diff --git a/keystone/assignment/backends/ldap.py b/keystone/assignment/backends/ldap.py
index 1f986b81b2..ca5bf6801c 100644
--- a/keystone/assignment/backends/ldap.py
+++ b/keystone/assignment/backends/ldap.py
@@ -15,20 +15,20 @@ from __future__ import absolute_import
 
 import ldap as ldap
 import ldap.filter
+from oslo_config import cfg
 from oslo_log import log
 
 from keystone import assignment
 from keystone.assignment.role_backends import ldap as ldap_role
 from keystone.common import ldap as common_ldap
 from keystone.common import models
-from keystone import config
 from keystone import exception
 from keystone.i18n import _
 from keystone.identity.backends import ldap as ldap_identity
 from keystone.openstack.common import versionutils
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 
diff --git a/keystone/assignment/backends/sql.py b/keystone/assignment/backends/sql.py
index a741ee75fc..2de6ca6062 100644
--- a/keystone/assignment/backends/sql.py
+++ b/keystone/assignment/backends/sql.py
@@ -12,6 +12,7 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+from oslo_config import cfg
 from oslo_log import log
 import six
 import sqlalchemy
@@ -19,12 +20,11 @@ from sqlalchemy.sql.expression import false
 
 from keystone import assignment as keystone_assignment
 from keystone.common import sql
-from keystone import config
 from keystone import exception
 from keystone.i18n import _
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 
diff --git a/keystone/assignment/controllers.py b/keystone/assignment/controllers.py
index ad73f98fd2..0457bef122 100644
--- a/keystone/assignment/controllers.py
+++ b/keystone/assignment/controllers.py
@@ -19,6 +19,7 @@ import copy
 import functools
 import uuid
 
+from oslo_config import cfg
 from oslo_log import log
 from six.moves import urllib
 
@@ -26,13 +27,12 @@ from keystone.assignment import schema
 from keystone.common import controller
 from keystone.common import dependency
 from keystone.common import validation
-from keystone import config
 from keystone import exception
 from keystone.i18n import _, _LW
 from keystone.models import token_model
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 
diff --git a/keystone/assignment/core.py b/keystone/assignment/core.py
index 6440bd2888..63f241d8ac 100644
--- a/keystone/assignment/core.py
+++ b/keystone/assignment/core.py
@@ -16,6 +16,7 @@
 
 import abc
 
+from oslo_config import cfg
 from oslo_log import log
 import six
 
@@ -23,7 +24,6 @@ from keystone.common import cache
 from keystone.common import dependency
 from keystone.common import driver_hints
 from keystone.common import manager
-from keystone import config
 from keystone import exception
 from keystone.i18n import _
 from keystone.i18n import _LI
@@ -31,7 +31,7 @@ from keystone import notifications
 from keystone.openstack.common import versionutils
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 SHOULD_CACHE = cache.should_cache_fn('role')
 
@@ -242,28 +242,28 @@ class Manager(manager.Manager):
         """
         self.resource_api.get_project(tenant_id)
         try:
-            self.role_api.get_role(config.CONF.member_role_id)
+            self.role_api.get_role(CONF.member_role_id)
             self.driver.add_role_to_user_and_project(
                 user_id,
                 tenant_id,
-                config.CONF.member_role_id)
+                CONF.member_role_id)
         except exception.RoleNotFound:
             LOG.info(_LI("Creating the default role %s "
                          "because it does not exist."),
-                     config.CONF.member_role_id)
+                     CONF.member_role_id)
             role = {'id': CONF.member_role_id,
                     'name': CONF.member_role_name}
             try:
-                self.role_api.create_role(config.CONF.member_role_id, role)
+                self.role_api.create_role(CONF.member_role_id, role)
             except exception.Conflict:
                 LOG.info(_LI("Creating the default role %s failed because it "
                              "was already created"),
-                         config.CONF.member_role_id)
+                         CONF.member_role_id)
             # now that default role exists, the add should succeed
             self.driver.add_role_to_user_and_project(
                 user_id,
                 tenant_id,
-                config.CONF.member_role_id)
+                CONF.member_role_id)
 
     def add_role_to_user_and_project(self, user_id, tenant_id, role_id):
         self.resource_api.get_project(tenant_id)
diff --git a/keystone/assignment/role_backends/ldap.py b/keystone/assignment/role_backends/ldap.py
index 7310376a74..d5a06a4c86 100644
--- a/keystone/assignment/role_backends/ldap.py
+++ b/keystone/assignment/role_backends/ldap.py
@@ -12,18 +12,18 @@
 
 from __future__ import absolute_import
 
+from oslo_config import cfg
 from oslo_log import log
 
 from keystone import assignment
 from keystone.common import ldap as common_ldap
 from keystone.common import models
-from keystone import config
 from keystone import exception
 from keystone.i18n import _
 from keystone.identity.backends import ldap as ldap_identity
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 
diff --git a/keystone/assignment/routers.py b/keystone/assignment/routers.py
index 4b54fb5397..49549a0b8a 100644
--- a/keystone/assignment/routers.py
+++ b/keystone/assignment/routers.py
@@ -17,13 +17,16 @@
 
 import functools
 
+from oslo_config import cfg
+
 from keystone.assignment import controllers
 from keystone.common import json_home
 from keystone.common import router
 from keystone.common import wsgi
-from keystone import config
 
 
+CONF = cfg.CONF
+
 build_os_inherit_relation = functools.partial(
     json_home.build_v3_extension_resource_relation,
     extension_name='OS-INHERIT', extension_version='1.0')
@@ -162,7 +165,7 @@ class Routers(wsgi.RoutersBase):
                           resource_descriptions=self.v3_resources,
                           is_entity_implemented=False))
 
-        if config.CONF.os_inherit.enabled:
+        if CONF.os_inherit.enabled:
             self._add_resource(
                 mapper, grant_controller,
                 path='/OS-INHERIT/domains/{domain_id}/users/{user_id}/roles/'
diff --git a/keystone/auth/controllers.py b/keystone/auth/controllers.py
index 56ec7d7721..04d2480c58 100644
--- a/keystone/auth/controllers.py
+++ b/keystone/auth/controllers.py
@@ -15,6 +15,7 @@
 import sys
 
 from keystoneclient.common import cms
+from oslo_config import cfg
 from oslo_log import log
 from oslo_serialization import jsonutils
 from oslo_utils import importutils
@@ -33,7 +34,7 @@ from keystone.resource import controllers as resource_controllers
 
 LOG = log.getLogger(__name__)
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 # registry of authentication methods
 AUTH_METHODS = {}
diff --git a/keystone/auth/plugins/external.py b/keystone/auth/plugins/external.py
index 4cd37b5776..2322649f84 100644
--- a/keystone/auth/plugins/external.py
+++ b/keystone/auth/plugins/external.py
@@ -16,17 +16,17 @@
 
 import abc
 
+from oslo_config import cfg
 import six
 
 from keystone import auth
-from keystone.common import config
 from keystone.common import dependency
 from keystone import exception
 from keystone.i18n import _
 from keystone.openstack.common import versionutils
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 @six.add_metaclass(abc.ABCMeta)
diff --git a/keystone/catalog/backends/sql.py b/keystone/catalog/backends/sql.py
index e75dc7c0cf..fb3c3e7f2a 100644
--- a/keystone/catalog/backends/sql.py
+++ b/keystone/catalog/backends/sql.py
@@ -13,6 +13,7 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+from oslo_config import cfg
 import six
 import sqlalchemy
 from sqlalchemy.sql import true
@@ -20,11 +21,10 @@ from sqlalchemy.sql import true
 from keystone import catalog
 from keystone.catalog import core
 from keystone.common import sql
-from keystone import config
 from keystone import exception
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 class Region(sql.ModelBase, sql.DictBase):
diff --git a/keystone/catalog/backends/templated.py b/keystone/catalog/backends/templated.py
index 0a4e482afb..53a9158bf3 100644
--- a/keystone/catalog/backends/templated.py
+++ b/keystone/catalog/backends/templated.py
@@ -14,19 +14,19 @@
 
 import os.path
 
+from oslo_config import cfg
 from oslo_log import log
 import six
 
 from keystone.catalog.backends import kvs
 from keystone.catalog import core
-from keystone import config
 from keystone import exception
 from keystone.i18n import _LC
 
