From 8383838afffeedcde8cd0dc486e32d2f5bb26f8e Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@gmail.com>
Date: Thu, 21 Jul 2011 22:46:36 +0000
Subject: [PATCH 01/17] change context to maintain exact time, store roles, use
 ids instead of objects and use a uuid for request_id

---
 nova/context.py | 88 +++++++++++++++----------------------------------
 nova/utils.py   | 23 +++++++++----
 2 files changed, 43 insertions(+), 68 deletions(-)

diff --git a/nova/context.py b/nova/context.py
index 99085ed7548e..e7c60142cebb 100644
--- a/nova/context.py
+++ b/nova/context.py
@@ -18,9 +18,8 @@
 
 """RequestContext: context for requests that persist through all of nova."""
 
-import random
+import uuid
 
-from nova import exception
 from nova import utils
 
 
@@ -31,86 +30,53 @@ class RequestContext(object):
 
     """
 
-    def __init__(self, user, project, is_admin=None, read_deleted=False,
-                 remote_address=None, timestamp=None, request_id=None):
-        if hasattr(user, 'id'):
-            self._user = user
-            self.user_id = user.id
-        else:
-            self._user = None
-            self.user_id = user
-        if hasattr(project, 'id'):
-            self._project = project
-            self.project_id = project.id
-        else:
-            self._project = None
-            self.project_id = project
-        if is_admin is None:
-            if self.user_id and self.user:
-                self.is_admin = self.user.is_admin()
+    def __init__(self, user_id, project_id, is_admin=None, read_deleted=False,
+                 roles=None, remote_address=None, timestamp=None, request_id=None):
+        self.user_id = user_id
+        self.project_id = project_id
+        self.roles = roles or []
+        self.is_admin = is_admin
+        if self.is_admin is None:
+            if 'admin' in self.roles:
+                self.is_admin = True
             else:
                 self.is_admin = False
-        else:
-            self.is_admin = is_admin
         self.read_deleted = read_deleted
         self.remote_address = remote_address
         if not timestamp:
             timestamp = utils.utcnow()
-        if isinstance(timestamp, str) or isinstance(timestamp, unicode):
-            timestamp = utils.parse_isotime(timestamp)
+        if isinstance(timestamp, basestring):
+            timestamp = utils.parse_strtime(timestamp)
         self.timestamp = timestamp
         if not request_id:
-            chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-'
-            request_id = ''.join([random.choice(chars) for x in xrange(20)])
+            request_id = unicode(uuid.uuid4())
         self.request_id = request_id
 
-    @property
-    def user(self):
-        # NOTE(vish): Delay import of manager, so that we can import this
-        #             file from manager.
-        from nova.auth import manager
-        if not self._user:
-            try:
-                self._user = manager.AuthManager().get_user(self.user_id)
-            except exception.NotFound:
-                pass
-        return self._user
-
-    @property
-    def project(self):
-        # NOTE(vish): Delay import of manager, so that we can import this
-        #             file from manager.
-        from nova.auth import manager
-        if not self._project:
-            try:
-                auth_manager = manager.AuthManager()
-                self._project = auth_manager.get_project(self.project_id)
-            except exception.NotFound:
-                pass
-        return self._project
-
     def to_dict(self):
-        return {'user': self.user_id,
-                'project': self.project_id,
+        return {'user_id': self.user_id,
+                'project_id': self.project_id,
                 'is_admin': self.is_admin,
                 'read_deleted': self.read_deleted,
+                'roles': self.roles,
                 'remote_address': self.remote_address,
-                'timestamp': utils.isotime(self.timestamp),
+                'timestamp': utils.strtime(self.timestamp),
                 'request_id': self.request_id}
 
     @classmethod
     def from_dict(cls, values):
         return cls(**values)
 
-    def elevated(self, read_deleted=False):
+    def elevated(self, read_deleted=None):
         """Return a version of this context with admin flag set."""
-        return RequestContext(self.user_id,
-                              self.project_id,
-                              True,
-                              read_deleted,
-                              self.remote_address,
-                              self.timestamp,
-                              self.request_id)
+        rd = self.read_deleted if read_deleted is None else read_deleted
+        return RequestContext(user_id=self.user_id,
+                              project_id=self.project_id,
+                              is_admin=True,
+                              read_deleted=rd,
+                              roles=self.roles,
+                              remote_address=self.remote_address,
+                              timestamp=self.timestamp,
+                              request_id=self.request_id)
 
 
 def get_admin_context(read_deleted=False):
diff --git a/nova/utils.py b/nova/utils.py
index 8784a227dd8e..737903f813dc 100644
--- a/nova/utils.py
+++ b/nova/utils.py
@@ -19,7 +19,6 @@
 
 """Utilities and helper functions."""
 
-import base64
 import datetime
 import functools
 import inspect
@@ -30,7 +29,6 @@ import os
 import random
 import re
 import socket
-import string
 import struct
 import sys
 import time
@@ -50,7 +48,8 @@ from nova import version
 
 
 LOG = logging.getLogger("nova.utils")
-TIME_FORMAT = "%Y-%m-%dT%H:%M:%SZ"
+ISO_TIME_FORMAT = "%Y-%m-%dT%H:%M:%SZ"
+PERFECT_TIME_FORMAT = "%Y-%m-%dT%H:%M:%S.%f"
 FLAGS = flags.FLAGS
 
 
@@ -361,16 +360,26 @@ def clear_time_override():
     utcnow.override_time = None
 
 
-def isotime(at=None):
-    """Returns iso formatted utcnow."""
+def strtime(at=None, fmt=PERFECT_TIME_FORMAT):
+    """Returns formatted utcnow."""
     if not at:
         at = utcnow()
-    return at.strftime(TIME_FORMAT)
+    return at.strftime(fmt)
+
+
+def parse_strtime(timestr, fmt=PERFECT_TIME_FORMAT):
+    """Turn a formatted time back into a datetime."""
+    return datetime.datetime.strptime(timestr, fmt)
+
+
+def isotime(at=None):
+    """Returns iso formatted utcnow."""
+    return strtime(at, ISO_TIME_FORMAT)
 
 
 def parse_isotime(timestr):
     """Turn an iso formatted time back into a datetime."""
-    return datetime.datetime.strptime(timestr, TIME_FORMAT)
+    return parse_strtime(timestr, ISO_TIME_FORMAT)
 
 
 def parse_mailmap(mailmap='.mailmap'):

From 5f75097eb46fa03814fe53c5d9fda84f0000fdd4 Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@gmail.com>
Date: Thu, 21 Jul 2011 22:46:57 +0000
Subject: [PATCH 02/17] start removing references to AuthManager

---
 nova/api/direct.py                     |  3 +-
 nova/api/ec2/__init__.py               | 10 +++--
 nova/api/openstack/auth.py             | 26 +++--------
 nova/cloudpipe/pipelib.py              | 18 ++++----
 nova/compute/api.py                    |  2 +-
 nova/db/sqlalchemy/api.py              |  4 +-
 nova/image/s3.py                       |  6 +--
 nova/log.py                            |  4 +-
 nova/tests/api/openstack/test_auth.py  |  1 -
 nova/tests/hyperv_unittest.py          |  2 +-
 nova/tests/scheduler/test_scheduler.py | 17 ++------
 nova/tests/test_access.py              |  2 +-
 nova/tests/test_adminapi.py            |  4 +-
 nova/tests/test_cloud.py               | 12 +++---
 nova/tests/test_libvirt.py             |  9 ++--
 nova/tests/test_quota.py               | 60 ++++++++++++--------------
 16 files changed, 77 insertions(+), 103 deletions(-)

diff --git a/nova/api/direct.py b/nova/api/direct.py
index ec79151b1079..993815fc708d 100644
--- a/nova/api/direct.py
+++ b/nova/api/direct.py
@@ -107,7 +107,8 @@ class DelegatedAuthMiddleware(wsgi.Middleware):
     def process_request(self, request):
         os_user = request.headers['X-OpenStack-User']
         os_project = request.headers['X-OpenStack-Project']
-        context_ref = context.RequestContext(user=os_user, project=os_project)
+        context_ref = context.RequestContext(user_id=os_user,
+                                             project_id=os_project)
         request.environ['openstack.context'] = context_ref
 
 
diff --git a/nova/api/ec2/__init__.py b/nova/api/ec2/__init__.py
index cf17342810b3..8bb2ea94437a 100644
--- a/nova/api/ec2/__init__.py
+++ b/nova/api/ec2/__init__.py
@@ -174,8 +174,8 @@ class Authenticate(wsgi.Middleware):
         remote_address = req.remote_addr
         if FLAGS.use_forwarded_for:
             remote_address = req.headers.get('X-Forwarded-For', remote_address)
-        ctxt = context.RequestContext(user=user,
-                                      project=project,
+        ctxt = context.RequestContext(user_id=user.id,
+                                      project_id=project.id,
                                       remote_address=remote_address)
         req.environ['ec2.context'] = ctxt
         uname = user.name
@@ -295,13 +295,15 @@ class Authorizer(wsgi.Middleware):
 
     def _matches_any_role(self, context, roles):
         """Return True if any role in roles is allowed in context."""
-        if context.user.is_superuser():
+        authman = manager.AuthManager()
+        user = authman.get_user(context.user_id)
+        if user.is_superuser():
             return True
         if 'all' in roles:
             return True
         if 'none' in roles:
             return False
-        return any(context.project.has_role(context.user_id, role)
+        return any(authman.has_role(context.user_id, role, context.project_id)
                    for role in roles)
 
 
diff --git a/nova/api/openstack/auth.py b/nova/api/openstack/auth.py
index 7c3e683d671a..5b387c08103d 100644
--- a/nova/api/openstack/auth.py
+++ b/nova/api/openstack/auth.py
@@ -48,31 +48,19 @@ class AuthMiddleware(wsgi.Middleware):
     def __call__(self, req):
         if not self.has_authentication(req):
             return self.authenticate(req)
-        user = self.get_user_by_authentication(req)
-        if not user:
+        user_id = self.get_user_by_authentication(req)
+        if not user_id:
             token = req.headers["X-Auth-Token"]
-            msg = _("%(user)s could not be found with token '%(token)s'")
+            msg = _("%(user_id)s could not be found with token '%(token)s'")
             LOG.warn(msg % locals())
             return faults.Fault(webob.exc.HTTPUnauthorized())
 
         try:
-            account = req.headers["X-Auth-Project-Id"]
+            project_id = req.headers["X-Auth-Project-Id"]
         except KeyError:
-            # FIXME(usrleon): It needed only for compatibility
-            # while osapi clients don't use this header
-            accounts = self.auth.get_projects(user=user)
-            if accounts:
-                account = accounts[0]
-            else:
-                return faults.Fault(webob.exc.HTTPUnauthorized())
+            project_id = user_id
 
-        if not self.auth.is_admin(user) and \
-           not self.auth.is_project_member(user, account):
-            msg = _("%(user)s must be an admin or a member of %(account)s")
-            LOG.warn(msg % locals())
-            return faults.Fault(webob.exc.HTTPUnauthorized())
-
-        req.environ['nova.context'] = context.RequestContext(user, account)
+        req.environ['nova.context'] = context.RequestContext(user_id, project_id)
         return self.application
 
     def has_authentication(self, req):
@@ -133,7 +121,7 @@ class AuthMiddleware(wsgi.Middleware):
             if delta.days >= 2:
                 self.db.auth_token_destroy(ctxt, token['token_hash'])
             else:
-                return self.auth.get_user(token['user_id'])
+                return token['user_id']
         return None
 
     def _authorize_user(self, username, key, req):
diff --git a/nova/cloudpipe/pipelib.py b/nova/cloudpipe/pipelib.py
index 7844d31e11b1..521525205307 100644
--- a/nova/cloudpipe/pipelib.py
+++ b/nova/cloudpipe/pipelib.py
@@ -96,8 +96,8 @@ class CloudPipe(object):
     def launch_vpn_instance(self, project_id):
         LOG.debug(_("Launching VPN for %s") % (project_id))
         project = self.manager.get_project(project_id)
-        ctxt = context.RequestContext(user=project.project_manager,
-                                      project=project)
+        ctxt = context.RequestContext(user=project.project_manager_id,
+                                      project=project.id)
         key_name = self.setup_key_pair(ctxt)
         group_name = self.setup_security_group(ctxt)
 
