatters.py
index 50960923a2..169155e990 100644
--- a/keystone/token/providers/fernet/token_formatters.py
+++ b/keystone/token/providers/fernet/token_formatters.py
@@ -21,7 +21,7 @@ from oslo_config import cfg
 from oslo_log import log
 from oslo_utils import timeutils
 import six
-from six.moves import urllib
+from six.moves import map, urllib
 
 from keystone.auth import plugins as auth_plugins
 from keystone import exception
@@ -508,12 +508,13 @@ class FederatedPayload(BasePayload):
 
         b_user_id = cls.attempt_convert_uuid_hex_to_bytes(user_id)
         methods = auth_plugins.convert_method_list_to_integer(methods)
-        b_group_ids = map(pack_group_ids, federated_info['group_ids'])
+        b_group_ids = list(map(pack_group_ids, federated_info['group_ids']))
         b_idp_id = cls.attempt_convert_uuid_hex_to_bytes(
             federated_info['idp_id'])
         protocol_id = federated_info['protocol_id']
         expires_at_int = cls._convert_time_string_to_int(expires_at)
-        b_audit_ids = map(provider.random_urlsafe_str_to_bytes, audit_ids)
+        b_audit_ids = list(map(provider.random_urlsafe_str_to_bytes,
+                               audit_ids))
 
         return (b_user_id, methods, b_group_ids, b_idp_id, protocol_id,
                 expires_at_int, b_audit_ids)
@@ -535,11 +536,11 @@ class FederatedPayload(BasePayload):
 
         user_id = cls.attempt_convert_uuid_bytes_to_hex(payload[0])
         methods = auth_plugins.convert_integer_to_method_list(payload[1])
-        group_ids = map(unpack_group_ids, payload[2])
+        group_ids = list(map(unpack_group_ids, payload[2]))
         idp_id = cls.attempt_convert_uuid_bytes_to_hex(payload[3])
         protocol_id = payload[4]
         expires_at_str = cls._convert_int_to_time_string(payload[5])
-        audit_ids = map(provider.base64_encode, payload[6])
+        audit_ids = list(map(provider.base64_encode, payload[6]))
         federated_info = dict(group_ids=group_ids, idp_id=idp_id,
                               protocol_id=protocol_id)
         return (user_id, methods, expires_at_str, audit_ids, federated_info)
diff --git a/keystone/trust/backends/sql.py b/keystone/trust/backends/sql.py
index d344495d6e..95b18d40fb 100644
--- a/keystone/trust/backends/sql.py
+++ b/keystone/trust/backends/sql.py
@@ -16,6 +16,7 @@ import time
 
 from oslo_log import log
 from oslo_utils import timeutils
+from six.moves import range
 
 from keystone.common import sql
 from keystone import exception
diff --git a/keystone/trust/core.py b/keystone/trust/core.py
index 80e7fb36be..cae96220d6 100644
--- a/keystone/trust/core.py
+++ b/keystone/trust/core.py
@@ -19,6 +19,7 @@ import abc
 from oslo_config import cfg
 from oslo_log import log
 import six
+from six.moves import zip
 
 from keystone.common import dependency
 from keystone.common import manager