 
 LOG = log.getLogger(__name__)
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 def parse_templates(template_lines):
diff --git a/keystone/catalog/core.py b/keystone/catalog/core.py
index 6d97313842..41a1e65b49 100644
--- a/keystone/catalog/core.py
+++ b/keystone/catalog/core.py
@@ -17,6 +17,7 @@
 
 import abc
 
+from oslo_config import cfg
 from oslo_log import log
 import six
 
@@ -25,14 +26,13 @@ from keystone.common import dependency
 from keystone.common import driver_hints
 from keystone.common import manager
 from keystone.common import utils
-from keystone import config
 from keystone import exception
 from keystone.i18n import _
 from keystone.i18n import _LE
 from keystone import notifications
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 SHOULD_CACHE = cache.should_cache_fn('catalog')
 
diff --git a/keystone/cli.py b/keystone/cli.py
index 981a5ef3d6..07da4200d5 100644
--- a/keystone/cli.py
+++ b/keystone/cli.py
@@ -31,7 +31,7 @@ from keystone import identity
 from keystone import token
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 
diff --git a/keystone/common/cache/core.py b/keystone/common/cache/core.py
index 0ea78567d3..df42401039 100644
--- a/keystone/common/cache/core.py
+++ b/keystone/common/cache/core.py
@@ -17,15 +17,15 @@
 import dogpile.cache
 from dogpile.cache import proxy
 from dogpile.cache import util
+from oslo_config import cfg
 from oslo_log import log
 from oslo_utils import importutils
 
-from keystone import config
 from keystone import exception
 from keystone.i18n import _, _LE
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 make_region = dogpile.cache.make_region
diff --git a/keystone/common/controller.py b/keystone/common/controller.py
index ca9980d138..d075367217 100644
--- a/keystone/common/controller.py
+++ b/keystone/common/controller.py
@@ -15,6 +15,7 @@
 import functools
 import uuid
 
+from oslo_config import cfg
 from oslo_log import log
 import six
 
@@ -23,14 +24,13 @@ from keystone.common import dependency
 from keystone.common import driver_hints
 from keystone.common import utils
 from keystone.common import wsgi
-from keystone import config
 from keystone import exception
 from keystone.i18n import _, _LW
 from keystone.models import token_model
 
 
 LOG = log.getLogger(__name__)
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 def v2_deprecated(f):
diff --git a/keystone/common/kvs/backends/memcached.py b/keystone/common/kvs/backends/memcached.py
index e25b0c3644..e8c374b34f 100644
--- a/keystone/common/kvs/backends/memcached.py
+++ b/keystone/common/kvs/backends/memcached.py
@@ -21,16 +21,16 @@ import time
 
 from dogpile.cache import api
 from dogpile.cache.backends import memcached
+from oslo_config import cfg
 from oslo_log import log
 
 from keystone.common.cache.backends import memcache_pool
 from keystone.common import manager
-from keystone import config
 from keystone import exception
 from keystone.i18n import _
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 NO_VALUE = api.NO_VALUE
 
diff --git a/keystone/common/kvs/core.py b/keystone/common/kvs/core.py
index 984070c463..a766ebc6e7 100644
--- a/keystone/common/kvs/core.py
+++ b/keystone/common/kvs/core.py
@@ -22,11 +22,11 @@ from dogpile.cache import proxy
 from dogpile.cache import region
 from dogpile.cache import util as dogpile_util
 from dogpile.core import nameregistry
+from oslo_config import cfg
 from oslo_log import log
 from oslo_utils import importutils
 import six
 
-from keystone.common import config
 from keystone import exception
 from keystone.i18n import _
 from keystone.i18n import _LI
@@ -38,7 +38,7 @@ __all__ = ['KeyValueStore', 'KeyValueStoreLock', 'LockTimeout',
 
 
 BACKENDS_REGISTERED = False
-CONF = config.CONF
+CONF = cfg.CONF
 KEY_VALUE_STORE_REGISTRY = weakref.WeakValueDictionary()
 LOCK_WINDOW = 1
 LOG = log.getLogger(__name__)
diff --git a/keystone/common/openssl.py b/keystone/common/openssl.py
index b063c3efcb..840b1ac47c 100644
--- a/keystone/common/openssl.py
+++ b/keystone/common/openssl.py
@@ -15,15 +15,15 @@
 
 import os
 
+from oslo_config import cfg
 from oslo_log import log
 
 from keystone.common import environment
 from keystone.common import utils
-from keystone import config
 from keystone.i18n import _LI, _LE
 
 LOG = log.getLogger(__name__)
-CONF = config.CONF
+CONF = cfg.CONF
 
 PUBLIC_DIR_PERMS = 0o755        # -rwxr-xr-x
 PRIVATE_DIR_PERMS = 0o750       # -rwxr-x---
diff --git a/keystone/common/sql/migrate_repo/versions/034_havana.py b/keystone/common/sql/migrate_repo/versions/034_havana.py
index 06a2fc9383..b49e59988c 100644
--- a/keystone/common/sql/migrate_repo/versions/034_havana.py
+++ b/keystone/common/sql/migrate_repo/versions/034_havana.py
@@ -11,17 +11,17 @@
 #    under the License.
 
 import migrate
+from oslo_config import cfg
 from oslo_log import log
 import sqlalchemy as sql
 from sqlalchemy import orm
 
 from keystone.common import sql as ks_sql
 from keystone.common.sql import migration_helpers
-from keystone import config
 
 
 LOG = log.getLogger(__name__)
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 def upgrade(migrate_engine):
diff --git a/keystone/common/sql/migration_helpers.py b/keystone/common/sql/migration_helpers.py
index 933c5f95b4..77f9367e97 100644
--- a/keystone/common/sql/migration_helpers.py
+++ b/keystone/common/sql/migration_helpers.py
@@ -19,6 +19,7 @@ import sys
 
 import migrate
 from migrate import exceptions
+from oslo_config import cfg
 from oslo_db.sqlalchemy import migration
 from oslo_serialization import jsonutils
 from oslo_utils import importutils
@@ -27,13 +28,12 @@ import sqlalchemy
 
 from keystone.common import sql
 from keystone.common.sql import migrate_repo
-from keystone import config
 from keystone import contrib
 from keystone import exception
 from keystone.i18n import _
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 DEFAULT_EXTENSIONS = ['revoke', 'federation']
 
 
diff --git a/keystone/common/utils.py b/keystone/common/utils.py
index 1bd04f98b4..a4b03ffd0d 100644
--- a/keystone/common/utils.py
+++ b/keystone/common/utils.py
@@ -23,6 +23,7 @@ import hashlib
 import os
 import pwd
 
+from oslo_config import cfg
 from oslo_log import log
 from oslo_serialization import jsonutils
 from oslo_utils import strutils
@@ -30,12 +31,11 @@ import passlib.hash
 import six
 from six import moves
 
-from keystone.common import config
 from keystone import exception
 from keystone.i18n import _, _LE, _LW
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 LOG = log.getLogger(__name__)
 
diff --git a/keystone/common/wsgi.py b/keystone/common/wsgi.py
index 4ae37aa425..aac9bc1f88 100644
--- a/keystone/common/wsgi.py
+++ b/keystone/common/wsgi.py
@@ -21,6 +21,7 @@
 import copy
 import urllib
 
+from oslo_config import cfg
 import oslo_i18n
 from oslo_log import log
 from oslo_serialization import jsonutils
@@ -31,7 +32,6 @@ import six
 import webob.dec
 import webob.exc
 
-from keystone.common import config
 from keystone.common import dependency
 from keystone.common import utils
 from keystone import exception
@@ -41,7 +41,7 @@ from keystone.i18n import _LW
 from keystone.models import token_model
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 # Environment variable used to pass the request context
diff --git a/keystone/config.py b/keystone/config.py
index 8979fe18e9..3d9a29fde6 100644
--- a/keystone/config.py
+++ b/keystone/config.py
@@ -16,13 +16,14 @@
 import logging
 import os
 
+from oslo_config import cfg
 from oslo_log import log
 
 from keystone.common import config
 from keystone import exception
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 setup_authentication = config.setup_authentication
 configure = config.configure
diff --git a/keystone/contrib/endpoint_filter/backends/catalog_sql.py b/keystone/contrib/endpoint_filter/backends/catalog_sql.py
index 7202aadd1d..710267d516 100644
--- a/keystone/contrib/endpoint_filter/backends/catalog_sql.py
+++ b/keystone/contrib/endpoint_filter/backends/catalog_sql.py
@@ -12,15 +12,15 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+from oslo_config import cfg
 import six
 
 from keystone.catalog.backends import sql
 from keystone.catalog import core as catalog_core
 from keystone.common import dependency
-from keystone import config
 from keystone import exception
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 @dependency.requires('endpoint_filter_api')
diff --git a/keystone/contrib/endpoint_filter/core.py b/keystone/contrib/endpoint_filter/core.py
index cffd17375f..972b65dd36 100644
--- a/keystone/contrib/endpoint_filter/core.py
+++ b/keystone/contrib/endpoint_filter/core.py
@@ -14,17 +14,17 @@
 
 import abc
 
+from oslo_config import cfg
 from oslo_log import log
 import six
 
 from keystone.common import dependency
 from keystone.common import extension
 from keystone.common import manager
-from keystone import config
 from keystone import exception
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 extension_data = {
diff --git a/keystone/contrib/endpoint_policy/core.py b/keystone/contrib/endpoint_policy/core.py
index e388b118d2..1aa032674a 100644
--- a/keystone/contrib/endpoint_policy/core.py
+++ b/keystone/contrib/endpoint_policy/core.py
@@ -14,16 +14,16 @@
 
 import abc
 
+from oslo_config import cfg
 from oslo_log import log
 import six
 
 from keystone.common import dependency
 from keystone.common import manager
-from keystone import config
 from keystone import exception
 from keystone.i18n import _, _LE, _LW
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 
diff --git a/keystone/contrib/federation/controllers.py b/keystone/contrib/federation/controllers.py
index 1c485f141d..dd60e76b40 100644
--- a/keystone/contrib/federation/controllers.py
+++ b/keystone/contrib/federation/controllers.py
@@ -12,13 +12,14 @@
 
 """Extensions supporting Federation."""
 