@@ -112,11 +112,11 @@ class CloudPipe(object):
             security_group=[group_name])
 
     def setup_security_group(self, context):
-        group_name = '%s%s' % (context.project.id, FLAGS.vpn_key_suffix)
-        if db.security_group_exists(context, context.project.id, group_name):
+        group_name = '%s%s' % (context.project_id, FLAGS.vpn_key_suffix)
+        if db.security_group_exists(context, context.project_id, group_name):
             return group_name
-        group = {'user_id': context.user.id,
-                 'project_id': context.project.id,
+        group = {'user_id': context.user_id,
+                 'project_id': context.project_id,
                  'name': group_name,
                  'description': 'Group for vpn'}
         group_ref = db.security_group_create(context, group)
@@ -137,12 +137,12 @@ class CloudPipe(object):
         return group_name
 
     def setup_key_pair(self, context):
-        key_name = '%s%s' % (context.project.id, FLAGS.vpn_key_suffix)
+        key_name = '%s%s' % (context.project_id, FLAGS.vpn_key_suffix)
         try:
-            result = cloud._gen_key(context, context.user.id, key_name)
+            result = cloud._gen_key(context, context.user_id, key_name)
             private_key = result['private_key']
             try:
-                key_dir = os.path.join(FLAGS.keys_path, context.user.id)
+                key_dir = os.path.join(FLAGS.keys_path, context.user_id)
                 if not os.path.exists(key_dir):
                     os.makedirs(key_dir)
                 key_path = os.path.join(key_dir, '%s.pem' % key_name)
diff --git a/nova/compute/api.py b/nova/compute/api.py
index 67aa3c20f98d..51a903d40136 100644
--- a/nova/compute/api.py
+++ b/nova/compute/api.py
@@ -688,7 +688,7 @@ class API(base.Base):
                     raise
                 instances = None
         elif project_id or not context.is_admin:
-            if not context.project:
+            if not context.project_id:
                 instances = self.db.instance_get_all_by_user(
                     context, context.user_id)
             else:
diff --git a/nova/db/sqlalchemy/api.py b/nova/db/sqlalchemy/api.py
index ba03cabbc1b6..6be3f483e235 100644
--- a/nova/db/sqlalchemy/api.py
+++ b/nova/db/sqlalchemy/api.py
@@ -62,7 +62,7 @@ def is_user_context(context):
 def authorize_project_context(context, project_id):
     """Ensures a request has permission to access the given project."""
     if is_user_context(context):
-        if not context.project:
+        if not context.project_id:
             raise exception.NotAuthorized()
         elif context.project_id != project_id:
             raise exception.NotAuthorized()
@@ -71,7 +71,7 @@ def authorize_project_context(context, project_id):
 def authorize_user_context(context, user_id):
     """Ensures a request has permission to access the given user."""
     if is_user_context(context):
-        if not context.user:
+        if not context.user_id:
             raise exception.NotAuthorized()
         elif context.user_id != user_id:
             raise exception.NotAuthorized()
diff --git a/nova/image/s3.py b/nova/image/s3.py
index 4a3df98baef2..dd5c957a5907 100644
--- a/nova/image/s3.py
+++ b/nova/image/s3.py
@@ -84,9 +84,9 @@ class S3ImageService(service.BaseImageService):
     def _conn(context):
         # TODO(vish): is there a better way to get creds to sign
         #             for the user?
-        access = manager.AuthManager().get_access_key(context.user,
-                                                      context.project)
-        secret = str(context.user.secret)
+        authman = manager.AuthManager()
+        access = authman.get_access_key(context.user_id, context.project_id)
+        secret = str(authman.get_user(context.user_id).secret)
         calling = boto.s3.connection.OrdinaryCallingFormat()
         return boto.s3.connection.S3Connection(aws_access_key_id=access,
                                                aws_secret_access_key=secret,
diff --git a/nova/log.py b/nova/log.py
index f8c0ba68d9ea..b4f6c1d2e6df 100644
--- a/nova/log.py
+++ b/nova/log.py
@@ -43,8 +43,8 @@ from nova import version
 FLAGS = flags.FLAGS
 flags.DEFINE_string('logging_context_format_string',
                     '%(asctime)s %(levelname)s %(name)s '
-                    '[%(request_id)s %(user)s '
-                    '%(project)s] %(message)s',
+                    '[%(request_id)s %(user_id)s '
+                    '%(project_id)s] %(message)s',
                     'format string to use for log messages with context')
 flags.DEFINE_string('logging_default_format_string',
                     '%(asctime)s %(levelname)s %(name)s [-] '
diff --git a/nova/tests/api/openstack/test_auth.py b/nova/tests/api/openstack/test_auth.py
index af3478c7d61e..25fd2e8c5f22 100644
--- a/nova/tests/api/openstack/test_auth.py
+++ b/nova/tests/api/openstack/test_auth.py
@@ -24,7 +24,6 @@ import webob.dec
 import nova.api
 import nova.api.openstack.auth
 import nova.auth.manager
-from nova import auth
 from nova import context
 from nova import db
 from nova import test
diff --git a/nova/tests/hyperv_unittest.py b/nova/tests/hyperv_unittest.py
index 042819b9c3a8..ab2995923e7b 100644
--- a/nova/tests/hyperv_unittest.py
+++ b/nova/tests/hyperv_unittest.py
@@ -38,7 +38,7 @@ class HyperVTestCase(test.TestCase):
         self.user = self.manager.create_user('fake', 'fake', 'fake',
                                              admin=True)
         self.project = self.manager.create_project('fake', 'fake', 'fake')
-        self.context = context.RequestContext(self.user, self.project)
+        self.context = context.RequestContext(self.user.id, self.project.id)
 
     def test_create_destroy(self):
         """Create a VM and destroy it"""
diff --git a/nova/tests/scheduler/test_scheduler.py b/nova/tests/scheduler/test_scheduler.py
index daea826fdb71..ef4ef156cc2d 100644
--- a/nova/tests/scheduler/test_scheduler.py
+++ b/nova/tests/scheduler/test_scheduler.py
@@ -23,7 +23,6 @@ import datetime
 import mox
 import novaclient.exceptions
 import stubout
-import webob
 
 from mox import IgnoreArg
 from nova import context
@@ -34,12 +33,10 @@ from nova import service
 from nova import test
 from nova import rpc
 from nova import utils
-from nova.auth import manager as auth_manager
 from nova.scheduler import api
 from nova.scheduler import manager
 from nova.scheduler import driver
 from nova.compute import power_state
-from nova.db.sqlalchemy import models
 
 
 FLAGS = flags.FLAGS
@@ -250,23 +247,17 @@ class SimpleDriverTestCase(test.TestCase):
                    volume_driver='nova.volume.driver.FakeISCSIDriver',
                    scheduler_driver='nova.scheduler.simple.SimpleScheduler')
         self.scheduler = manager.SchedulerManager()
-        self.manager = auth_manager.AuthManager()
-        self.user = self.manager.create_user('fake', 'fake', 'fake')
-        self.project = self.manager.create_project('fake', 'fake', 'fake')
         self.context = context.get_admin_context()
-
-    def tearDown(self):
-        self.manager.delete_user(self.user)
-        self.manager.delete_project(self.project)
-        super(SimpleDriverTestCase, self).tearDown()
+        self.user_id = 'fake'
+        self.project_id = 'fake'
 
     def _create_instance(self, **kwargs):
         """Create a test instance"""
         inst = {}
         inst['image_id'] = 1
         inst['reservation_id'] = 'r-fakeres'
-        inst['user_id'] = self.user.id
-        inst['project_id'] = self.project.id
+        inst['user_id'] = self.user_id
+        inst['project_id'] = self.project_id
         inst['instance_type_id'] = '1'
         inst['vcpus'] = kwargs.get('vcpus', 1)
         inst['ami_launch_index'] = 0
diff --git a/nova/tests/test_access.py b/nova/tests/test_access.py
index e170ccee62bd..6069c5d71c0e 100644
--- a/nova/tests/test_access.py
+++ b/nova/tests/test_access.py
@@ -93,7 +93,7 @@ class AccessTestCase(test.TestCase):
         super(AccessTestCase, self).tearDown()
 
     def response_status(self, user, methodName):
-        ctxt = context.RequestContext(user, self.project)
+        ctxt = context.RequestContext(user.id, self.project.id)
         environ = self._env_for(ctxt, methodName)
         req = webob.Request.blank('/', environ)
         resp = req.get_response(self.mw)
diff --git a/nova/tests/test_adminapi.py b/nova/tests/test_adminapi.py
index 877cf4ea1bc4..f8abe609dbe8 100644
--- a/nova/tests/test_adminapi.py
+++ b/nova/tests/test_adminapi.py
@@ -54,8 +54,8 @@ class AdminApiTestCase(test.TestCase):
         self.manager = manager.AuthManager()
         self.user = self.manager.create_user('admin', 'admin', 'admin', True)
         self.project = self.manager.create_project('proj', 'admin', 'proj')
-        self.context = context.RequestContext(user=self.user,
-                                              project=self.project)
+        self.context = context.RequestContext(user_id=self.user.id,
+                                              project_id=self.project.id)
 
         def fake_show(meh, context, id):
             return {'id': 1, 'properties': {'kernel_id': 1, 'ramdisk_id': 1,
diff --git a/nova/tests/test_cloud.py b/nova/tests/test_cloud.py
index 8cdc73a666a6..71ac7f4733f5 100644
--- a/nova/tests/test_cloud.py
+++ b/nova/tests/test_cloud.py
@@ -65,8 +65,8 @@ class CloudTestCase(test.TestCase):
         self.manager = manager.AuthManager()
         self.user = self.manager.create_user('admin', 'admin', 'admin', True)
         self.project = self.manager.create_project('proj', 'admin', 'proj')
-        self.context = context.RequestContext(user=self.user,
-                                              project=self.project)
+        self.context = context.RequestContext(user_id=self.user.id,
+                                              project_id=self.project.id)
         host = self.network.host
 
         def fake_show(meh, context, id):
@@ -97,7 +97,7 @@ class CloudTestCase(test.TestCase):
 
     def _create_key(self, name):
         # NOTE(vish): create depends on pool, so just call helper directly
-        return cloud._gen_key(self.context, self.context.user.id, name)
+        return cloud._gen_key(self.context, self.context.user_id, name)
 
     def test_describe_regions(self):
         """Makes sure describe regions runs without raising an exception"""
@@ -936,7 +936,7 @@ class CloudTestCase(test.TestCase):
         key = RSA.load_key_string(private_key, callback=lambda: None)
         bio = BIO.MemoryBuffer()
         public_key = db.key_pair_get(self.context,
-                                    self.context.user.id,
+                                    self.context.user_id,
                                     'test')['public_key']
         key.save_pub_key_bio(bio)
         converted = crypto.ssl_pub_to_ssh_pub(bio.read())
@@ -960,7 +960,7 @@ class CloudTestCase(test.TestCase):
                                                'mytestfprint')
         self.assertTrue(result1)
         keydata = db.key_pair_get(self.context,
-                                  self.context.user.id,
+                                  self.context.user_id,
                                   'testimportkey1')
         self.assertEqual('mytestpubkey', keydata['public_key'])
         self.assertEqual('mytestfprint', keydata['fingerprint'])
@@ -977,7 +977,7 @@ class CloudTestCase(test.TestCase):
                                                dummypub)
         self.assertTrue(result2)
         keydata = db.key_pair_get(self.context,
-                                  self.context.user.id,
+                                  self.context.user_id,
                                   'testimportkey2')
         self.assertEqual(dummypub, keydata['public_key'])
         self.assertEqual(dummyfprint, keydata['fingerprint'])
diff --git a/nova/tests/test_libvirt.py b/nova/tests/test_libvirt.py
index 6e2ec7ed6155..948ca215fdd9 100644
--- a/nova/tests/test_libvirt.py
+++ b/nova/tests/test_libvirt.py
@@ -429,8 +429,8 @@ class LibvirtConnTestCase(test.TestCase):
         self.assertEquals(parameters[1].get('value'), 'fake')
 
     def _check_xml_and_container(self, instance):
-        user_context = context.RequestContext(project=self.project,
-                                              user=self.user)
+        user_context = context.RequestContext(self.user.id,
+                                              self.project.id)
         instance_ref = db.instance_create(user_context, instance)
         # Re-get the instance so it's bound to an actual session
         instance_ref = db.instance_get(user_context, instance_ref['id'])
@@ -475,8 +475,7 @@ class LibvirtConnTestCase(test.TestCase):
 
     def _check_xml_and_uri(self, instance, expect_ramdisk, expect_kernel,
                            rescue=False):
-        user_context = context.RequestContext(project=self.project,
-                                              user=self.user)
+        user_context = context.RequestContext(self.user.id, self.project.id)
         instance_ref = db.instance_create(user_context, instance)
         network_ref = db.project_get_networks(context.get_admin_context(),
                                              self.project.id)[0]
@@ -1166,7 +1165,7 @@ class NWFilterTestCase(test.TestCase):
         self.user = self.manager.create_user('fake', 'fake', 'fake',
                                              admin=True)
         self.project = self.manager.create_project('fake', 'fake', 'fake')
-        self.context = context.RequestContext(self.user, self.project)
+        self.context = context.RequestContext(self.user.id, self.project.id)
 
         self.fake_libvirt_connection = Mock()
 
diff --git a/nova/tests/test_quota.py b/nova/tests/test_quota.py
index 69d2deafe216..fcb99b7c97c1 100644
--- a/nova/tests/test_quota.py
+++ b/nova/tests/test_quota.py
@@ -25,7 +25,6 @@ from nova import quota
 from nova import test
 from nova import utils
 from nova import volume
-from nova.auth import manager
 from nova.compute import instance_types
 
 
@@ -48,25 +47,20 @@ class QuotaTestCase(test.TestCase):
                    quota_gigabytes=20,
                    quota_floating_ips=1)
 
-        self.manager = manager.AuthManager()
-        self.user = self.manager.create_user('admin', 'admin', 'admin', True)
-        self.project = self.manager.create_project('admin', 'admin', 'admin')
         self.network = self.network = self.start_service('network')
-        self.context = context.RequestContext(project=self.project,
-                                              user=self.user)
-
-    def tearDown(self):
-        manager.AuthManager().delete_project(self.project)
-        manager.AuthManager().delete_user(self.user)
-        super(QuotaTestCase, self).tearDown()
+        self.user_id = 'admin'
+        self.project_id = 'admin'
+        self.context = context.RequestContext(self.user_id,
+                                              self.project_id,
+                                              True)
 
     def _create_instance(self, cores=2):
         """Create a test instance"""
         inst = {}
         inst['image_id'] = 1
         inst['reservation_id'] = 'r-fakeres'
-        inst['user_id'] = self.user.id
-        inst['project_id'] = self.project.id
+        inst['user_id'] = self.user_id
+        inst['project_id'] = self.project_id
         inst['instance_type_id'] = '3'  # m1.large
         inst['vcpus'] = cores
         return db.instance_create(self.context, inst)['id']
@@ -74,8 +68,8 @@ class QuotaTestCase(test.TestCase):
     def _create_volume(self, size=10):
         """Create a test volume"""
         vol = {}
-        vol['user_id'] = self.user.id
-        vol['project_id'] = self.project.id
+        vol['user_id'] = self.user_id
+        vol['project_id'] = self.project_id
         vol['size'] = size
         return db.volume_create(self.context, vol)['id']
 
@@ -95,15 +89,15 @@ class QuotaTestCase(test.TestCase):
         num_instances = quota.allowed_instances(self.context, 100,
             self._get_instance_type('m1.small'))
         self.assertEqual(num_instances, 2)
-        db.quota_create(self.context, self.project.id, 'instances', 10)
+        db.quota_create(self.context, self.project_id, 'instances', 10)
         num_instances = quota.allowed_instances(self.context, 100,
             self._get_instance_type('m1.small'))
         self.assertEqual(num_instances, 4)
-        db.quota_create(self.context, self.project.id, 'cores', 100)
+        db.quota_create(self.context, self.project_id, 'cores', 100)
         num_instances = quota.allowed_instances(self.context, 100,
             self._get_instance_type('m1.small'))
         self.assertEqual(num_instances, 10)
-        db.quota_create(self.context, self.project.id, 'ram', 3 * 2048)
+        db.quota_create(self.context, self.project_id, 'ram', 3 * 2048)
         num_instances = quota.allowed_instances(self.context, 100,
             self._get_instance_type('m1.small'))
         self.assertEqual(num_instances, 3)
@@ -113,13 +107,13 @@ class QuotaTestCase(test.TestCase):
         num_metadata_items = quota.allowed_metadata_items(self.context,
                                                           too_many_items)
         self.assertEqual(num_metadata_items, FLAGS.quota_metadata_items)
-        db.quota_create(self.context, self.project.id, 'metadata_items', 5)
+        db.quota_create(self.context, self.project_id, 'metadata_items', 5)
         num_metadata_items = quota.allowed_metadata_items(self.context,
                                                           too_many_items)
         self.assertEqual(num_metadata_items, 5)
 
         # Cleanup
-        db.quota_destroy_all_by_project(self.context, self.project.id)
+        db.quota_destroy_all_by_project(self.context, self.project_id)
 
     def test_unlimited_instances(self):
         FLAGS.quota_instances = 2
@@ -129,7 +123,7 @@ class QuotaTestCase(test.TestCase):
         num_instances = quota.allowed_instances(self.context, 100,
                                                 instance_type)
         self.assertEqual(num_instances, 2)
-        db.quota_create(self.context, self.project.id, 'instances', None)
+        db.quota_create(self.context, self.project_id, 'instances', None)
         num_instances = quota.allowed_instances(self.context, 100,
                                                 instance_type)
         self.assertEqual(num_instances, 100)
@@ -145,7 +139,7 @@ class QuotaTestCase(test.TestCase):
         num_instances = quota.allowed_instances(self.context, 100,
                                                 instance_type)
         self.assertEqual(num_instances, 2)
-        db.quota_create(self.context, self.project.id, 'ram', None)
+        db.quota_create(self.context, self.project_id, 'ram', None)
         num_instances = quota.allowed_instances(self.context, 100,
                                                 instance_type)
         self.assertEqual(num_instances, 100)
@@ -161,7 +155,7 @@ class QuotaTestCase(test.TestCase):
         num_instances = quota.allowed_instances(self.context, 100,
                                                 instance_type)
         self.assertEqual(num_instances, 2)
-        db.quota_create(self.context, self.project.id, 'cores', None)
+        db.quota_create(self.context, self.project_id, 'cores', None)
         num_instances = quota.allowed_instances(self.context, 100,
                                                 instance_type)
         self.assertEqual(num_instances, 100)
@@ -174,7 +168,7 @@ class QuotaTestCase(test.TestCase):
         FLAGS.quota_gigabytes = -1
         volumes = quota.allowed_volumes(self.context, 100, 1)
         self.assertEqual(volumes, 10)
-        db.quota_create(self.context, self.project.id, 'volumes', None)
+        db.quota_create(self.context, self.project_id, 'volumes', None)
         volumes = quota.allowed_volumes(self.context, 100, 1)
         self.assertEqual(volumes, 100)
         volumes = quota.allowed_volumes(self.context, 101, 1)
@@ -185,7 +179,7 @@ class QuotaTestCase(test.TestCase):
         FLAGS.quota_gigabytes = 10
         volumes = quota.allowed_volumes(self.context, 100, 1)
         self.assertEqual(volumes, 10)
-        db.quota_create(self.context, self.project.id, 'gigabytes', None)
+        db.quota_create(self.context, self.project_id, 'gigabytes', None)
         volumes = quota.allowed_volumes(self.context, 100, 1)
         self.assertEqual(volumes, 100)
         volumes = quota.allowed_volumes(self.context, 101, 1)
@@ -195,7 +189,7 @@ class QuotaTestCase(test.TestCase):
         FLAGS.quota_floating_ips = 10
         floating_ips = quota.allowed_floating_ips(self.context, 100)
         self.assertEqual(floating_ips, 10)
-        db.quota_create(self.context, self.project.id, 'floating_ips', None)
+        db.quota_create(self.context, self.project_id, 'floating_ips', None)
         floating_ips = quota.allowed_floating_ips(self.context, 100)
         self.assertEqual(floating_ips, 100)
         floating_ips = quota.allowed_floating_ips(self.context, 101)
@@ -205,7 +199,7 @@ class QuotaTestCase(test.TestCase):
         FLAGS.quota_metadata_items = 10
         items = quota.allowed_metadata_items(self.context, 100)
         self.assertEqual(items, 10)
-        db.quota_create(self.context, self.project.id, 'metadata_items', None)
+        db.quota_create(self.context, self.project_id, 'metadata_items', None)
         items = quota.allowed_metadata_items(self.context, 100)
         self.assertEqual(items, 100)
         items = quota.allowed_metadata_items(self.context, 101)
@@ -274,11 +268,11 @@ class QuotaTestCase(test.TestCase):
         address = '192.168.0.100'
         db.floating_ip_create(context.get_admin_context(),
                               {'address': address, 'host': FLAGS.host,
-                               'project_id': self.project.id})
+                               'project_id': self.project_id})
         self.assertRaises(quota.QuotaError,
                           self.network.allocate_floating_ip,
                           self.context,
-                          self.project.id)
+                          self.project_id)
         db.floating_ip_destroy(context.get_admin_context(), address)
 
     def test_too_many_metadata_items(self):
@@ -300,7 +294,7 @@ class QuotaTestCase(test.TestCase):
 
     def test_overridden_allowed_injected_files(self):
         FLAGS.quota_max_injected_files = 5
-        db.quota_create(self.context, self.project.id, 'injected_files', 77)
+        db.quota_create(self.context, self.project_id, 'injected_files', 77)
         self.assertEqual(quota.allowed_injected_files(self.context, 100), 77)
 
     def test_unlimited_default_allowed_injected_files(self):
@@ -309,7 +303,7 @@ class QuotaTestCase(test.TestCase):
 
     def test_unlimited_db_allowed_injected_files(self):
         FLAGS.quota_max_injected_files = 5
-        db.quota_create(self.context, self.project.id, 'injected_files', None)
+        db.quota_create(self.context, self.project_id, 'injected_files', None)
         self.assertEqual(quota.allowed_injected_files(self.context, 100), 100)
 
     def test_default_allowed_injected_file_content_bytes(self):
@@ -319,7 +313,7 @@ class QuotaTestCase(test.TestCase):
 
     def test_overridden_allowed_injected_file_content_bytes(self):
         FLAGS.quota_max_injected_file_content_bytes = 12345
-        db.quota_create(self.context, self.project.id,
+        db.quota_create(self.context, self.project_id,
                         'injected_file_content_bytes', 5678)
         limit = quota.allowed_injected_file_content_bytes(self.context, 23456)
         self.assertEqual(limit, 5678)
@@ -331,7 +325,7 @@ class QuotaTestCase(test.TestCase):
 
     def test_unlimited_db_allowed_injected_file_content_bytes(self):
         FLAGS.quota_max_injected_file_content_bytes = 12345
-        db.quota_create(self.context, self.project.id,
+        db.quota_create(self.context, self.project_id,
                         'injected_file_content_bytes', None)
         limit = quota.allowed_injected_file_content_bytes(self.context, 23456)
         self.assertEqual(limit, 23456)

From e1cf345fa82c3a9b8088237f1025c41db0f4e829 Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@gmail.com>
Date: Fri, 22 Jul 2011 00:39:53 +0000
Subject: [PATCH 03/17] fix a whole bunch of tests

---
 nova/api/ec2/__init__.py        | 20 +++++---
 nova/tests/hyperv_unittest.py   |  9 ++--
 nova/tests/test_adminapi.py     | 16 ++-----
 nova/tests/test_api.py          | 74 +++-------------------------
 nova/tests/test_cloud.py        | 16 +++----
 nova/tests/test_compute.py      | 37 +++++---------
 nova/tests/test_console.py      | 19 +++-----
 nova/tests/test_libvirt.py      | 66 ++++++-------------------
 nova/tests/test_objectstore.py  | 24 +++-------
 nova/tests/test_vmwareapi.py    | 15 ++----
 nova/tests/test_xenapi.py       | 85 +++++++++++++++++----------------
 nova/virt/hyperv.py             |  6 +--
 nova/virt/images.py             |  2 +-
 nova/virt/libvirt/connection.py | 19 ++++----
 nova/virt/xenapi/vm_utils.py    | 27 ++++++-----
 nova/virt/xenapi/vmops.py       | 17 +++----
 16 files changed, 155 insertions(+), 297 deletions(-)

diff --git a/nova/api/ec2/__init__.py b/nova/api/ec2/__init__.py
index 8bb2ea94437a..edae9433197f 100644
--- a/nova/api/ec2/__init__.py
+++ b/nova/api/ec2/__init__.py
@@ -138,8 +138,19 @@ class Lockout(wsgi.Middleware):
         return res
 
 
-class Authenticate(wsgi.Middleware):
+class InjectContext(wsgi.Middleware):
+    """Always add a fake 'ec2.context' to WSGI environ."""
+    def __init__(self, context, *args, **kwargs):
+        self.context = context
+        super(InjectContext, self).__init__(*args, **kwargs)
 
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
+    def __call__(self, req):
+        req.environ['ec2.context'] = self.context
+        return self.application
+
+
+class Authenticate(wsgi.Middleware):
     """Authenticate an EC2 request and add 'ec2.context' to WSGI environ."""
 
     @webob.dec.wsgify(RequestClass=wsgi.Request)
@@ -295,16 +306,13 @@ class Authorizer(wsgi.Middleware):
 
     def _matches_any_role(self, context, roles):
         """Return True if any role in roles is allowed in context."""
-        authman = manager.AuthManager()
-        user = authman.get_user(context.user_id)
-        if user.is_superuser():
+        if context.is_admin:
             return True
         if 'all' in roles:
             return True
         if 'none' in roles:
             return False
-        return any(authman.has_role(context.user_id, role, context.project_id)
-                   for role in roles)
+        return any(role in context.roles for role in roles)
 
 
 class Executor(wsgi.Application):
diff --git a/nova/tests/hyperv_unittest.py b/nova/tests/hyperv_unittest.py
index ab2995923e7b..0ea196950332 100644
--- a/nova/tests/hyperv_unittest.py
+++ b/nova/tests/hyperv_unittest.py
@@ -23,7 +23,6 @@ from nova import context
 from nova import db
 from nova import flags
 from nova import test
-from nova.auth import manager
 from nova.virt import hyperv
 
 FLAGS = flags.FLAGS
@@ -34,11 +33,9 @@ class HyperVTestCase(test.TestCase):
     """Test cases for the Hyper-V driver"""
     def setUp(self):
         super(HyperVTestCase, self).setUp()
-        self.manager = manager.AuthManager()
-        self.user = self.manager.create_user('fake', 'fake', 'fake',
-                                             admin=True)
-        self.project = self.manager.create_project('fake', 'fake', 'fake')
-        self.context = context.RequestContext(self.user.id, self.project.id)
+        self.user_id = 'fake'
+        self.project_id = 'fake'
+        self.context = context.RequestContext(self.user_id, self.project_id)
 
     def test_create_destroy(self):
         """Create a VM and destroy it"""
diff --git a/nova/tests/test_adminapi.py b/nova/tests/test_adminapi.py
index f8abe609dbe8..fde26e31a629 100644
--- a/nova/tests/test_adminapi.py
+++ b/nova/tests/test_adminapi.py
@@ -25,7 +25,6 @@ from nova import log as logging
 from nova import rpc
 from nova import test
 from nova import utils
-from nova.auth import manager
 from nova.api.ec2 import admin
 from nova.image import fake
 
@@ -51,11 +50,11 @@ class AdminApiTestCase(test.TestCase):
         self.volume = self.start_service('volume')
         self.image_service = utils.import_object(FLAGS.image_service)
 