+from oslo_config import cfg
+
 from keystone.auth import controllers as auth_controllers
 from keystone.common import authorization
 from keystone.common import controller
 from keystone.common import dependency
 from keystone.common import validation
 from keystone.common import wsgi
-from keystone import config
 from keystone.contrib.federation import idp as keystone_idp
 from keystone.contrib.federation import schema
 from keystone.contrib.federation import utils
@@ -27,7 +28,7 @@ from keystone.i18n import _
 from keystone.models import token_model
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 class _ControllerBase(controller.V3Controller):
diff --git a/keystone/contrib/federation/core.py b/keystone/contrib/federation/core.py
index 0de50cfbcc..f14ca8109d 100644
--- a/keystone/contrib/federation/core.py
+++ b/keystone/contrib/federation/core.py
@@ -14,17 +14,17 @@
 
 import abc
 
+from oslo_config import cfg
 from oslo_log import log as logging
 import six
 
 from keystone.common import dependency
 from keystone.common import extension
 from keystone.common import manager
-from keystone import config
 from keystone import exception
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = logging.getLogger(__name__)
 EXTENSION_DATA = {
     'name': 'OpenStack Federation APIs',
diff --git a/keystone/contrib/federation/idp.py b/keystone/contrib/federation/idp.py
index 54850b4fb2..bf40013525 100644
--- a/keystone/contrib/federation/idp.py
+++ b/keystone/contrib/federation/idp.py
@@ -15,6 +15,7 @@ import os
 import subprocess
 import uuid
 
+from oslo_config import cfg
 from oslo_log import log
 from oslo_utils import timeutils
 import saml2
@@ -24,14 +25,13 @@ from saml2 import samlp
 from saml2 import sigver
 import xmldsig
 
-from keystone.common import config
 from keystone import exception
 from keystone.i18n import _, _LE
 from keystone.openstack.common import fileutils
 
 
 LOG = log.getLogger(__name__)
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 class SAMLGenerator(object):
diff --git a/keystone/contrib/federation/utils.py b/keystone/contrib/federation/utils.py
index 46b57532ba..491641e2e2 100644
--- a/keystone/contrib/federation/utils.py
+++ b/keystone/contrib/federation/utils.py
@@ -15,16 +15,16 @@
 import re
 
 import jsonschema
+from oslo_config import cfg
 from oslo_log import log
 from oslo_utils import timeutils
 import six
 
-from keystone.common import config
 from keystone import exception
 from keystone.i18n import _, _LW
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 
diff --git a/keystone/contrib/oauth1/controllers.py b/keystone/contrib/oauth1/controllers.py
index 2bde8579b3..7cf3a59d01 100644
--- a/keystone/contrib/oauth1/controllers.py
+++ b/keystone/contrib/oauth1/controllers.py
@@ -14,13 +14,13 @@
 
 """Extensions supporting OAuth1."""
 
+from oslo_config import cfg
 from oslo_serialization import jsonutils
 from oslo_utils import timeutils
 
 from keystone.common import controller
 from keystone.common import dependency
 from keystone.common import wsgi
-from keystone import config
 from keystone.contrib.oauth1 import core as oauth1
 from keystone.contrib.oauth1 import validator
 from keystone import exception
@@ -29,7 +29,7 @@ from keystone.models import token_model
 from keystone import notifications
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 @notifications.internal(notifications.INVALIDATE_USER_OAUTH_CONSUMER_TOKENS,
diff --git a/keystone/contrib/oauth1/core.py b/keystone/contrib/oauth1/core.py
index 8d54242f18..5ed062221c 100644
--- a/keystone/contrib/oauth1/core.py
+++ b/keystone/contrib/oauth1/core.py
@@ -22,12 +22,12 @@ import uuid
 
 import oauthlib.common
 from oauthlib import oauth1
+from oslo_config import cfg
 import six
 
 from keystone.common import dependency
 from keystone.common import extension
 from keystone.common import manager
-from keystone import config
 from keystone import exception
 from keystone import notifications
 
@@ -57,7 +57,7 @@ class Token(object):
         self.verifier = verifier
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 def token_generator(*args, **kwargs):
diff --git a/keystone/contrib/revoke/backends/kvs.py b/keystone/contrib/revoke/backends/kvs.py
index 42250b5878..140b239447 100644
--- a/keystone/contrib/revoke/backends/kvs.py
+++ b/keystone/contrib/revoke/backends/kvs.py
@@ -12,16 +12,16 @@
 
 import datetime
 
+from oslo_config import cfg
 from oslo_utils import timeutils
 
 from keystone.common import kvs
-from keystone import config
 from keystone.contrib import revoke
 from keystone import exception
 from keystone.openstack.common import versionutils
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 _EVENT_KEY = 'os-revoke-events'
 _KVS_BACKEND = 'openstack.kvs.Memory'
diff --git a/keystone/contrib/revoke/core.py b/keystone/contrib/revoke/core.py
index 9ca14f42cd..44dcf4569a 100644
--- a/keystone/contrib/revoke/core.py
+++ b/keystone/contrib/revoke/core.py
@@ -13,6 +13,7 @@
 import abc
 import datetime
 
+from oslo_config import cfg
 from oslo_log import log
 from oslo_utils import timeutils
 import six
@@ -21,7 +22,6 @@ from keystone.common import cache
 from keystone.common import dependency
 from keystone.common import extension
 from keystone.common import manager
-from keystone import config
 from keystone.contrib.revoke import model
 from keystone import exception
 from keystone.i18n import _
@@ -29,7 +29,7 @@ from keystone import notifications
 from keystone.openstack.common import versionutils
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 
diff --git a/keystone/credential/core.py b/keystone/credential/core.py
index e29011efbf..d3354ea3ef 100644
--- a/keystone/credential/core.py
+++ b/keystone/credential/core.py
@@ -16,17 +16,17 @@
 
 import abc
 
+from oslo_config import cfg
 from oslo_log import log
 import six
 
 from keystone.common import dependency
 from keystone.common import driver_hints
 from keystone.common import manager
-from keystone import config
 from keystone import exception
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 LOG = log.getLogger(__name__)
 
diff --git a/keystone/exception.py b/keystone/exception.py
index 365ec6bbf0..5d1a7b1373 100644
--- a/keystone/exception.py
+++ b/keystone/exception.py
@@ -12,15 +12,15 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+from oslo_config import cfg
 from oslo_log import log
 from oslo_utils import encodeutils
 import six
 
-from keystone.common import config
 from keystone.i18n import _, _LW
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 # Tests use this to make exception message format errors fatal
diff --git a/keystone/identity/backends/ldap.py b/keystone/identity/backends/ldap.py
index 52451ac3cb..6abc49f11a 100644
--- a/keystone/identity/backends/ldap.py
+++ b/keystone/identity/backends/ldap.py
@@ -16,6 +16,7 @@ import uuid
 
 import ldap
 import ldap.filter
+from oslo_config import cfg
 from oslo_log import log
 import six
 
@@ -23,13 +24,12 @@ from keystone import clean
 from keystone.common import driver_hints
 from keystone.common import ldap as common_ldap
 from keystone.common import models
-from keystone import config
 from keystone import exception
 from keystone.i18n import _
 from keystone import identity
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 
diff --git a/keystone/identity/backends/sql.py b/keystone/identity/backends/sql.py
index 0ea4e2628d..b29121ada4 100644
--- a/keystone/identity/backends/sql.py
+++ b/keystone/identity/backends/sql.py
@@ -12,9 +12,10 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+from oslo_config import cfg
+
 from keystone.common import sql
 from keystone.common import utils
-from keystone import config
 from keystone import exception
 from keystone.i18n import _
 from keystone import identity
@@ -24,7 +25,7 @@ from keystone import identity
 from keystone.resource.backends import sql as resource_sql  # noqa
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 class User(sql.ModelBase, sql.DictBase):
diff --git a/keystone/identity/controllers.py b/keystone/identity/controllers.py
index c4b6583ca3..3b6df46be9 100644
--- a/keystone/identity/controllers.py
+++ b/keystone/identity/controllers.py
@@ -14,16 +14,16 @@
 
 """Workflow Logic the Identity service."""
 
+from oslo_config import cfg
 from oslo_log import log
 
 from keystone.common import controller
 from keystone.common import dependency
-from keystone import config
 from keystone import exception
 from keystone.i18n import _, _LW
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 
@@ -126,7 +126,7 @@ class User(controller.V2Controller):
             if user_ref['tenantId'] != old_user_ref.get('tenantId'):
                 if old_user_ref.get('tenantId'):
                     try:
-                        member_role_id = config.CONF.member_role_id
+                        member_role_id = CONF.member_role_id
                         self.assignment_api.remove_role_from_user_and_project(
                             user_id, old_user_ref['tenantId'], member_role_id)
                     except exception.NotFound:
diff --git a/keystone/identity/core.py b/keystone/identity/core.py
index 7f88a9c304..9054a74581 100644
--- a/keystone/identity/core.py
+++ b/keystone/identity/core.py
@@ -35,7 +35,7 @@ from keystone.identity.mapping_backends import mapping
 from keystone import notifications
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 LOG = log.getLogger(__name__)
 
diff --git a/keystone/identity/generator.py b/keystone/identity/generator.py
index 1c4cdc3441..d25426ce86 100644
--- a/keystone/identity/generator.py
+++ b/keystone/identity/generator.py
@@ -16,14 +16,14 @@
 
 import abc
 
+from oslo_config import cfg
 import six
 
 from keystone.common import dependency
 from keystone.common import manager
-from keystone import config
 from keystone import exception
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 @dependency.provider('id_generator_api')
diff --git a/keystone/middleware/core.py b/keystone/middleware/core.py
index 9cf6838cf7..bf86cd2b97 100644
--- a/keystone/middleware/core.py
+++ b/keystone/middleware/core.py
@@ -12,20 +12,20 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+from oslo_config import cfg
 from oslo_log import log
 from oslo_middleware import sizelimit
 from oslo_serialization import jsonutils
 import six
 
 from keystone.common import authorization
-from keystone.common import config
 from keystone.common import wsgi
 from keystone import exception
 from keystone.i18n import _LW
 from keystone.models import token_model
 from keystone.openstack.common import versionutils
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 
diff --git a/keystone/models/token_model.py b/keystone/models/token_model.py
index a52ca3b30f..3be22b96b3 100644
--- a/keystone/models/token_model.py
+++ b/keystone/models/token_model.py
@@ -13,16 +13,16 @@
 """Unified in-memory token model."""
 
 from keystoneclient.common import cms
+from oslo_config import cfg
 from oslo_utils import timeutils
 import six
 
-from keystone.common import config
 from keystone.contrib import federation
 from keystone import exception
 from keystone.i18n import _
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 # supported token versions
 V2 = 'v2.0'
 V3 = 'v3.0'
diff --git a/keystone/policy/backends/rules.py b/keystone/policy/backends/rules.py
index 4efe077ccb..f3fe8180f5 100644
--- a/keystone/policy/backends/rules.py
+++ b/keystone/policy/backends/rules.py
@@ -17,16 +17,16 @@
 
 import os.path
 
+from oslo_config import cfg
 from oslo_log import log
 
 from keystone.common import utils
-from keystone import config
 from keystone import exception
 from keystone.openstack.common import policy as common_policy
 from keystone import policy
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 
diff --git a/keystone/policy/core.py b/keystone/policy/core.py
index 127bd57a36..833b5ecd9b 100644
--- a/keystone/policy/core.py
+++ b/keystone/policy/core.py
@@ -16,16 +16,16 @@
 
 import abc
 
+from oslo_config import cfg
 import six
 
 from keystone.common import dependency
 from keystone.common import manager
-from keystone import config
 from keystone import exception
 from keystone import notifications
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 @dependency.provider('policy_api')
diff --git a/keystone/resource/backends/ldap.py b/keystone/resource/backends/ldap.py
index 63a49b000d..54797fd080 100644
--- a/keystone/resource/backends/ldap.py
+++ b/keystone/resource/backends/ldap.py
@@ -14,20 +14,20 @@ from __future__ import absolute_import
 
 import uuid
 
+from oslo_config import cfg
 from oslo_log import log
 
 from keystone import clean
 from keystone.common import driver_hints
 from keystone.common import ldap as common_ldap
 from keystone.common import models
-from keystone import config
 from keystone import exception
 from keystone.i18n import _
 from keystone.identity.backends import ldap as ldap_identity
 from keystone import resource
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 
diff --git a/keystone/resource/backends/sql.py b/keystone/resource/backends/sql.py
index df3b2580e5..fb117240c0 100644
--- a/keystone/resource/backends/sql.py
+++ b/keystone/resource/backends/sql.py
@@ -10,17 +10,17 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+from oslo_config import cfg
 from oslo_log import log
 
 from keystone import clean
 from keystone.common import sql
-from keystone import config
 from keystone import exception
 from keystone.i18n import _LE
 from keystone import resource as keystone_resource
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 
diff --git a/keystone/resource/controllers.py b/keystone/resource/controllers.py
index d0ed1823c4..f8b7f60ac9 100644
--- a/keystone/resource/controllers.py
+++ b/keystone/resource/controllers.py
@@ -17,18 +17,18 @@
 
 import uuid
 
+from oslo_config import cfg
 from oslo_log import log
 
 from keystone.common import controller
 from keystone.common import dependency
 from keystone.common import validation
-from keystone import config
 from keystone import exception
 from keystone.i18n import _
 from keystone.resource import schema
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 
diff --git a/keystone/resource/core.py b/keystone/resource/core.py
index a913d27afa..040428ce1f 100644
--- a/keystone/resource/core.py
+++ b/keystone/resource/core.py
@@ -14,6 +14,7 @@
 
 import abc
 
+from oslo_config import cfg
 from oslo_log import log
 import six
 
@@ -22,14 +23,13 @@ from keystone.common import cache
 from keystone.common import dependency
 from keystone.common import driver_hints
 from keystone.common import manager
-from keystone import config
 from keystone.contrib import federation
 from keystone import exception
 from keystone.i18n import _, _LE
 from keystone import notifications
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 SHOULD_CACHE = cache.should_cache_fn('resource')
 
diff --git a/keystone/server/common.py b/keystone/server/common.py
index b0ad43e9c8..1fa3a62130 100644
--- a/keystone/server/common.py
+++ b/keystone/server/common.py
@@ -12,13 +12,15 @@
 #    under the License.
 
 
+from oslo_config import cfg
+
 from keystone import backends
 from keystone.common import dependency
 from keystone.common import sql
 from keystone import config
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 def configure(version=None, config_files=None):
diff --git a/keystone/server/eventlet.py b/keystone/server/eventlet.py
index a91ee6d773..c5ec996afd 100644
--- a/keystone/server/eventlet.py
+++ b/keystone/server/eventlet.py
@@ -18,6 +18,7 @@ import os
 import socket
 
 from oslo_concurrency import processutils
+from oslo_config import cfg
 import oslo_i18n
 import pbr.version
 
@@ -39,7 +40,7 @@ from keystone.server import common
 from keystone import service as keystone_service
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 class ServerWrapper(object):
diff --git a/keystone/server/wsgi.py b/keystone/server/wsgi.py
index 0e22cf0d78..863f13bcee 100644
--- a/keystone/server/wsgi.py
+++ b/keystone/server/wsgi.py
@@ -14,6 +14,7 @@
 
 import logging
 
+from oslo_config import cfg
 import oslo_i18n
 
 
@@ -30,7 +31,7 @@ from keystone.server import common
 from keystone import service as keystone_service
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 def initialize_application(name):
diff --git a/keystone/service.py b/keystone/service.py
index fdac30a816..621afdf832 100644
--- a/keystone/service.py
+++ b/keystone/service.py
@@ -15,6 +15,7 @@
 import functools
 import sys
 