-        self.manager = manager.AuthManager()
-        self.user = self.manager.create_user('admin', 'admin', 'admin', True)
-        self.project = self.manager.create_project('proj', 'admin', 'proj')
-        self.context = context.RequestContext(user_id=self.user.id,
-                                              project_id=self.project.id)
+        self.user_id = 'admin'
+        self.project_id = 'admin'
+        self.context = context.RequestContext(self.user_id,
+                                              self.project_id,
+                                              True)
 
         def fake_show(meh, context, id):
             return {'id': 1, 'properties': {'kernel_id': 1, 'ramdisk_id': 1,
@@ -73,11 +72,6 @@ class AdminApiTestCase(test.TestCase):
 
         self.stubs.Set(rpc, 'cast', finish_cast)
 
-    def tearDown(self):
-        self.manager.delete_project(self.project)
-        self.manager.delete_user(self.user)
-        super(AdminApiTestCase, self).tearDown()
-
     def test_block_external_ips(self):
         """Make sure provider firewall rules are created."""
         result = self.api.block_external_addresses(self.context, '1.1.1.1/32')
diff --git a/nova/tests/test_api.py b/nova/tests/test_api.py
index 26ac5ff24d3b..978e43abd80c 100644
--- a/nova/tests/test_api.py
+++ b/nova/tests/test_api.py
@@ -34,7 +34,6 @@ from nova.api import ec2
 from nova.api.ec2 import apirequest
 from nova.api.ec2 import cloud
 from nova.api.ec2 import ec2utils
-from nova.auth import manager
 
 
 class FakeHttplibSocket(object):
@@ -192,10 +191,13 @@ class ApiEc2TestCase(test.TestCase):
     """Unit test for the cloud controller on an EC2 API"""
     def setUp(self):
         super(ApiEc2TestCase, self).setUp()
-        self.manager = manager.AuthManager()
         self.host = '127.0.0.1'
-        self.app = ec2.Authenticate(ec2.Requestify(ec2.Executor(),
-                       'nova.api.ec2.cloud.CloudController'))
+        # NOTE(vish): skipping the Authorizer
+        roles = ['sysadmin', 'netadmin']
+        ctxt = context.RequestContext('fake', 'fake', roles=roles)
+        self.app = ec2.InjectContext(ctxt,
+                ec2.Requestify(ec2.Authorizer(ec2.Executor()),
+                               'nova.api.ec2.cloud.CloudController'))
 
     def expect_http(self, host=None, is_secure=False, api_version=None):
         """Returns a new EC2 connection"""
@@ -242,39 +244,25 @@ class ApiEc2TestCase(test.TestCase):
         self.expect_http(api_version='2010-10-30')
         self.mox.ReplayAll()
 
-        user = self.manager.create_user('fake', 'fake', 'fake')
-        project = self.manager.create_project('fake', 'fake', 'fake')
-
         # Any request should be fine
         self.ec2.get_all_instances()
         self.assertTrue(self.ec2.APIVersion in self.http.getresponsebody(),
                        'The version in the xmlns of the response does '
                        'not match the API version given in the request.')
 
-        self.manager.delete_project(project)
-        self.manager.delete_user(user)
-
     def test_describe_instances(self):
         """Test that, after creating a user and a project, the describe
         instances call to the API works properly"""
         self.expect_http()
         self.mox.ReplayAll()
-        user = self.manager.create_user('fake', 'fake', 'fake')
-        project = self.manager.create_project('fake', 'fake', 'fake')
         self.assertEqual(self.ec2.get_all_instances(), [])
-        self.manager.delete_project(project)
-        self.manager.delete_user(user)
 
     def test_terminate_invalid_instance(self):
         """Attempt to terminate an invalid instance"""
         self.expect_http()
         self.mox.ReplayAll()
-        user = self.manager.create_user('fake', 'fake', 'fake')
-        project = self.manager.create_project('fake', 'fake', 'fake')
         self.assertRaises(EC2ResponseError, self.ec2.terminate_instances,
                             "i-00000005")
-        self.manager.delete_project(project)
-        self.manager.delete_user(user)
 
     def test_get_all_key_pairs(self):
         """Test that, after creating a user and project and generating
@@ -283,16 +271,12 @@ class ApiEc2TestCase(test.TestCase):
         self.mox.ReplayAll()
         keyname = "".join(random.choice("sdiuisudfsdcnpaqwertasd") \
                           for x in range(random.randint(4, 8)))
-        user = self.manager.create_user('fake', 'fake', 'fake')
-        project = self.manager.create_project('fake', 'fake', 'fake')
         # NOTE(vish): create depends on pool, so call helper directly
-        cloud._gen_key(context.get_admin_context(), user.id, keyname)
+        cloud._gen_key(context.get_admin_context(), 'fake', keyname)
 
         rv = self.ec2.get_all_key_pairs()
         results = [k for k in rv if k.name == keyname]
         self.assertEquals(len(results), 1)
-        self.manager.delete_project(project)
-        self.manager.delete_user(user)
 
     def test_create_duplicate_key_pair(self):
         """Test that, after successfully generating a keypair,
@@ -301,8 +285,6 @@ class ApiEc2TestCase(test.TestCase):
         self.mox.ReplayAll()
         keyname = "".join(random.choice("sdiuisudfsdcnpaqwertasd") \
                           for x in range(random.randint(4, 8)))
-        user = self.manager.create_user('fake', 'fake', 'fake')
-        project = self.manager.create_project('fake', 'fake', 'fake')
         # NOTE(vish): create depends on pool, so call helper directly
         self.ec2.create_key_pair('test')
 
@@ -321,27 +303,16 @@ class ApiEc2TestCase(test.TestCase):
         """Test that we can retrieve security groups"""
         self.expect_http()
         self.mox.ReplayAll()
-        user = self.manager.create_user('fake', 'fake', 'fake', admin=True)
-        project = self.manager.create_project('fake', 'fake', 'fake')
 
         rv = self.ec2.get_all_security_groups()
 
         self.assertEquals(len(rv), 1)
         self.assertEquals(rv[0].name, 'default')
 
-        self.manager.delete_project(project)
-        self.manager.delete_user(user)
-
     def test_create_delete_security_group(self):
         """Test that we can create a security group"""
         self.expect_http()
         self.mox.ReplayAll()
-        user = self.manager.create_user('fake', 'fake', 'fake', admin=True)
-        project = self.manager.create_project('fake', 'fake', 'fake')
-
-        # At the moment, you need both of these to actually be netadmin
-        self.manager.add_role('fake', 'netadmin')
-        project.add_role('fake', 'netadmin')
 
         security_group_name = "".join(random.choice("sdiuisudfsdcnpaqwertasd")
                                       for x in range(random.randint(4, 8)))
@@ -360,9 +331,6 @@ class ApiEc2TestCase(test.TestCase):
 
         self.ec2.delete_security_group(security_group_name)
 
-        self.manager.delete_project(project)
-        self.manager.delete_user(user)
-
     def test_authorize_revoke_security_group_cidr(self):
         """
         Test that we can add and remove CIDR based rules
@@ -370,12 +338,6 @@ class ApiEc2TestCase(test.TestCase):
         """
         self.expect_http()
         self.mox.ReplayAll()
-        user = self.manager.create_user('fake', 'fake', 'fake')
-        project = self.manager.create_project('fake', 'fake', 'fake')
-
-        # At the moment, you need both of these to actually be netadmin
-        self.manager.add_role('fake', 'netadmin')
-        project.add_role('fake', 'netadmin')
 
         security_group_name = "".join(random.choice("sdiuisudfsdcnpaqwertasd")
                                       for x in range(random.randint(4, 8)))
@@ -422,9 +384,6 @@ class ApiEc2TestCase(test.TestCase):
         self.assertEqual(len(rv), 1)
         self.assertEqual(rv[0].name, 'default')
 
-        self.manager.delete_project(project)
-        self.manager.delete_user(user)
-
         return
 
     def test_authorize_revoke_security_group_cidr_v6(self):
@@ -434,12 +393,7 @@ class ApiEc2TestCase(test.TestCase):
         """
         self.expect_http()
         self.mox.ReplayAll()
-        user = self.manager.create_user('fake', 'fake', 'fake')
-        project = self.manager.create_project('fake', 'fake', 'fake')
 
-        # At the moment, you need both of these to actually be netadmin
-        self.manager.add_role('fake', 'netadmin')
-        project.add_role('fake', 'netadmin')
 
         security_group_name = "".join(random.choice("sdiuisudfsdcnpaqwertasd")
                                       for x in range(random.randint(4, 8)))
@@ -485,9 +439,6 @@ class ApiEc2TestCase(test.TestCase):
         self.assertEqual(len(rv), 1)
         self.assertEqual(rv[0].name, 'default')
 
-        self.manager.delete_project(project)
-        self.manager.delete_user(user)
-
         return
 
     def test_authorize_revoke_security_group_foreign_group(self):
@@ -497,12 +448,6 @@ class ApiEc2TestCase(test.TestCase):
         """
         self.expect_http()
         self.mox.ReplayAll()
-        user = self.manager.create_user('fake', 'fake', 'fake', admin=True)
-        project = self.manager.create_project('fake', 'fake', 'fake')
-
-        # At the moment, you need both of these to actually be netadmin
-        self.manager.add_role('fake', 'netadmin')
-        project.add_role('fake', 'netadmin')
 
         rand_string = 'sdiuisudfsdcnpaqwertasd'
         security_group_name = "".join(random.choice(rand_string)
@@ -556,8 +501,3 @@ class ApiEc2TestCase(test.TestCase):
         self.mox.ReplayAll()
 
         self.ec2.delete_security_group(security_group_name)
-
-        self.manager.delete_project(project)
-        self.manager.delete_user(user)
-
-        return
diff --git a/nova/tests/test_cloud.py b/nova/tests/test_cloud.py
index 71ac7f4733f5..c414e0ddc31e 100644
--- a/nova/tests/test_cloud.py
+++ b/nova/tests/test_cloud.py
@@ -34,7 +34,6 @@ from nova import network
 from nova import rpc
 from nova import test
 from nova import utils
-from nova.auth import manager
 from nova.api.ec2 import cloud
 from nova.api.ec2 import ec2utils
 from nova.image import fake
@@ -62,12 +61,11 @@ class CloudTestCase(test.TestCase):
         self.volume = self.start_service('volume')
         self.image_service = utils.import_object(FLAGS.image_service)
 
-        self.manager = manager.AuthManager()
-        self.user = self.manager.create_user('admin', 'admin', 'admin', True)
-        self.project = self.manager.create_project('proj', 'admin', 'proj')
-        self.context = context.RequestContext(user_id=self.user.id,
-                                              project_id=self.project.id)
-        host = self.network.host
+        self.user_id = 'fake'
+        self.project_id = 'fake'
+        self.context = context.RequestContext(self.user_id,
+                                              self.project_id,
+                                              True)
 
         def fake_show(meh, context, id):
             return {'id': 1, 'container_format': 'ami',
@@ -87,12 +85,10 @@ class CloudTestCase(test.TestCase):
         self.stubs.Set(rpc, 'cast', finish_cast)
 
     def tearDown(self):
-        networks = db.project_get_networks(self.context, self.project.id,
+        networks = db.project_get_networks(self.context, self.project_id,
                                            associate=False)
         for network in networks:
             db.network_disassociate(self.context, network['id'])
-        self.manager.delete_project(self.project)
-        self.manager.delete_user(self.user)
         super(CloudTestCase, self).tearDown()
 
     def _create_key(self, name):
diff --git a/nova/tests/test_compute.py b/nova/tests/test_compute.py
index 5d59b628a9f6..a1b86276fc50 100644
--- a/nova/tests/test_compute.py
+++ b/nova/tests/test_compute.py
@@ -19,10 +19,6 @@
 Tests For Compute
 """
 
-import mox
-import stubout
-
-from nova.auth import manager
 from nova import compute
 from nova.compute import instance_types
 from nova.compute import manager as compute_manager
@@ -67,10 +63,9 @@ class ComputeTestCase(test.TestCase):
                    network_manager='nova.network.manager.FlatManager')
         self.compute = utils.import_object(FLAGS.compute_manager)
         self.compute_api = compute.API()
-        self.manager = manager.AuthManager()
-        self.user = self.manager.create_user('fake', 'fake', 'fake')
-        self.project = self.manager.create_project('fake', 'fake', 'fake')
-        self.context = context.RequestContext('fake', 'fake', False)
+        self.user_id = 'fake'
+        self.project_id = 'fake'
+        self.context = context.RequestContext(self.user_id, self.project_id)
         test_notifier.NOTIFICATIONS = []
 
         def fake_show(meh, context, id):
@@ -78,19 +73,14 @@ class ComputeTestCase(test.TestCase):
 
         self.stubs.Set(nova.image.fake._FakeImageService, 'show', fake_show)
 