+from oslo_config import cfg
 from oslo_log import log
 from paste import deploy
 import routes
@@ -23,7 +24,6 @@ from keystone import assignment
 from keystone import auth
 from keystone import catalog
 from keystone.common import wsgi
-from keystone import config
 from keystone import controllers
 from keystone import credential
 from keystone import identity
@@ -34,7 +34,7 @@ from keystone import token
 from keystone import trust
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 
diff --git a/keystone/tests/unit/catalog/test_core.py b/keystone/tests/unit/catalog/test_core.py
index dca410a429..99a34280be 100644
--- a/keystone/tests/unit/catalog/test_core.py
+++ b/keystone/tests/unit/catalog/test_core.py
@@ -10,14 +10,14 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+from oslo_config import cfg
 import testtools
 
 from keystone.catalog import core
-from keystone import config
 from keystone import exception
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 class FormatUrlTests(testtools.TestCase):
diff --git a/keystone/tests/unit/common/test_ldap.py b/keystone/tests/unit/common/test_ldap.py
index 0ad96641f8..41568890b5 100644
--- a/keystone/tests/unit/common/test_ldap.py
+++ b/keystone/tests/unit/common/test_ldap.py
@@ -15,6 +15,7 @@ import uuid
 
 import ldap.dn
 import mock
+from oslo_config import cfg
 from testtools import matchers
 
 import os
@@ -23,12 +24,11 @@ import tempfile
 
 from keystone.common import ldap as ks_ldap
 from keystone.common.ldap import core as common_ldap_core
-from keystone import config
 from keystone.tests import unit as tests
 from keystone.tests.unit import default_fixtures
 from keystone.tests.unit import fakeldap
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 class DnCompareTest(tests.BaseTestCase):
diff --git a/keystone/tests/unit/common/test_utils.py b/keystone/tests/unit/common/test_utils.py
index b6c0761c71..5cc4a53651 100644
--- a/keystone/tests/unit/common/test_utils.py
+++ b/keystone/tests/unit/common/test_utils.py
@@ -13,17 +13,17 @@
 import datetime
 import uuid
 
+from oslo_config import cfg
 from oslo_serialization import jsonutils
 
 from keystone.common import utils as common_utils
-from keystone import config
 from keystone import exception
 from keystone import service
 from keystone.tests import unit as tests
 from keystone.tests.unit import utils
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 TZ = utils.TZ
 
diff --git a/keystone/tests/unit/core.py b/keystone/tests/unit/core.py
index a3109207e3..e30f999e88 100644
--- a/keystone/tests/unit/core.py
+++ b/keystone/tests/unit/core.py
@@ -26,6 +26,7 @@ import time
 import warnings
 
 import fixtures
+from oslo_config import cfg
 from oslo_config import fixture as config_fixture
 from oslo_log import log
 import oslotest.base as oslotest
@@ -83,7 +84,7 @@ def _calc_tmpdir():
 
 TMPDIR = _calc_tmpdir()
 
-CONF = config.CONF
+CONF = cfg.CONF
 log.register_options(CONF)
 
 IN_MEM_DB_CONN_STRING = 'sqlite://'
diff --git a/keystone/tests/unit/fakeldap.py b/keystone/tests/unit/fakeldap.py
index fdabcd1170..56d05503ee 100644
--- a/keystone/tests/unit/fakeldap.py
+++ b/keystone/tests/unit/fakeldap.py
@@ -26,12 +26,12 @@ import re
 import shelve
 
 import ldap
+from oslo_config import cfg
 from oslo_log import log
 import six
 from six import moves
 
 from keystone.common.ldap import core
-from keystone import config
 from keystone import exception
 
 
@@ -45,7 +45,7 @@ SCOPE_NAMES = {
 CONTROL_TREEDELETE = '1.2.840.113556.1.4.805'
 
 LOG = log.getLogger(__name__)
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 def _internal_attr(attr_name, value_or_values):
diff --git a/keystone/tests/unit/filtering.py b/keystone/tests/unit/filtering.py
index fc1b337fe2..89a9973b10 100644
--- a/keystone/tests/unit/filtering.py
+++ b/keystone/tests/unit/filtering.py
@@ -14,9 +14,10 @@
 
 import uuid
 
-from keystone import config
+from oslo_config import cfg
 
-CONF = config.CONF
+
+CONF = cfg.CONF
 
 
 class FilterTests(object):
diff --git a/keystone/tests/unit/identity/test_core.py b/keystone/tests/unit/identity/test_core.py
index b77d7b8b5d..200de45d0b 100644
--- a/keystone/tests/unit/identity/test_core.py
+++ b/keystone/tests/unit/identity/test_core.py
@@ -16,14 +16,14 @@ import os
 import uuid
 
 import mock
+from oslo_config import cfg
 
-from keystone import config
 from keystone import exception
 from keystone import identity
 from keystone.tests import unit as tests
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 class TestDomainConfigs(tests.BaseTestCase):
diff --git a/keystone/tests/unit/ksfixtures/appserver.py b/keystone/tests/unit/ksfixtures/appserver.py
index 3d2307eefa..7ac7bb6dea 100644
--- a/keystone/tests/unit/ksfixtures/appserver.py
+++ b/keystone/tests/unit/ksfixtures/appserver.py
@@ -16,13 +16,13 @@
 from __future__ import absolute_import
 
 import fixtures
+from oslo_config import cfg
 from paste import deploy
 
 from keystone.common import environment
-from keystone import config
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 MAIN = 'main'
 ADMIN = 'admin'
diff --git a/keystone/tests/unit/ksfixtures/database.py b/keystone/tests/unit/ksfixtures/database.py
index ff894b971b..1559753906 100644
--- a/keystone/tests/unit/ksfixtures/database.py
+++ b/keystone/tests/unit/ksfixtures/database.py
@@ -16,16 +16,16 @@ import os
 import shutil
 
 import fixtures
+from oslo_config import cfg
 from oslo_db import options as db_options
 from oslo_db.sqlalchemy import migration
 
 from keystone.common import sql
 from keystone.common.sql import migration_helpers
-from keystone import config
 from keystone.tests import unit as tests
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 def run_once(f):
diff --git a/keystone/tests/unit/test_auth.py b/keystone/tests/unit/test_auth.py
index e356d31ee8..8252df900b 100644
--- a/keystone/tests/unit/test_auth.py
+++ b/keystone/tests/unit/test_auth.py
@@ -17,6 +17,7 @@ import datetime
 import uuid
 
 import mock
+from oslo_config import cfg
 from oslo_utils import timeutils
 from testtools import matchers
 
@@ -35,7 +36,7 @@ from keystone.token import provider
 from keystone import trust
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 TIME_FORMAT = '%Y-%m-%dT%H:%M:%S.%fZ'
 DEFAULT_DOMAIN_ID = CONF.identity.default_domain_id
 
diff --git a/keystone/tests/unit/test_backend.py b/keystone/tests/unit/test_backend.py
index ac05be16af..5c0d548633 100644
--- a/keystone/tests/unit/test_backend.py
+++ b/keystone/tests/unit/test_backend.py
@@ -19,13 +19,13 @@ import uuid
 
 from keystoneclient.common import cms
 import mock
+from oslo_config import cfg
 from oslo_utils import timeutils
 import six
 from testtools import matchers
 
 from keystone.catalog import core
 from keystone.common import driver_hints
-from keystone import config
 from keystone import exception
 from keystone.tests import unit as tests
 from keystone.tests.unit import default_fixtures
@@ -34,7 +34,7 @@ from keystone.tests.unit import utils as test_utils
 from keystone.token import provider
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 DEFAULT_DOMAIN_ID = CONF.identity.default_domain_id
 NULL_OBJECT = object()
 
diff --git a/keystone/tests/unit/test_backend_kvs.py b/keystone/tests/unit/test_backend_kvs.py
index 32c04a4c54..c0997ad996 100644
--- a/keystone/tests/unit/test_backend_kvs.py
+++ b/keystone/tests/unit/test_backend_kvs.py
@@ -14,16 +14,16 @@
 import datetime
 import uuid
 
+from oslo_config import cfg
 from oslo_utils import timeutils
 import six
 
-from keystone import config
 from keystone import exception
 from keystone.tests import unit as tests
 from keystone.tests.unit import test_backend
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 class KvsToken(tests.TestCase, test_backend.TokenTests):
diff --git a/keystone/tests/unit/test_backend_ldap.py b/keystone/tests/unit/test_backend_ldap.py
index 00abd089ab..7402c35cf1 100644
--- a/keystone/tests/unit/test_backend_ldap.py
+++ b/keystone/tests/unit/test_backend_ldap.py
@@ -19,13 +19,13 @@ import uuid
 
 import ldap
 import mock
+from oslo_config import cfg
 from testtools import matchers
 
 from keystone.common import cache
 from keystone.common import ldap as common_ldap
 from keystone.common.ldap import core as common_ldap_core
 from keystone.common import sql
-from keystone import config
 from keystone import exception
 from keystone import identity
 from keystone.identity.mapping_backends import mapping as map
@@ -38,7 +38,7 @@ from keystone.tests.unit.ksfixtures import database
 from keystone.tests.unit import test_backend
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 def create_group_container(identity_api):
@@ -2642,7 +2642,7 @@ class MultiLDAPandSQLIdentity(BaseLDAPIdentity, tests.SQLDriverOverrides,
         """
         # Confirm that config has drivers_enabled as True, which we will
         # check has been set to False later in this test
-        self.assertTrue(config.CONF.identity.domain_specific_drivers_enabled)
+        self.assertTrue(CONF.identity.domain_specific_drivers_enabled)
         self.load_backends()
         # Execute any command to trigger the lazy loading of domain configs
         self.identity_api.list_users(
diff --git a/keystone/tests/unit/test_backend_ldap_pool.py b/keystone/tests/unit/test_backend_ldap_pool.py
index 048fc9348f..9506745ddc 100644
--- a/keystone/tests/unit/test_backend_ldap_pool.py
+++ b/keystone/tests/unit/test_backend_ldap_pool.py
@@ -16,16 +16,16 @@
 
 import ldappool
 import mock
+from oslo_config import cfg
 from oslotest import mockpatch
 
 from keystone.common.ldap import core as ldap_core
-from keystone import config
 from keystone.identity.backends import ldap
 from keystone.tests import unit as tests
 from keystone.tests.unit import fakeldap
 from keystone.tests.unit import test_backend_ldap
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 class LdapPoolCommonTestMixin(object):
diff --git a/keystone/tests/unit/test_backend_sql.py b/keystone/tests/unit/test_backend_sql.py
index 6f0a70b4ab..2572e8327c 100644
--- a/keystone/tests/unit/test_backend_sql.py
+++ b/keystone/tests/unit/test_backend_sql.py
@@ -17,6 +17,7 @@ import functools
 import uuid
 
 import mock
+from oslo_config import cfg
 from oslo_db import exception as db_exception
 from oslo_db import options
 import sqlalchemy
@@ -25,7 +26,6 @@ from testtools import matchers
 
 from keystone.common import driver_hints
 from keystone.common import sql
-from keystone import config
 from keystone import exception
 from keystone.identity.backends import sql as identity_sql
 from keystone.openstack.common import versionutils
@@ -36,7 +36,7 @@ from keystone.tests.unit import test_backend
 from keystone.token.persistence.backends import sql as token_sql
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 DEFAULT_DOMAIN_ID = CONF.identity.default_domain_id
 
 
diff --git a/keystone/tests/unit/test_cache.py b/keystone/tests/unit/test_cache.py
index b3223c8152..cb51631633 100644
--- a/keystone/tests/unit/test_cache.py
+++ b/keystone/tests/unit/test_cache.py
@@ -16,14 +16,14 @@ import copy
 
 from dogpile.cache import api
 from dogpile.cache import proxy
+from oslo_config import cfg
 
 from keystone.common import cache
-from keystone import config
 from keystone import exception
 from keystone.tests import unit as tests
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 NO_VALUE = api.NO_VALUE
 
 
@@ -82,7 +82,7 @@ class CacheRegionTest(tests.TestCase):
 
     def _add_test_caching_option(self):
         self.config_fixture.register_opt(
-            config.config.cfg.BoolOpt('caching', default=True), group='cache')
+            cfg.BoolOpt('caching', default=True), group='cache')
 
     def _get_cacheable_function(self):
         SHOULD_CACHE_FN = cache.should_cache_fn('cache')
diff --git a/keystone/tests/unit/test_config.py b/keystone/tests/unit/test_config.py
index 7bb935e86e..e7a46cff68 100644
--- a/keystone/tests/unit/test_config.py
+++ b/keystone/tests/unit/test_config.py
@@ -14,12 +14,14 @@
 
 import uuid
 
+from oslo_config import cfg
+
 from keystone import config
 from keystone import exception
 from keystone.tests import unit as tests
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 class ConfigTestCase(tests.TestCase):
diff --git a/keystone/tests/unit/test_content_types.py b/keystone/tests/unit/test_content_types.py
index 9c4957ff5c..f8867da377 100644
--- a/keystone/tests/unit/test_content_types.py
+++ b/keystone/tests/unit/test_content_types.py
@@ -17,16 +17,16 @@ import time
 import uuid
 
 from keystoneclient.common import cms
+from oslo_config import cfg
 import six
 from testtools import matchers
 
 from keystone.common import extension as keystone_extension
-from keystone import config
 from keystone.contrib import revoke
 from keystone.tests.unit import rest
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 class CoreApiTests(object):
diff --git a/keystone/tests/unit/test_ipv6.py b/keystone/tests/unit/test_ipv6.py
index 750c6680a8..b268422f02 100644
--- a/keystone/tests/unit/test_ipv6.py
+++ b/keystone/tests/unit/test_ipv6.py
@@ -13,13 +13,14 @@
 # See the License for the specific language governing permissions and
 # limitations under the License.
 
+from oslo_config import cfg
+
 from keystone.common import environment
-from keystone import config
 from keystone.tests import unit as tests
 from keystone.tests.unit.ksfixtures import appserver
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 class IPv6TestCase(tests.TestCase):
diff --git a/keystone/tests/unit/test_keystoneclient.py b/keystone/tests/unit/test_keystoneclient.py
index a6fa57214e..7abc5bc443 100644
--- a/keystone/tests/unit/test_keystoneclient.py
+++ b/keystone/tests/unit/test_keystoneclient.py
@@ -18,18 +18,18 @@ import uuid
 from keystoneclient import exceptions as client_exceptions
 from keystoneclient.v2_0 import client as ks_client
 import mock
+from oslo_config import cfg
 from oslo_serialization import jsonutils
 from oslo_utils import timeutils
 import webob
 
-from keystone import config
 from keystone.tests import unit as tests
 from keystone.tests.unit import default_fixtures
 from keystone.tests.unit.ksfixtures import appserver
 from keystone.tests.unit.ksfixtures import database
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 DEFAULT_DOMAIN_ID = CONF.identity.default_domain_id
 
 
diff --git a/keystone/tests/unit/test_ldap_livetest.py b/keystone/tests/unit/test_ldap_livetest.py
index 3a22562e8c..d1ef3af415 100644
--- a/keystone/tests/unit/test_ldap_livetest.py
+++ b/keystone/tests/unit/test_ldap_livetest.py
@@ -17,15 +17,15 @@ import uuid
 
 import ldap
 import ldap.modlist
+from oslo_config import cfg
 
-from keystone import config
 from keystone import exception
 from keystone.identity.backends import ldap as identity_ldap
 from keystone.tests import unit as tests
 from keystone.tests.unit import test_backend_ldap
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 def create_object(dn, attrs):
diff --git a/keystone/tests/unit/test_ldap_pool_livetest.py b/keystone/tests/unit/test_ldap_pool_livetest.py
index ae2bbe6b7b..023f43c6d8 100644
--- a/keystone/tests/unit/test_ldap_pool_livetest.py
+++ b/keystone/tests/unit/test_ldap_pool_livetest.py
@@ -15,9 +15,9 @@
 import uuid
 
 import ldappool
+from oslo_config import cfg
 
 from keystone.common.ldap import core as ldap_core
-from keystone import config
 from keystone.identity.backends import ldap
 from keystone.tests import unit as tests
 from keystone.tests.unit import fakeldap
@@ -25,7 +25,7 @@ from keystone.tests.unit import test_backend_ldap_pool
 from keystone.tests.unit import test_ldap_livetest
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 class LiveLDAPPoolIdentity(test_backend_ldap_pool.LdapPoolCommonTestMixin,
diff --git a/keystone/tests/unit/test_ldap_tls_livetest.py b/keystone/tests/unit/test_ldap_tls_livetest.py
index 01e3ed01f3..aff2b5bff9 100644
--- a/keystone/tests/unit/test_ldap_tls_livetest.py
+++ b/keystone/tests/unit/test_ldap_tls_livetest.py
@@ -15,15 +15,15 @@
 
 import ldap
 import ldap.modlist
+from oslo_config import cfg
 
-from keystone import config
 from keystone import exception
 from keystone import identity
 from keystone.tests import unit as tests
 from keystone.tests.unit import test_ldap_livetest
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 def create_object(dn, attrs):
diff --git a/keystone/tests/unit/test_middleware.py b/keystone/tests/unit/test_middleware.py
index 7aa1077142..3a26dd24d2 100644
--- a/keystone/tests/unit/test_middleware.py
+++ b/keystone/tests/unit/test_middleware.py
@@ -12,14 +12,14 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+from oslo_config import cfg
 import webob
 
-from keystone import config
 from keystone import middleware
 from keystone.tests import unit as tests
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 def make_request(**kwargs):
diff --git a/keystone/tests/unit/test_sql_upgrade.py b/keystone/tests/unit/test_sql_upgrade.py
index 2d32fdb0af..020c9c3192 100644
--- a/keystone/tests/unit/test_sql_upgrade.py
+++ b/keystone/tests/unit/test_sql_upgrade.py
@@ -34,6 +34,7 @@ import json
 import uuid
 
 from migrate.versioning import api as versioning_api
+from oslo_config import cfg
 from oslo_db import exception as db_exception
 from oslo_db.sqlalchemy import migration
 from oslo_db.sqlalchemy import session as db_session
@@ -46,7 +47,6 @@ from keystone.assignment.backends import sql as assignment_sql
 from keystone.common import sql
 from keystone.common.sql import migrate_repo
 from keystone.common.sql import migration_helpers
-from keystone import config
 from keystone.contrib import federation
 from keystone.contrib import revoke
 from keystone import exception
@@ -55,7 +55,7 @@ from keystone.tests.unit import default_fixtures
 from keystone.tests.unit.ksfixtures import database
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 DEFAULT_DOMAIN_ID = CONF.identity.default_domain_id
 