-    def tearDown(self):
-        self.manager.delete_user(self.user)
-        self.manager.delete_project(self.project)
-        super(ComputeTestCase, self).tearDown()
-
     def _create_instance(self, params={}):
         """Create a test instance"""
         inst = {}
         inst['image_ref'] = 1
         inst['reservation_id'] = 'r-fakeres'
         inst['launch_time'] = '10'
-        inst['user_id'] = self.user.id
-        inst['project_id'] = self.project.id
+        inst['user_id'] = self.user_id
+        inst['project_id'] = self.project_id
         type_id = instance_types.get_instance_type_by_name('m1.tiny')['id']
         inst['instance_type_id'] = type_id
         inst['ami_launch_index'] = 0
@@ -115,8 +105,8 @@ class ComputeTestCase(test.TestCase):
     def _create_group(self):
         values = {'name': 'testgroup',
                   'description': 'testgroup',
-                  'user_id': self.user.id,
-                  'project_id': self.project.id}
+                  'user_id': self.user_id,
+                  'project_id': self.project_id}
         return db.security_group_create(self.context, values)
 
     def _get_dummy_instance(self):
@@ -350,8 +340,8 @@ class ComputeTestCase(test.TestCase):
         self.assertEquals(msg['priority'], 'INFO')
         self.assertEquals(msg['event_type'], 'compute.instance.create')
         payload = msg['payload']
-        self.assertEquals(payload['tenant_id'], self.project.id)
-        self.assertEquals(payload['user_id'], self.user.id)
+        self.assertEquals(payload['tenant_id'], self.project_id)
+        self.assertEquals(payload['user_id'], self.user_id)
         self.assertEquals(payload['instance_id'], instance_id)
         self.assertEquals(payload['instance_type'], 'm1.tiny')
         type_id = instance_types.get_instance_type_by_name('m1.tiny')['id']
@@ -374,8 +364,8 @@ class ComputeTestCase(test.TestCase):
         self.assertEquals(msg['priority'], 'INFO')
         self.assertEquals(msg['event_type'], 'compute.instance.delete')
         payload = msg['payload']
-        self.assertEquals(payload['tenant_id'], self.project.id)
-        self.assertEquals(payload['user_id'], self.user.id)
+        self.assertEquals(payload['tenant_id'], self.project_id)
+        self.assertEquals(payload['user_id'], self.user_id)
         self.assertEquals(payload['instance_id'], instance_id)
         self.assertEquals(payload['instance_type'], 'm1.tiny')
         type_id = instance_types.get_instance_type_by_name('m1.tiny')['id']
@@ -457,8 +447,8 @@ class ComputeTestCase(test.TestCase):
         self.assertEquals(msg['priority'], 'INFO')
         self.assertEquals(msg['event_type'], 'compute.instance.resize.prep')
         payload = msg['payload']
-        self.assertEquals(payload['tenant_id'], self.project.id)
-        self.assertEquals(payload['user_id'], self.user.id)
+        self.assertEquals(payload['tenant_id'], self.project_id)
+        self.assertEquals(payload['user_id'], self.user_id)
         self.assertEquals(payload['instance_id'], instance_id)
         self.assertEquals(payload['instance_type'], 'm1.tiny')
         type_id = instance_types.get_instance_type_by_name('m1.tiny')['id']
@@ -850,7 +840,6 @@ class ComputeTestCase(test.TestCase):
 
     def test_run_kill_vm(self):
         """Detect when a vm is terminated behind the scenes"""
-        self.stubs = stubout.StubOutForTesting()
         self.stubs.Set(compute_manager.ComputeManager,
                 '_report_driver_status', nop_report_driver_status)
 
diff --git a/nova/tests/test_console.py b/nova/tests/test_console.py
index 1806cc1ead2f..cf7f592cf8b1 100644
--- a/nova/tests/test_console.py
+++ b/nova/tests/test_console.py
@@ -26,10 +26,9 @@ from nova import exception
 from nova import flags
 from nova import test
 from nova import utils
-from nova.auth import manager
-from nova.console import manager as console_manager
 
 FLAGS = flags.FLAGS
+flags.DECLARE('console_driver', 'nova.console.manager')
 
 
 class ConsoleTestCase(test.TestCase):
@@ -39,17 +38,11 @@ class ConsoleTestCase(test.TestCase):
         self.flags(console_driver='nova.console.fake.FakeConsoleProxy',
                    stub_compute=True)
         self.console = utils.import_object(FLAGS.console_manager)
-        self.manager = manager.AuthManager()
-        self.user = self.manager.create_user('fake', 'fake', 'fake')
-        self.project = self.manager.create_project('fake', 'fake', 'fake')
-        self.context = context.get_admin_context()
+        self.user_id = 'fake'
+        self.project_id = 'fake'
+        self.context = context.RequestContext(self.user_id, self.project_id)
         self.host = 'test_compute_host'
 
-    def tearDown(self):
-        self.manager.delete_user(self.user)
-        self.manager.delete_project(self.project)
-        super(ConsoleTestCase, self).tearDown()
-
     def _create_instance(self):
         """Create a test instance"""
         inst = {}
@@ -58,8 +51,8 @@ class ConsoleTestCase(test.TestCase):
         inst['image_id'] = 1
         inst['reservation_id'] = 'r-fakeres'
         inst['launch_time'] = '10'
-        inst['user_id'] = self.user.id
-        inst['project_id'] = self.project.id
+        inst['user_id'] = self.user_id
+        inst['project_id'] = self.project_id
         inst['instance_type_id'] = 1
         inst['ami_launch_index'] = 0
         return db.instance_create(self.context, inst)['id']
diff --git a/nova/tests/test_libvirt.py b/nova/tests/test_libvirt.py
index 948ca215fdd9..61e95c05eccb 100644
--- a/nova/tests/test_libvirt.py
+++ b/nova/tests/test_libvirt.py
@@ -32,7 +32,6 @@ from nova import flags
 from nova import test
 from nova import utils
 from nova.api.ec2 import cloud
-from nova.auth import manager
 from nova.compute import power_state
 from nova.virt.libvirt import connection
 from nova.virt.libvirt import firewall
@@ -150,35 +149,14 @@ class LibvirtConnTestCase(test.TestCase):
         super(LibvirtConnTestCase, self).setUp()
         connection._late_load_cheetah()
         self.flags(fake_call=True)
-        self.manager = manager.AuthManager()
-
-        try:
-            pjs = self.manager.get_projects()
-            pjs = [p for p in pjs if p.name == 'fake']
-            if 0 != len(pjs):
-                self.manager.delete_project(pjs[0])
-
-            users = self.manager.get_users()
-            users = [u for u in users if u.name == 'fake']
-            if 0 != len(users):
-                self.manager.delete_user(users[0])
-        except Exception, e:
-            pass
-
-        users = self.manager.get_users()
-        self.user = self.manager.create_user('fake', 'fake', 'fake',
-                                             admin=True)
-        self.project = self.manager.create_project('fake', 'fake', 'fake')
+        self.user_id = 'fake'
+        self.project_id = 'fake'
+        self.context = context.RequestContext(self.user_id, self.project_id)
         self.network = utils.import_object(FLAGS.network_manager)
         self.context = context.get_admin_context()
         FLAGS.instances_path = ''
         self.call_libvirt_dependant_setup = False
 
-    def tearDown(self):
-        self.manager.delete_project(self.project)
-        self.manager.delete_user(self.user)
-        super(LibvirtConnTestCase, self).tearDown()
-
     test_ip = '10.11.12.13'
     test_instance = {'memory_kb':     '1024000',
                      'basepath':      '/some/path',
@@ -429,13 +407,13 @@ class LibvirtConnTestCase(test.TestCase):
         self.assertEquals(parameters[1].get('value'), 'fake')
 
     def _check_xml_and_container(self, instance):
-        user_context = context.RequestContext(self.user.id,
-                                              self.project.id)
+        user_context = context.RequestContext(self.user_id,
+                                              self.project_id)
         instance_ref = db.instance_create(user_context, instance)
         # Re-get the instance so it's bound to an actual session
         instance_ref = db.instance_get(user_context, instance_ref['id'])
         network_ref = db.project_get_networks(context.get_admin_context(),
-                                             self.project.id)[0]
+                                             self.project_id)[0]
 
         vif = {'address': '56:12:12:12:12:12',
                'network_id': network_ref['id'],
@@ -475,10 +453,10 @@ class LibvirtConnTestCase(test.TestCase):
 
     def _check_xml_and_uri(self, instance, expect_ramdisk, expect_kernel,
                            rescue=False):
-        user_context = context.RequestContext(self.user.id, self.project.id)
+        user_context = context.RequestContext(self.user_id, self.project_id)
         instance_ref = db.instance_create(user_context, instance)
         network_ref = db.project_get_networks(context.get_admin_context(),
-                                             self.project.id)[0]
+                                             self.project_id)[0]
 
         _setup_networking(instance_ref['id'], ip=self.test_ip)
 
@@ -759,7 +737,7 @@ class LibvirtConnTestCase(test.TestCase):
         conn.firewall_driver.setattr('prepare_instance_filter', fake_none)
 
         network = db.project_get_networks(context.get_admin_context(),
-                                          self.project.id)[0]
+                                          self.project_id)[0]
         ip_dict = {'ip': self.test_ip,
                    'netmask': network['netmask'],
                    'enabled': '1'}
@@ -814,11 +792,9 @@ class IptablesFirewallTestCase(test.TestCase):
     def setUp(self):
         super(IptablesFirewallTestCase, self).setUp()
 
-        self.manager = manager.AuthManager()
-        self.user = self.manager.create_user('fake', 'fake', 'fake',
-                                             admin=True)
-        self.project = self.manager.create_project('fake', 'fake', 'fake')
-        self.context = context.RequestContext('fake', 'fake')
+        self.user_id = 'fake'
+        self.project_id = 'fake'
+        self.context = context.RequestContext(self.user_id, self.project_id)
         self.network = utils.import_object(FLAGS.network_manager)
 
         class FakeLibvirtConnection(object):
@@ -843,11 +819,6 @@ class IptablesFirewallTestCase(test.TestCase):
         connection.libxml2 = __import__('libxml2')
         return True
 
-    def tearDown(self):
-        self.manager.delete_project(self.project)
-        self.manager.delete_user(self.user)
-        super(IptablesFirewallTestCase, self).tearDown()
-
     in_nat_rules = [
       '# Generated by iptables-save v1.4.10 on Sat Feb 19 00:03:19 2011',
       '*nat',
@@ -1161,22 +1132,15 @@ class NWFilterTestCase(test.TestCase):
         class Mock(object):
             pass
 
-        self.manager = manager.AuthManager()
-        self.user = self.manager.create_user('fake', 'fake', 'fake',
-                                             admin=True)
-        self.project = self.manager.create_project('fake', 'fake', 'fake')
-        self.context = context.RequestContext(self.user.id, self.project.id)
+        self.user_id = 'fake'
+        self.project_id = 'fake'
+        self.context = context.RequestContext(self.user_id, self.project_id)
 
         self.fake_libvirt_connection = Mock()
 
         self.fw = firewall.NWFilterFirewall(
                                          lambda: self.fake_libvirt_connection)
 
-    def tearDown(self):
-        self.manager.delete_project(self.project)
-        self.manager.delete_user(self.user)
-        super(NWFilterTestCase, self).tearDown()
-
     def test_cidr_rule_nwfilter_xml(self):
         cloud_controller = cloud.CloudController()
         cloud_controller.create_security_group(self.context,
diff --git a/nova/tests/test_objectstore.py b/nova/tests/test_objectstore.py
index 39b4e18d77db..af4ee27cd028 100644
--- a/nova/tests/test_objectstore.py
+++ b/nova/tests/test_objectstore.py
@@ -21,8 +21,6 @@ Unittets for S3 objectstore clone.
 """
 
 import boto
-import glob
-import hashlib
 import os
 import shutil
 import tempfile
@@ -30,12 +28,9 @@ import tempfile
 from boto import exception as boto_exception
 from boto.s3 import connection as s3
 
-from nova import context
-from nova import exception
 from nova import flags
 from nova import wsgi
 from nova import test
-from nova.auth import manager
 from nova.objectstore import s3server
 
 
@@ -61,11 +56,6 @@ class S3APITestCase(test.TestCase):
                    buckets_path=os.path.join(OSS_TEMPDIR, 'buckets'),
                    s3_host='127.0.0.1')
 
-        self.auth_manager = manager.AuthManager()
-        self.admin_user = self.auth_manager.create_user('admin', admin=True)
-        self.admin_project = self.auth_manager.create_project('admin',
-                                                              self.admin_user)
-
         shutil.rmtree(FLAGS.buckets_path)
         os.mkdir(FLAGS.buckets_path)
 
@@ -80,8 +70,8 @@ class S3APITestCase(test.TestCase):
             boto.config.add_section('Boto')
 
         boto.config.set('Boto', 'num_retries', '0')
-        conn = s3.S3Connection(aws_access_key_id=self.admin_user.access,
-                               aws_secret_access_key=self.admin_user.secret,
+        conn = s3.S3Connection(aws_access_key_id='fake',
+                               aws_secret_access_key='fake',
                                host=FLAGS.s3_host,
                                port=FLAGS.s3_port,
                                is_secure=False,
@@ -104,11 +94,11 @@ class S3APITestCase(test.TestCase):
         self.assertEquals(buckets[0].name, name, "Wrong name")
         return True
 
-    def test_000_list_buckets(self):
+    def test_list_buckets(self):
         """Make sure we are starting with no buckets."""
         self._ensure_no_buckets(self.conn.get_all_buckets())
 
-    def test_001_create_and_delete_bucket(self):
+    def test_create_and_delete_bucket(self):
         """Test bucket creation and deletion."""
         bucket_name = 'testbucket'
 
@@ -117,7 +107,7 @@ class S3APITestCase(test.TestCase):
         self.conn.delete_bucket(bucket_name)
         self._ensure_no_buckets(self.conn.get_all_buckets())
 