 # NOTE(morganfainberg): This should be updated when each DB migration collapse
diff --git a/keystone/tests/unit/test_ssl.py b/keystone/tests/unit/test_ssl.py
index 3f63c21053..dd213e1ccf 100644
--- a/keystone/tests/unit/test_ssl.py
+++ b/keystone/tests/unit/test_ssl.py
@@ -16,13 +16,14 @@
 import os
 import ssl
 
+from oslo_config import cfg
+
 from keystone.common import environment
-from keystone import config
 from keystone.tests import unit as tests
 from keystone.tests.unit.ksfixtures import appserver
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 CERTDIR = tests.dirs.root('examples', 'pki', 'certs')
 KEYDIR = tests.dirs.root('examples', 'pki', 'private')
diff --git a/keystone/tests/unit/test_token_provider.py b/keystone/tests/unit/test_token_provider.py
index aa4e891554..ca7ae1a377 100644
--- a/keystone/tests/unit/test_token_provider.py
+++ b/keystone/tests/unit/test_token_provider.py
@@ -14,9 +14,9 @@
 
 import datetime
 
+from oslo_config import cfg
 from oslo_utils import timeutils
 
-from keystone import config
 from keystone import exception
 from keystone.tests import unit as tests
 from keystone.tests.unit import default_fixtures
@@ -25,7 +25,7 @@ from keystone import token
 from keystone.token.providers import pki
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 FUTURE_DELTA = datetime.timedelta(seconds=CONF.token.expiration)
 CURRENT_DATE = timeutils.utcnow()
diff --git a/keystone/tests/unit/test_v3.py b/keystone/tests/unit/test_v3.py
index 673ba2311f..15958638d6 100644
--- a/keystone/tests/unit/test_v3.py
+++ b/keystone/tests/unit/test_v3.py
@@ -15,6 +15,7 @@
 import datetime
 import uuid
 
+from oslo_config import cfg
 from oslo_serialization import jsonutils
 from oslo_utils import timeutils
 import six
@@ -23,7 +24,6 @@ from testtools import matchers
 from keystone import auth
 from keystone.common import authorization
 from keystone.common import cache
-from keystone import config
 from keystone import exception
 from keystone import middleware
 from keystone.policy.backends import rules
@@ -31,7 +31,7 @@ from keystone.tests import unit as tests
 from keystone.tests.unit import rest
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 DEFAULT_DOMAIN_ID = 'default'
 
 TIME_FORMAT = '%Y-%m-%dT%H:%M:%S.%fZ'
diff --git a/keystone/tests/unit/test_v3_auth.py b/keystone/tests/unit/test_v3_auth.py
index 65589b7134..210eb7d1cb 100644
--- a/keystone/tests/unit/test_v3_auth.py
+++ b/keystone/tests/unit/test_v3_auth.py
@@ -20,13 +20,13 @@ import uuid
 
 from keystoneclient.common import cms
 import mock
+from oslo_config import cfg
 from oslo_utils import timeutils
 import six
 from testtools import matchers
 from testtools import testcase
 
 from keystone import auth
-from keystone import config
 from keystone.contrib import revoke
 from keystone import exception
 from keystone.policy.backends import rules
@@ -34,7 +34,7 @@ from keystone.tests import unit as tests
 from keystone.tests.unit import test_v3
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 class TestAuthInfo(test_v3.AuthTestMixin, testcase.TestCase):
diff --git a/keystone/tests/unit/test_v3_credential.py b/keystone/tests/unit/test_v3_credential.py
index 26f4796bc1..571054d672 100644
--- a/keystone/tests/unit/test_v3_credential.py
+++ b/keystone/tests/unit/test_v3_credential.py
@@ -17,13 +17,13 @@ import json
 import uuid
 
 from keystoneclient.contrib.ec2 import utils as ec2_utils
+from oslo_config import cfg
 
-from keystone import config
 from keystone import exception
 from keystone.tests.unit import test_v3
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 class CredentialBaseTestCase(test_v3.RestfulTestCase):
diff --git a/keystone/tests/unit/test_v3_federation.py b/keystone/tests/unit/test_v3_federation.py
index 91303a24b6..484698e7fd 100644
--- a/keystone/tests/unit/test_v3_federation.py
+++ b/keystone/tests/unit/test_v3_federation.py
@@ -17,6 +17,7 @@ import uuid
 
 from lxml import etree
 import mock
+from oslo_config import cfg
 from oslo_log import log
 from oslo_serialization import jsonutils
 from oslotest import mockpatch
@@ -26,7 +27,6 @@ from saml2 import sigver
 import xmldsig
 
 from keystone.auth import controllers as auth_controllers
-from keystone import config
 from keystone.contrib.federation import controllers as federation_controllers
 from keystone.contrib.federation import idp as keystone_idp
 from keystone.contrib.federation import utils as mapping_utils
@@ -37,7 +37,7 @@ from keystone.tests.unit import mapping_fixtures
 from keystone.tests.unit import test_v3
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 ROOTDIR = os.path.dirname(os.path.abspath(__file__))
 XMLDIR = os.path.join(ROOTDIR, 'saml2/')
diff --git a/keystone/tests/unit/test_v3_filters.py b/keystone/tests/unit/test_v3_filters.py
index 1f8073b549..b8f20b7c2c 100644
--- a/keystone/tests/unit/test_v3_filters.py
+++ b/keystone/tests/unit/test_v3_filters.py
@@ -15,16 +15,16 @@
 
 import uuid
 
+from oslo_config import cfg
 from oslo_serialization import jsonutils
 
-from keystone import config
 from keystone.policy.backends import rules
 from keystone.tests.unit import filtering
 from keystone.tests.unit.ksfixtures import temporaryfile
 from keystone.tests.unit import test_v3
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 class IdentityTestFilteredCase(filtering.FilterTests,
diff --git a/keystone/tests/unit/test_v3_oauth1.py b/keystone/tests/unit/test_v3_oauth1.py
index 1d3a3f2b7f..772172be3b 100644
--- a/keystone/tests/unit/test_v3_oauth1.py
+++ b/keystone/tests/unit/test_v3_oauth1.py
@@ -15,10 +15,10 @@
 import copy
 import uuid
 
+from oslo_config import cfg
 from oslo_serialization import jsonutils
 from six.moves import urllib
 
-from keystone import config
 from keystone.contrib import oauth1
 from keystone.contrib.oauth1 import controllers
 from keystone.contrib.oauth1 import core
@@ -27,7 +27,7 @@ from keystone.tests.unit.ksfixtures import temporaryfile
 from keystone.tests.unit import test_v3
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 class OAuth1Tests(test_v3.RestfulTestCase):
diff --git a/keystone/tests/unit/test_v3_protection.py b/keystone/tests/unit/test_v3_protection.py
index 38e1dc041c..c4188fa2fc 100644
--- a/keystone/tests/unit/test_v3_protection.py
+++ b/keystone/tests/unit/test_v3_protection.py
@@ -15,9 +15,9 @@
 
 import uuid
 
+from oslo_config import cfg
 from oslo_serialization import jsonutils
 
-from keystone import config
 from keystone import exception
 from keystone.policy.backends import rules
 from keystone.tests import unit as tests
@@ -25,7 +25,7 @@ from keystone.tests.unit.ksfixtures import temporaryfile
 from keystone.tests.unit import test_v3
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 DEFAULT_DOMAIN_ID = CONF.identity.default_domain_id
 
 
diff --git a/keystone/tests/unit/test_versions.py b/keystone/tests/unit/test_versions.py
index 614e0f2107..60609d928c 100644
--- a/keystone/tests/unit/test_versions.py
+++ b/keystone/tests/unit/test_versions.py
@@ -18,16 +18,16 @@ import functools
 import random
 
 import mock
+from oslo_config import cfg
 from oslo_serialization import jsonutils
 from testtools import matchers as tt_matchers
 
 from keystone.common import json_home
-from keystone import config
 from keystone import controllers
 from keystone.tests import unit as tests
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 v2_MEDIA_TYPES = [
     {
diff --git a/keystone/tests/unit/token/test_token_model.py b/keystone/tests/unit/token/test_token_model.py
index 9b2dd8dd11..b24742894c 100644
--- a/keystone/tests/unit/token/test_token_model.py
+++ b/keystone/tests/unit/token/test_token_model.py
@@ -13,16 +13,16 @@
 import copy
 import uuid
 
+from oslo_config import cfg
 from oslo_utils import timeutils
 
-from keystone.common import config
 from keystone import exception
 from keystone.models import token_model
 from keystone.tests.unit import core
 from keystone.tests.unit import test_token_provider
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 class TestKeystoneTokenModel(core.TestCase):
diff --git a/keystone/token/controllers.py b/keystone/token/controllers.py
index ed40642387..7639ee5f31 100644
--- a/keystone/token/controllers.py
+++ b/keystone/token/controllers.py
@@ -16,6 +16,7 @@ import datetime
 import sys
 
 from keystoneclient.common import cms
+from oslo_config import cfg
 from oslo_log import log
 from oslo_serialization import jsonutils
 from oslo_utils import timeutils
@@ -24,14 +25,13 @@ import six
 from keystone.common import controller
 from keystone.common import dependency
 from keystone.common import wsgi
-from keystone import config
 from keystone import exception
 from keystone.i18n import _
 from keystone.models import token_model
 from keystone.token import provider
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 
diff --git a/keystone/token/core.py b/keystone/token/core.py
index 2b3efadc78..29a409580a 100644
--- a/keystone/token/core.py
+++ b/keystone/token/core.py
@@ -14,9 +14,9 @@
 
 """Main entry point into the Token service."""
 