-    def test_002_create_bucket_and_key_and_delete_key_again(self):
+    def test_create_bucket_and_key_and_delete_key_again(self):
         """Test key operations on buckets."""
         bucket_name = 'testbucket'
         key_name = 'somekey'
@@ -146,8 +136,6 @@ class S3APITestCase(test.TestCase):
                           bucket_name)
 
     def tearDown(self):
-        """Tear down auth and test server."""
-        self.auth_manager.delete_user('admin')
-        self.auth_manager.delete_project('admin')
+        """Tear down test server."""
         self.server.stop()
         super(S3APITestCase, self).tearDown()
diff --git a/nova/tests/test_vmwareapi.py b/nova/tests/test_vmwareapi.py
index cbf7801cf35b..52b5debf5d08 100644
--- a/nova/tests/test_vmwareapi.py
+++ b/nova/tests/test_vmwareapi.py
@@ -26,7 +26,6 @@ from nova import db
 from nova import flags
 from nova import test
 from nova import utils
-from nova.auth import manager
 from nova.compute import power_state
 from nova.tests.glance import stubs as glance_stubs
 from nova.tests.vmwareapi import db_fakes
@@ -48,12 +47,10 @@ class VMWareAPIVMTestCase(test.TestCase):
     #    self.flags(vmwareapi_host_ip='test_url',
     #               vmwareapi_host_username='test_username',
     #               vmwareapi_host_password='test_pass')
-    #    self.manager = manager.AuthManager()
-    #    self.user = self.manager.create_user('fake', 'fake', 'fake',
-    #                                         admin=True)
-    #    self.project = self.manager.create_project('fake', 'fake', 'fake')
     #    self.network = utils.import_object(FLAGS.network_manager)
-    #    self.stubs = stubout.StubOutForTesting()
+    #    self.user_id = 'fake'
+    #    self.project_id = 'fake'
+    #    self.context = context.RequestContext(self.user_id, self.project_id)
     #    vmwareapi_fake.reset()
     #    db_fakes.stub_out_db_instance_api(self.stubs)
     #    stubs.set_stubs(self.stubs)
@@ -64,15 +61,13 @@ class VMWareAPIVMTestCase(test.TestCase):
     #def tearDown(self):
     #    super(VMWareAPIVMTestCase, self).tearDown()
     #    vmwareapi_fake.cleanup()
-    #    self.manager.delete_project(self.project)
-    #    self.manager.delete_user(self.user)
     #    self.stubs.UnsetAll()
 
     def _create_instance_in_the_db(self):
         values = {'name': 1,
                   'id': 1,
-                  'project_id': self.project.id,
-                  'user_id': self.user.id,
+                  'project_id': self.project_id,
+                  'user_id': self.user_id,
                   'image_id': "1",
                   'kernel_id': "1",
                   'ramdisk_id': "1",
diff --git a/nova/tests/test_xenapi.py b/nova/tests/test_xenapi.py
index 4cb7447d3c3c..651c7f9e76fa 100644
--- a/nova/tests/test_xenapi.py
+++ b/nova/tests/test_xenapi.py
@@ -30,7 +30,6 @@ from nova import flags
 from nova import log as logging
 from nova import test
 from nova import utils
-from nova.auth import manager
 from nova.compute import instance_types
 from nova.compute import power_state
 from nova import exception
@@ -69,7 +68,9 @@ class XenAPIVolumeTestCase(test.TestCase):
     def setUp(self):
         super(XenAPIVolumeTestCase, self).setUp()
         self.stubs = stubout.StubOutForTesting()
-        self.context = context.RequestContext('fake', 'fake', False)
+        self.user_id = 'fake'
+        self.project_id = 'fake'
+        self.context = context.RequestContext(self.user_id, self.project_id)
         FLAGS.target_host = '127.0.0.1'
         FLAGS.xenapi_connection_url = 'test_url'
         FLAGS.xenapi_connection_password = 'test_pass'
@@ -77,7 +78,7 @@ class XenAPIVolumeTestCase(test.TestCase):
         stubs.stub_out_get_target(self.stubs)
         xenapi_fake.reset()
         self.values = {'id': 1,
-                  'project_id': 'fake',
+                  'project_id': self.user_id,
                   'user_id': 'fake',
                   'image_ref': 1,
                   'kernel_id': 2,
@@ -173,10 +174,6 @@ class XenAPIVMTestCase(test.TestCase):
     """Unit tests for VM operations."""
     def setUp(self):
         super(XenAPIVMTestCase, self).setUp()
-        self.manager = manager.AuthManager()
-        self.user = self.manager.create_user('fake', 'fake', 'fake',
-                                             admin=True)
-        self.project = self.manager.create_project('fake', 'fake', 'fake')
         self.network = utils.import_object(FLAGS.network_manager)
         self.stubs = stubout.StubOutForTesting()
         self.flags(xenapi_connection_url='test_url',
@@ -195,7 +192,9 @@ class XenAPIVMTestCase(test.TestCase):
         stubs.stub_out_vm_methods(self.stubs)
         glance_stubs.stubout_glance_client(self.stubs)
         fake_utils.stub_out_utils_execute(self.stubs)
-        self.context = context.RequestContext('fake', 'fake', False)
+        self.user_id = 'fake'
+        self.project_id = 'fake'
+        self.context = context.RequestContext(self.user_id, self.project_id)
         self.conn = xenapi_conn.get_connection(False)
 
     def test_parallel_builds(self):
@@ -229,8 +228,8 @@ class XenAPIVMTestCase(test.TestCase):
             instance = db.instance_create(self.context, values)
             self.conn.spawn(instance, network_info)
 
-        gt1 = eventlet.spawn(_do_build, 1, self.project.id, self.user.id)
-        gt2 = eventlet.spawn(_do_build, 2, self.project.id, self.user.id)
+        gt1 = eventlet.spawn(_do_build, 1, self.project_id, self.user_id)
+        gt2 = eventlet.spawn(_do_build, 2, self.project_id, self.user_id)
         gt1.wait()
         gt2.wait()
 
@@ -399,8 +398,8 @@ class XenAPIVMTestCase(test.TestCase):
                     check_injection=False):
         stubs.stubout_loopingcall_start(self.stubs)
         values = {'id': instance_id,
-                  'project_id': self.project.id,
-                  'user_id': self.user.id,
+                  'project_id': self.project_id,
+                  'user_id': self.user_id,
                   'image_ref': image_ref,
                   'kernel_id': kernel_id,
                   'ramdisk_id': ramdisk_id,
@@ -465,12 +464,30 @@ class XenAPIVMTestCase(test.TestCase):
         self._check_vdis(vdi_recs_start, vdi_recs_end)
 
     def test_spawn_raw_objectstore(self):
-        FLAGS.xenapi_image_service = 'objectstore'
-        self._test_spawn(1, None, None)
+        # TODO(vish): deprecated
+        from nova.auth import manager
+        authman = manager.AuthManager()
+        authman.create_user('fake', 'fake')
+        authman.create_project('fake', 'fake')
+        try:
+            FLAGS.xenapi_image_service = 'objectstore'
+            self._test_spawn(1, None, None)
+        finally:
+            authman.delete_project('fake')
+            authman.delete_user('fake')
 
     def test_spawn_objectstore(self):
-        FLAGS.xenapi_image_service = 'objectstore'
-        self._test_spawn(1, 2, 3)
+        # TODO(vish): deprecated
+        from nova.auth import manager
+        authman = manager.AuthManager()
+        authman.create_user('fake', 'fake')
+        authman.create_project('fake', 'fake')
+        try:
+            FLAGS.xenapi_image_service = 'objectstore'
+            self._test_spawn(1, 2, 3)
+        finally:
+            authman.delete_project('fake')
+            authman.delete_user('fake')
 
     @stub_vm_utils_with_vdi_attached_here
     def test_spawn_raw_glance(self):
@@ -599,7 +616,7 @@ class XenAPIVMTestCase(test.TestCase):
         # guest agent is detected
         self.assertFalse(self._tee_executed)
 
-    @test.skip_test("Never gets an address, not sure why")
+    @test.skip_test("Key Error on domid")
     def test_spawn_vlanmanager(self):
         self.flags(xenapi_image_service='glance',
                    network_manager='nova.network.manager.VlanManager',
@@ -609,7 +626,7 @@ class XenAPIVMTestCase(test.TestCase):
         def dummy(*args, **kwargs):
             pass
 
-        self.stubs.Set(VMOps, 'create_vifs', dummy)
+        self.stubs.Set(vmops.VMOps, 'create_vifs', dummy)
         # Reset network table
         xenapi_fake.reset_table('network')
         # Instance id = 2 will use vlan network (see db/fakes.py)
@@ -623,7 +640,7 @@ class XenAPIVMTestCase(test.TestCase):
             self.network.set_network_host(ctxt, network['id'])
 
         self.network.allocate_for_instance(ctxt, instance_id=instance_ref.id,
-                instance_type_id=1, project_id=self.project.id)
+                instance_type_id=1, project_id=self.project_id)
         self.network.setup_compute_network(ctxt, instance_ref.id)
         self._test_spawn(glance_stubs.FakeGlance.IMAGE_MACHINE,
                          glance_stubs.FakeGlance.IMAGE_KERNEL,
@@ -655,21 +672,13 @@ class XenAPIVMTestCase(test.TestCase):
         # Ensure that it will not unrescue a non-rescued instance.
         self.assertRaises(Exception, conn.unrescue, instance, None)
 
-    def tearDown(self):
-        super(XenAPIVMTestCase, self).tearDown()
-        self.manager.delete_project(self.project)
-        self.manager.delete_user(self.user)
-        self.vm_info = None
-        self.vm = None
-        self.stubs.UnsetAll()
-
     def _create_instance(self, instance_id=1):
         """Creates and spawns a test instance."""
         stubs.stubout_loopingcall_start(self.stubs)
         values = {
             'id': instance_id,
-            'project_id': self.project.id,
-            'user_id': self.user.id,
+            'project_id': self.project_id,
+            'user_id': self.user_id,
             'image_ref': 1,
             'kernel_id': 2,
             'ramdisk_id': 3,
@@ -750,14 +759,12 @@ class XenAPIMigrateInstance(test.TestCase):
         stubs.stub_out_get_target(self.stubs)
         xenapi_fake.reset()
         xenapi_fake.create_network('fake', FLAGS.flat_network_bridge)
-        self.manager = manager.AuthManager()
-        self.user = self.manager.create_user('fake', 'fake', 'fake',
-                                             admin=True)
-        self.project = self.manager.create_project('fake', 'fake', 'fake')
-        self.context = context.RequestContext('fake', 'fake', False)
+        self.user_id = 'fake'
+        self.project_id = 'fake'
+        self.context = context.RequestContext(self.user_id, self.project_id)
         self.values = {'id': 1,
-                  'project_id': self.project.id,
-                  'user_id': self.user.id,
+                  'project_id': self.project_id,
+                  'user_id': self.user_id,
                   'image_ref': 1,
                   'kernel_id': None,
                   'ramdisk_id': None,
@@ -771,12 +778,6 @@ class XenAPIMigrateInstance(test.TestCase):
         stubs.stubout_get_this_vm_uuid(self.stubs)
         glance_stubs.stubout_glance_client(self.stubs)
 
-    def tearDown(self):
-        super(XenAPIMigrateInstance, self).tearDown()
-        self.manager.delete_project(self.project)
-        self.manager.delete_user(self.user)
-        self.stubs.UnsetAll()
-
     def test_migrate_disk_and_power_off(self):
         instance = db.instance_create(self.context, self.values)
         stubs.stubout_session(self.stubs, stubs.FakeSessionForMigrationTests)
diff --git a/nova/virt/hyperv.py b/nova/virt/hyperv.py
index 5c1dc772d74d..490c9174b121 100644
--- a/nova/virt/hyperv.py
+++ b/nova/virt/hyperv.py
@@ -66,7 +66,6 @@ import time
 from nova import exception
 from nova import flags
 from nova import log as logging
-from nova.auth import manager
 from nova.compute import power_state
 from nova.virt import driver
 from nova.virt import images
@@ -145,13 +144,12 @@ class HyperVConnection(driver.ComputeDriver):
         if vm is not None:
             raise exception.InstanceExists(name=instance.name)
 
-        user = manager.AuthManager().get_user(instance['user_id'])
-        project = manager.AuthManager().get_project(instance['project_id'])
         #Fetch the file, assume it is a VHD file.
         base_vhd_filename = os.path.join(FLAGS.instances_path,
                                          instance.name)
         vhdfile = "%s.vhd" % (base_vhd_filename)
-        images.fetch(instance['image_ref'], vhdfile, user, project)
+        images.fetch(instance['image_ref'], vhdfile,
+                     instance['user_id'], instance['project_id'])
 
         try:
             self._create_vm(instance)
diff --git a/nova/virt/images.py b/nova/virt/images.py
index 40bf6107c96f..2e9fca3d61eb 100644
--- a/nova/virt/images.py
+++ b/nova/virt/images.py
@@ -33,7 +33,7 @@ FLAGS = flags.FLAGS
 LOG = logging.getLogger('nova.virt.images')
 
 
-def fetch(image_href, path, _user, _project):
+def fetch(image_href, path, _user_id, _project_id):
     # TODO(vish): Improve context handling and add owner and auth data
     #             when it is added to glance.  Right now there is no
     #             auth checking in glance, so we assume that access was
diff --git a/nova/virt/libvirt/connection.py b/nova/virt/libvirt/connection.py
index 342dea98f027..9c57d43b5893 100644
--- a/nova/virt/libvirt/connection.py
+++ b/nova/virt/libvirt/connection.py
@@ -757,9 +757,9 @@ class LibvirtConnection(driver.ComputeDriver):
             else:
                 utils.execute('cp', base, target)
 