+from oslo_config import cfg
 from oslo_log import log
 
-from keystone import config
 from keystone import exception
 from keystone.i18n import _
 from keystone.openstack.common import versionutils
@@ -24,7 +24,7 @@ from keystone.token import persistence
 from keystone.token import provider
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 
diff --git a/keystone/token/persistence/backends/kvs.py b/keystone/token/persistence/backends/kvs.py
index 6bca60d27e..b4807bf1ad 100644
--- a/keystone/token/persistence/backends/kvs.py
+++ b/keystone/token/persistence/backends/kvs.py
@@ -16,19 +16,19 @@
 from __future__ import absolute_import
 import copy
 
+from oslo_config import cfg
 from oslo_log import log
 from oslo_utils import timeutils
 import six
 
 from keystone.common import kvs
-from keystone import config
 from keystone import exception
 from keystone.i18n import _, _LE, _LW
 from keystone import token
 from keystone.token import provider
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 
diff --git a/keystone/token/persistence/backends/memcache.py b/keystone/token/persistence/backends/memcache.py
index 53293c01f9..03f27eaffc 100644
--- a/keystone/token/persistence/backends/memcache.py
+++ b/keystone/token/persistence/backends/memcache.py
@@ -13,11 +13,12 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-from keystone.common import config
+from oslo_config import cfg
+
 from keystone.token.persistence.backends import kvs
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 class Token(kvs.Token):
diff --git a/keystone/token/persistence/backends/memcache_pool.py b/keystone/token/persistence/backends/memcache_pool.py
index 3b1bdb4249..55f9e8aec0 100644
--- a/keystone/token/persistence/backends/memcache_pool.py
+++ b/keystone/token/persistence/backends/memcache_pool.py
@@ -10,11 +10,12 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
-from keystone.common import config
+from oslo_config import cfg
+
 from keystone.token.persistence.backends import memcache
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 class Token(memcache.Token):
diff --git a/keystone/token/persistence/backends/sql.py b/keystone/token/persistence/backends/sql.py
index 0902287ecc..80c9a52ef0 100644
--- a/keystone/token/persistence/backends/sql.py
+++ b/keystone/token/persistence/backends/sql.py
@@ -15,18 +15,18 @@
 import copy
 import functools
 
+from oslo_config import cfg
 from oslo_log import log
 from oslo_utils import timeutils
 
 from keystone.common import sql
-from keystone import config
 from keystone import exception
 from keystone.i18n import _LI
 from keystone import token
 from keystone.token import provider
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 
 
diff --git a/keystone/token/persistence/core.py b/keystone/token/persistence/core.py
index 38ac5870f4..5ab0fba489 100644
--- a/keystone/token/persistence/core.py
+++ b/keystone/token/persistence/core.py
@@ -17,6 +17,7 @@
 import abc
 import copy
 
+from oslo_config import cfg
 from oslo_log import log
 from oslo_utils import timeutils
 import six
@@ -24,13 +25,12 @@ import six
 from keystone.common import cache
 from keystone.common import dependency
 from keystone.common import manager
-from keystone import config
 from keystone import exception
 from keystone.i18n import _LW
 from keystone.openstack.common import versionutils
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 SHOULD_CACHE = cache.should_cache_fn('token')
 
diff --git a/keystone/token/provider.py b/keystone/token/provider.py
index 24a69dd32f..b820e32593 100644
--- a/keystone/token/provider.py
+++ b/keystone/token/provider.py
@@ -21,6 +21,7 @@ import sys
 import uuid
 
 from keystoneclient.common import cms
+from oslo_config import cfg
 from oslo_log import log
 from oslo_utils import timeutils
 import six
@@ -28,7 +29,6 @@ import six
 from keystone.common import cache
 from keystone.common import dependency
 from keystone.common import manager
-from keystone import config
 from keystone import exception
 from keystone.i18n import _, _LE, _LW
 from keystone.models import token_model
@@ -37,7 +37,7 @@ from keystone.openstack.common import versionutils
 from keystone.token import persistence
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 LOG = log.getLogger(__name__)
 SHOULD_CACHE = cache.should_cache_fn('token')
 
diff --git a/keystone/token/providers/common.py b/keystone/token/providers/common.py
index c847d0d09a..9e135d181c 100644
--- a/keystone/token/providers/common.py
+++ b/keystone/token/providers/common.py
@@ -12,6 +12,7 @@
 # License for the specific language governing permissions and limitations
 # under the License.
 
+from oslo_config import cfg
 from oslo_log import log
 from oslo_serialization import jsonutils
 from oslo_utils import timeutils
@@ -19,7 +20,6 @@ import six
 from six.moves.urllib import parse
 
 from keystone.common import dependency
-from keystone import config
 from keystone.contrib import federation
 from keystone import exception
 from keystone.i18n import _, _LE
@@ -28,7 +28,7 @@ from keystone.token import provider
 
 
 LOG = log.getLogger(__name__)
-CONF = config.CONF
+CONF = cfg.CONF
 
 
 class V2TokenDataHelper(object):
diff --git a/keystone/token/providers/pki.py b/keystone/token/providers/pki.py
index d267e6e2f5..054f7cac51 100644
--- a/keystone/token/providers/pki.py
+++ b/keystone/token/providers/pki.py
@@ -15,18 +15,18 @@
 """Keystone PKI Token Provider"""
 
 from keystoneclient.common import cms
+from oslo_config import cfg
 from oslo_log import log
 from oslo_serialization import jsonutils
 
 from keystone.common import environment
 from keystone.common import utils
-from keystone import config
 from keystone import exception
 from keystone.i18n import _, _LE
 from keystone.token.providers import common
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 LOG = log.getLogger(__name__)
 
diff --git a/keystone/token/providers/pkiz.py b/keystone/token/providers/pkiz.py
index 2ab8405099..147bc89bb6 100644
--- a/keystone/token/providers/pkiz.py
+++ b/keystone/token/providers/pkiz.py
@@ -13,18 +13,18 @@
 """Keystone Compressed PKI Token Provider"""
 
 from keystoneclient.common import cms
+from oslo_config import cfg
 from oslo_log import log
 from oslo_serialization import jsonutils
 
 from keystone.common import environment
 from keystone.common import utils
-from keystone import config
 from keystone import exception
 from keystone.i18n import _
 from keystone.token.providers import common
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 LOG = log.getLogger(__name__)
 ERROR_MESSAGE = _('Unable to sign token.')
diff --git a/keystone/trust/controllers.py b/keystone/trust/controllers.py
index 86fdf9d0fe..e9160e6e81 100644
--- a/keystone/trust/controllers.py
+++ b/keystone/trust/controllers.py
@@ -14,6 +14,7 @@
 
 import uuid
 
+from oslo_config import cfg
 from oslo_log import log
 from oslo_utils import timeutils
 import six
@@ -22,14 +23,13 @@ from keystone import assignment
 from keystone.common import controller
 from keystone.common import dependency
 from keystone.common import validation
-from keystone import config
 from keystone import exception
 from keystone.i18n import _
 from keystone.models import token_model
 from keystone.trust import schema
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 LOG = log.getLogger(__name__)
 
diff --git a/keystone/trust/core.py b/keystone/trust/core.py
index 77e2914690..77ab757059 100644
--- a/keystone/trust/core.py
+++ b/keystone/trust/core.py
@@ -16,18 +16,18 @@
 
 import abc
 
+from oslo_config import cfg
 from oslo_log import log
 import six
 
 from keystone.common import dependency
 from keystone.common import manager
-from keystone import config
 from keystone import exception
 from keystone.i18n import _
 from keystone import notifications
 
 
-CONF = config.CONF
+CONF = cfg.CONF
 
 LOG = log.getLogger(__name__)