-    def _fetch_image(self, target, image_id, user, project, size=None):
+    def _fetch_image(self, target, image_id, user_id, project_id, size=None):
         """Grab image and optionally attempt to resize it"""
-        images.fetch(image_id, target, user, project)
+        images.fetch(image_id, target, user_id, project_id)
         if size:
             disk.extend(target, size)
 
@@ -797,9 +797,6 @@ class LibvirtConnection(driver.ComputeDriver):
         os.close(os.open(basepath('console.log', ''),
                          os.O_CREAT | os.O_WRONLY, 0660))
 
-        user = manager.AuthManager().get_user(inst['user_id'])
-        project = manager.AuthManager().get_project(inst['project_id'])
-
         if not disk_images:
             disk_images = {'image_id': inst['image_ref'],
                            'kernel_id': inst['kernel_id'],
@@ -811,16 +808,16 @@ class LibvirtConnection(driver.ComputeDriver):
                               target=basepath('kernel'),
                               fname=fname,
                               image_id=disk_images['kernel_id'],
-                              user=user,
-                              project=project)
+                              user_id=inst['user_id'],
+                              project_id=inst['project_id'])
             if disk_images['ramdisk_id']:
                 fname = '%08x' % int(disk_images['ramdisk_id'])
                 self._cache_image(fn=self._fetch_image,
                                   target=basepath('ramdisk'),
                                   fname=fname,
                                   image_id=disk_images['ramdisk_id'],
-                                  user=user,
-                                  project=project)
+                                  user_id=inst['user_id'],
+                                  project_id=inst['project_id'])
 
         root_fname = hashlib.sha1(disk_images['image_id']).hexdigest()
         size = FLAGS.minimum_root_size
@@ -838,8 +835,8 @@ class LibvirtConnection(driver.ComputeDriver):
                               fname=root_fname,
                               cow=FLAGS.use_cow_images,
                               image_id=disk_images['image_id'],
-                              user=user,
-                              project=project,
+                              user_id=inst['user_id'],
+                              project_id=inst['project_id'],
                               size=size)
 
         if inst_type['local_gb'] and not self._volume_in_mapping(
diff --git a/nova/virt/xenapi/vm_utils.py b/nova/virt/xenapi/vm_utils.py
index 71107aff4083..d146ee2c730f 100644
--- a/nova/virt/xenapi/vm_utils.py
+++ b/nova/virt/xenapi/vm_utils.py
@@ -37,7 +37,6 @@ import nova.image
 from nova.image import glance as glance_image_service
 from nova import log as logging
 from nova import utils
-from nova.auth.manager import AuthManager
 from nova.compute import instance_types
 from nova.compute import power_state
 from nova.virt import disk
@@ -406,7 +405,7 @@ class VMHelper(HelperBase):
         session.wait_for_task(task, instance.id)
 
     @classmethod
-    def fetch_image(cls, session, instance_id, image, user, project,
+    def fetch_image(cls, session, instance_id, image, user_id, project_id,
                     image_type):
         """
         image_type is interpreted as an ImageType instance
@@ -418,18 +417,23 @@ class VMHelper(HelperBase):
         Returns: A single filename if image_type is KERNEL_RAMDISK
                  A list of dictionaries that describe VDIs, otherwise
         """
-        access = AuthManager().get_access_key(user, project)
 
         if FLAGS.xenapi_image_service == 'glance':
-            return cls._fetch_image_glance(session, instance_id, image,
-                                           access, image_type)
+            return cls._fetch_image_glance(session, instance_id,
+                                           image, image_type)
         else:
+            # TODO(vish): this shouldn't be used anywhere anymore and
+            #             can probably be removed
+            from nova.auth.manager import AuthManager
+            manager = AuthManager()
+            access = manager.get_access_key(user_id, project_id)
+            secret = manager.get_user(user_id).secret
             return cls._fetch_image_objectstore(session, instance_id, image,
-                                                access, user.secret,
+                                                access, secret,
                                                 image_type)
 
     @classmethod
-    def _fetch_image_glance_vhd(cls, session, instance_id, image, access,
+    def _fetch_image_glance_vhd(cls, session, instance_id, image,
                                 image_type):
         """Tell glance to download an image and put the VHDs into the SR
 
@@ -477,7 +481,7 @@ class VMHelper(HelperBase):
         return vdis
 
     @classmethod
-    def _fetch_image_glance_disk(cls, session, instance_id, image, access,
+    def _fetch_image_glance_disk(cls, session, instance_id, image,
                                  image_type):
         """Fetch the image from Glance
 
@@ -611,8 +615,7 @@ class VMHelper(HelperBase):
         return image_type
 
     @classmethod
-    def _fetch_image_glance(cls, session, instance_id, image, access,
-                            image_type):
+    def _fetch_image_glance(cls, session, instance_id, image, image_type):
         """Fetch image from glance based on image type.
 
         Returns: A single filename if image_type is KERNEL or RAMDISK
@@ -620,10 +623,10 @@ class VMHelper(HelperBase):
         """
         if image_type == ImageType.DISK_VHD:
             return cls._fetch_image_glance_vhd(
-                session, instance_id, image, access, image_type)
+                session, instance_id, image, image_type)
         else:
             return cls._fetch_image_glance_disk(
-                session, instance_id, image, access, image_type)
+                session, instance_id, image, image_type)
 
     @classmethod
     def _fetch_image_objectstore(cls, session, instance_id, image, access,
diff --git a/nova/virt/xenapi/vmops.py b/nova/virt/xenapi/vmops.py
index 7995576a601b..7c6f12ce29bb 100644
--- a/nova/virt/xenapi/vmops.py
+++ b/nova/virt/xenapi/vmops.py
@@ -38,7 +38,6 @@ from nova import ipv6
 from nova import log as logging
 from nova import utils
 
-from nova.auth.manager import AuthManager
 from nova.compute import power_state
 from nova.virt import driver
 from nova.virt.xenapi.network_utils import NetworkHelper
@@ -130,11 +129,10 @@ class VMOps(object):
         self._session.call_xenapi('VM.start', vm_ref, False, False)
 
     def _create_disks(self, instance):
-        user = AuthManager().get_user(instance.user_id)
-        project = AuthManager().get_project(instance.project_id)
         disk_image_type = VMHelper.determine_disk_image_type(instance)
         vdis = VMHelper.fetch_image(self._session,
-                instance.id, instance.image_ref, user, project,
+                instance.id, instance.image_ref,
+                instance.user_id, instance.project_id,
                 disk_image_type)
         return vdis
 
@@ -172,21 +170,18 @@ class VMOps(object):
                                   power_state.SHUTDOWN)
             return
 
-        user = AuthManager().get_user(instance.user_id)
-        project = AuthManager().get_project(instance.project_id)
-
         disk_image_type = VMHelper.determine_disk_image_type(instance)
         kernel = None
         ramdisk = None
         try:
             if instance.kernel_id:
                 kernel = VMHelper.fetch_image(self._session, instance.id,
-                        instance.kernel_id, user, project,
-                        ImageType.KERNEL)[0]
+                        instance.kernel_id, instance.user_id,
+                        instance.project_id, ImageType.KERNEL)[0]
             if instance.ramdisk_id:
                 ramdisk = VMHelper.fetch_image(self._session, instance.id,
-                        instance.ramdisk_id, user, project,
-                        ImageType.RAMDISK)[0]
+                        instance.kernel_id, instance.user_id,
+                        instance.project_id, ImageType.RAMDISK)[0]
             # Create the VM ref and attach the first disk
             first_vdi_ref = self._session.call_xenapi('VDI.get_by_uuid',
                     vdis[0]['vdi_uuid'])

From 44d1024a53b8150cf9542d08d5886f430365f161 Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@gmail.com>
Date: Fri, 22 Jul 2011 19:47:41 +0000
Subject: [PATCH 04/17] fix all tests

---
 nova/api/ec2/__init__.py                      | 29 +++-----
 nova/api/openstack/auth.py                    | 20 +++++-
 nova/compute/api.py                           |  2 +
 nova/tests/api/openstack/fakes.py             | 40 ++++++-----
 nova/tests/api/openstack/test_auth.py         | 37 +++++------
 nova/tests/api/openstack/test_extensions.py   | 29 ++++----
 .../test_flavors_extra_specs.py               | 66 +++++++------------
 nova/tests/api/openstack/test_images.py       | 27 ++++----
 nova/tests/api/openstack/test_servers.py      | 45 +++++++------
 nova/tests/test_access.py                     |  2 +-
 nova/tests/test_api.py                        |  3 +-
 nova/wsgi.py                                  | 12 ++++
 12 files changed, 157 insertions(+), 155 deletions(-)
 rename nova/tests/api/openstack/{extensions => }/test_flavors_extra_specs.py (74%)

diff --git a/nova/api/ec2/__init__.py b/nova/api/ec2/__init__.py
index edae9433197f..0a743075ca4e 100644
--- a/nova/api/ec2/__init__.py
+++ b/nova/api/ec2/__init__.py
@@ -66,7 +66,7 @@ class RequestLogging(wsgi.Middleware):
         else:
             controller = None
             action = None
-        ctxt = request.environ.get('ec2.context', None)
+        ctxt = request.environ.get('nova.context', None)
         delta = utils.utcnow() - start
         seconds = delta.seconds
         microseconds = delta.microseconds
@@ -138,20 +138,8 @@ class Lockout(wsgi.Middleware):
         return res
 
 
-class InjectContext(wsgi.Middleware):
-    """Always add a fake 'ec2.context' to WSGI environ."""
-    def __init__(self, context, *args, **kwargs):
-        self.context = context
-        super(InjectContext, self).__init__(*args, **kwargs)
-
-    @webob.dec.wsgify(RequestClass=wsgi.Request)
-    def __call__(self, req):
-        req.environ['ec2.context'] = self.context
-        return self.application
-
-
 class Authenticate(wsgi.Middleware):
-    """Authenticate an EC2 request and add 'ec2.context' to WSGI environ."""
+    """Authenticate an EC2 request and add 'nova.context' to WSGI environ."""
 
     @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
@@ -187,12 +175,13 @@ class Authenticate(wsgi.Middleware):
             remote_address = req.headers.get('X-Forwarded-For', remote_address)
         ctxt = context.RequestContext(user_id=user.id,
                                       project_id=project.id,
+                                      is_admin=user.is_admin(),
                                       remote_address=remote_address)
-        req.environ['ec2.context'] = ctxt
+        req.environ['nova.context'] = ctxt
         uname = user.name
         pname = project.name
         msg = _('Authenticated Request For %(uname)s:%(pname)s)') % locals()
-        LOG.audit(msg, context=req.environ['ec2.context'])
+        LOG.audit(msg, context=req.environ['nova.context'])
         return self.application
 
 
@@ -239,7 +228,7 @@ class Authorizer(wsgi.Middleware):
     """Authorize an EC2 API request.
 
     Return a 401 if ec2.controller and ec2.action in WSGI environ may not be
-    executed in ec2.context.
+    executed in nova.context.
     """
 
     def __init__(self, application):
@@ -293,7 +282,7 @@ class Authorizer(wsgi.Middleware):
 
     @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
-        context = req.environ['ec2.context']
+        context = req.environ['nova.context']
         controller = req.environ['ec2.request'].controller.__class__.__name__
         action = req.environ['ec2.request'].action
         allowed_roles = self.action_roles[controller].get(action, ['none'])
@@ -319,14 +308,14 @@ class Executor(wsgi.Application):
 
     """Execute an EC2 API request.
 
-    Executes 'ec2.action' upon 'ec2.controller', passing 'ec2.context' and
+    Executes 'ec2.action' upon 'ec2.controller', passing 'nova.context' and
     'ec2.action_args' (all variables in WSGI environ.)  Returns an XML
     response, or a 400 upon failure.
     """
 
     @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
-        context = req.environ['ec2.context']
+        context = req.environ['nova.context']
         api_request = req.environ['ec2.request']
         result = None
         try:
diff --git a/nova/api/openstack/auth.py b/nova/api/openstack/auth.py
index 5b387c08103d..9caa14a4e3f3 100644
--- a/nova/api/openstack/auth.py
+++ b/nova/api/openstack/auth.py
@@ -58,9 +58,25 @@ class AuthMiddleware(wsgi.Middleware):
         try:
             project_id = req.headers["X-Auth-Project-Id"]
         except KeyError:
-            project_id = user_id
+            # FIXME(usrleon): It needed only for compatibility
+            # while osapi clients don't use this header
+            projects = self.auth.get_projects(user_id)
+            if projects:
+                project_id = projects[0]
+            else:
+                return faults.Fault(webob.exc.HTTPUnauthorized())
+
+        is_admin = self.auth.is_admin(user_id)
+        req.environ['nova.context'] = context.RequestContext(user_id,
+                                                             project_id,
+                                                             is_admin)
+        if not is_admin and not self.auth.is_project_member(user_id,
+                                                            project_id):
+            msg = _("%(user_id)s must be an admin or a "
+                    "member of %(project_id)s")
+            LOG.warn(msg % locals())
+            return faults.Fault(webob.exc.HTTPUnauthorized())
 
-        req.environ['nova.context'] = context.RequestContext(user_id, project_id)
         return self.application
 
     def has_authentication(self, req):
diff --git a/nova/compute/api.py b/nova/compute/api.py
index 51a903d40136..9a1ce745247a 100644
--- a/nova/compute/api.py
+++ b/nova/compute/api.py
@@ -676,6 +676,7 @@ class API(base.Base):
         all instances in the system.
         """
 
+        LOG.info(locals())
         if reservation_id is not None:
             recurse_zones = True
             instances = self.db.instance_get_all_by_reservation(
@@ -688,6 +689,7 @@ class API(base.Base):
                     raise
                 instances = None
         elif project_id or not context.is_admin:
+            LOG.info(context.project_id)
             if not context.project_id:
                 instances = self.db.instance_get_all_by_user(
                     context, context.user_id)
diff --git a/nova/tests/api/openstack/fakes.py b/nova/tests/api/openstack/fakes.py
index 26b1de8186eb..28969d5f8992 100644
--- a/nova/tests/api/openstack/fakes.py
+++ b/nova/tests/api/openstack/fakes.py
@@ -29,6 +29,7 @@ from glance.common import exception as glance_exc
 from nova import context
 from nova import exception as exc
 from nova import utils
+from nova import wsgi
 import nova.api.openstack.auth
 from nova.api import openstack
 from nova.api.openstack import auth
@@ -40,14 +41,13 @@ import nova.image.fake
 from nova.image import glance
 from nova.image import service
 from nova.tests import fake_flags
-from nova.wsgi import Router
 
 
 class Context(object):
     pass
 
 
-class FakeRouter(Router):
+class FakeRouter(wsgi.Router):
     def __init__(self):
         pass
 
@@ -68,21 +68,30 @@ def fake_auth_init(self, application):
 
 @webob.dec.wsgify
 def fake_wsgi(self, req):
-    req.environ['nova.context'] = context.RequestContext(1, 1)
     return self.application
 
 
-def wsgi_app(inner_app10=None, inner_app11=None):
+def wsgi_app(inner_app10=None, inner_app11=None, fake_auth=True):
     if not inner_app10:
         inner_app10 = openstack.APIRouterV10()
     if not inner_app11:
         inner_app11 = openstack.APIRouterV11()
-    mapper = urlmap.URLMap()
-    api10 = openstack.FaultWrapper(auth.AuthMiddleware(
+
+    if fake_auth:
+        ctxt = context.RequestContext('fake', 'fake')
+        api10 = openstack.FaultWrapper(wsgi.InjectContext(ctxt,
               limits.RateLimitingMiddleware(inner_app10)))
-    api11 = openstack.FaultWrapper(auth.AuthMiddleware(
+        api11 = openstack.FaultWrapper(wsgi.InjectContext(ctxt,
               limits.RateLimitingMiddleware(
                   extensions.ExtensionMiddleware(inner_app11))))
+    else:
+        api10 = openstack.FaultWrapper(auth.AuthMiddleware(
+              limits.RateLimitingMiddleware(inner_app10)))
+        api11 = openstack.FaultWrapper(auth.AuthMiddleware(
+              limits.RateLimitingMiddleware(
+                  extensions.ExtensionMiddleware(inner_app11))))
+        Auth = auth
+    mapper = urlmap.URLMap()
     mapper['/v1.0'] = api10
     mapper['/v1.1'] = api11
     mapper['/'] = openstack.FaultWrapper(versions.Versions())
@@ -359,17 +368,18 @@ class FakeAuthManager(object):
             if admin is not None:
                 user.admin = admin
 
-    def is_admin(self, user):
+    def is_admin(self, user_id):
+        user = self.get_user(user_id)
         return user.admin
 
-    def is_project_member(self, user, project):
+    def is_project_member(self, user_id, project):
         if not isinstance(project, Project):
             try:
                 project = self.get_project(project)
             except exc.NotFound:
                 raise webob.exc.HTTPUnauthorized()
-        return ((user.id in project.member_ids) or
-                (user.id == project.project_manager_id))
+        return ((user_id in project.member_ids) or
+                (user_id == project.project_manager_id))
 
     def create_project(self, name, manager_user, description=None,
                        member_users=None):
@@ -396,13 +406,13 @@ class FakeAuthManager(object):
         else:
             raise exc.NotFound
 
-    def get_projects(self, user=None):
-        if not user:
+    def get_projects(self, user_id=None):
+        if not user_id:
             return FakeAuthManager.projects.values()
         else:
             return [p for p in FakeAuthManager.projects.values()
-                    if (user.id in p.member_ids) or
-                       (user.id == p.project_manager_id)]
+                    if (user_id in p.member_ids) or
+                       (user_id == p.project_manager_id)]
 
 
 class FakeRateLimiter(object):
diff --git a/nova/tests/api/openstack/test_auth.py b/nova/tests/api/openstack/test_auth.py
index 25fd2e8c5f22..1b1d443689f2 100644
--- a/nova/tests/api/openstack/test_auth.py
+++ b/nova/tests/api/openstack/test_auth.py
@@ -34,7 +34,6 @@ class Test(test.TestCase):
 
     def setUp(self):
         super(Test, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
         self.stubs.Set(nova.api.openstack.auth.AuthMiddleware,
             '__init__', fakes.fake_auth_init)
         self.stubs.Set(context, 'RequestContext', fakes.FakeRequestContext)
@@ -56,7 +55,7 @@ class Test(test.TestCase):
         req = webob.Request.blank('/v1.0/')
         req.headers['X-Auth-User'] = 'user1'
         req.headers['X-Auth-Key'] = 'user1_key'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '204 No Content')
         self.assertEqual(len(result.headers['X-Auth-Token']), 40)
         self.assertEqual(result.headers['X-CDN-Management-Url'],
@@ -72,7 +71,7 @@ class Test(test.TestCase):
         req = webob.Request.blank('/v1.0/', {'HTTP_HOST': 'foo'})
         req.headers['X-Auth-User'] = 'user1'
         req.headers['X-Auth-Key'] = 'user1_key'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '204 No Content')
         self.assertEqual(len(result.headers['X-Auth-Token']), 40)
         self.assertEqual(result.headers['X-Server-Management-Url'],
@@ -85,7 +84,7 @@ class Test(test.TestCase):
         self.stubs.Set(nova.api.openstack, 'APIRouterV10', fakes.FakeRouter)
         req = webob.Request.blank('/v1.0/fake')
         req.headers['X-Auth-Token'] = token
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '200 OK')
         self.assertEqual(result.headers['X-Test-Success'], 'True')
 
@@ -109,7 +108,7 @@ class Test(test.TestCase):
 
         req = webob.Request.blank('/v1.0/')
         req.headers['X-Auth-Token'] = 'token_hash'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '401 Unauthorized')
         self.assertEqual(self.destroy_called, True)
 
@@ -123,7 +122,7 @@ class Test(test.TestCase):
         req = webob.Request.blank('/v1.0/', {'HTTP_HOST': 'foo'})
         req.headers['X-Auth-User'] = 'user1'
         req.headers['X-Auth-Key'] = 'user1_key'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '204 No Content')
 
         token = result.headers['X-Auth-Token']
@@ -131,7 +130,7 @@ class Test(test.TestCase):
         req = webob.Request.blank('/v1.0/fake')
         req.headers['X-Auth-Token'] = token
         req.headers['X-Auth-Project-Id'] = 'user2_project'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '200 OK')
         self.assertEqual(result.headers['X-Test-Success'], 'True')
 
@@ -139,7 +138,7 @@ class Test(test.TestCase):
         req = webob.Request.blank('/v1.0/')
         req.headers['X-Auth-User'] = 'unknown_user'
         req.headers['X-Auth-Key'] = 'unknown_user_key'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '401 Unauthorized')
 
     def test_bad_user_good_key(self):
@@ -150,18 +149,18 @@ class Test(test.TestCase):
         req = webob.Request.blank('/v1.0/')
         req.headers['X-Auth-User'] = 'unknown_user'
         req.headers['X-Auth-Key'] = 'user1_key'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '401 Unauthorized')
 
     def test_no_user(self):
         req = webob.Request.blank('/v1.0/')
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '401 Unauthorized')
 
     def test_bad_token(self):
         req = webob.Request.blank('/v1.0/')
         req.headers['X-Auth-Token'] = 'unknown_token'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '401 Unauthorized')
 
     def test_bad_project(self):
@@ -176,7 +175,7 @@ class Test(test.TestCase):
         req = webob.Request.blank('/v1.0/', {'HTTP_HOST': 'foo'})
         req.headers['X-Auth-User'] = 'user1'
         req.headers['X-Auth-Key'] = 'user1_key'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '204 No Content')
 
         token = result.headers['X-Auth-Token']
@@ -184,7 +183,7 @@ class Test(test.TestCase):
         req = webob.Request.blank('/v1.0/fake')
         req.headers['X-Auth-Token'] = token
         req.headers['X-Auth-Project-Id'] = 'user2_project'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '401 Unauthorized')
 
     def test_not_existing_project(self):
@@ -196,7 +195,7 @@ class Test(test.TestCase):
         req = webob.Request.blank('/v1.0/', {'HTTP_HOST': 'foo'})
         req.headers['X-Auth-User'] = 'user1'
         req.headers['X-Auth-Key'] = 'user1_key'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '204 No Content')
 
         token = result.headers['X-Auth-Token']
@@ -204,7 +203,7 @@ class Test(test.TestCase):
         req = webob.Request.blank('/v1.0/fake')
         req.headers['X-Auth-Token'] = token
         req.headers['X-Auth-Project-Id'] = 'unknown_project'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '401 Unauthorized')
 
 
@@ -225,13 +224,13 @@ class TestFunctional(test.TestCase):
 
         req = webob.Request.blank('/v1.0/')
         req.headers['X-Auth-Token'] = 'test_token_hash'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '401 Unauthorized')
 
     def test_token_doesnotexist(self):
         req = webob.Request.blank('/v1.0/')
         req.headers['X-Auth-Token'] = 'nonexistant_token_hash'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '401 Unauthorized')
 
 
@@ -260,7 +259,7 @@ class TestLimiter(test.TestCase):
         req = webob.Request.blank('/v1.0/')
         req.headers['X-Auth-User'] = 'user1'
         req.headers['X-Auth-Key'] = 'user1_key'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(len(result.headers['X-Auth-Token']), 40)
 
         token = result.headers['X-Auth-Token']
@@ -268,6 +267,6 @@ class TestLimiter(test.TestCase):
         req = webob.Request.blank('/v1.0/fake')
         req.method = 'POST'
         req.headers['X-Auth-Token'] = token
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '200 OK')
         self.assertEqual(result.headers['X-Test-Success'], 'True')
diff --git a/nova/tests/api/openstack/test_extensions.py b/nova/tests/api/openstack/test_extensions.py
index 697c62e5cd5f..0a5603fc3940 100644
--- a/nova/tests/api/openstack/test_extensions.py
+++ b/nova/tests/api/openstack/test_extensions.py
@@ -16,13 +16,12 @@
 #    under the License.
 
 import json
-import stubout
-import unittest
 import webob
 import os.path
 
 from nova import context
 from nova import flags
+from nova import test
 from nova.api import openstack
 from nova.api.openstack import extensions
 from nova.api.openstack import flavors
@@ -78,7 +77,7 @@ class StubExtensionManager(object):
         return request_extensions
 
 
-class ExtensionControllerTest(unittest.TestCase):
+class ExtensionControllerTest(test.TestCase):
 
     def test_index(self):
         app = openstack.APIRouterV11()
@@ -95,7 +94,7 @@ class ExtensionControllerTest(unittest.TestCase):
         self.assertEqual(200, response.status_int)
 
 
-class ResourceExtensionTest(unittest.TestCase):
+class ResourceExtensionTest(test.TestCase):
 
     def test_no_extension_present(self):
         manager = StubExtensionManager(None)
@@ -133,13 +132,14 @@ class InvalidExtension(object):
         return "THIRD"
 
 
-class ExtensionManagerTest(unittest.TestCase):
+class ExtensionManagerTest(test.TestCase):
 
     response_body = "Try to say this Mr. Knox, sir..."
 
     def setUp(self):
-        FLAGS.osapi_extensions_path = os.path.join(os.path.dirname(__file__),
-                                                    "extensions")
+        super(ExtensionManagerTest, self).setUp()
+        ext_path = os.path.join(os.path.dirname(__file__), "extensions")
+        self.flags(osapi_extensions_path=ext_path)
 
     def test_get_resources(self):
         app = openstack.APIRouterV11()
@@ -158,11 +158,12 @@ class ExtensionManagerTest(unittest.TestCase):
         self.assertTrue('THIRD' not in ext_mgr.extensions)
 
 
-class ActionExtensionTest(unittest.TestCase):
+class ActionExtensionTest(test.TestCase):
 
     def setUp(self):
-        FLAGS.osapi_extensions_path = os.path.join(os.path.dirname(__file__),
-                                                    "extensions")
+        super(ActionExtensionTest, self).setUp()
+        ext_path = os.path.join(os.path.dirname(__file__), "extensions")
+        self.flags(osapi_extensions_path=ext_path)
 
     def _send_server_action_request(self, url, body):
         app = openstack.APIRouterV11()
@@ -196,20 +197,14 @@ class ActionExtensionTest(unittest.TestCase):
         self.assertEqual(404, response.status_int)
 
 
-class RequestExtensionTest(unittest.TestCase):
+class RequestExtensionTest(test.TestCase):
 
     def setUp(self):
         super(RequestExtensionTest, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
         fakes.FakeAuthManager.reset_fake_data()
         fakes.FakeAuthDatabase.data = {}
-        fakes.stub_out_auth(self.stubs)
         self.context = context.get_admin_context()
 
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        super(RequestExtensionTest, self).tearDown()
-
     def test_get_resources_with_stub_mgr(self):
 
         def _req_handler(req, res):
diff --git a/nova/tests/api/openstack/extensions/test_flavors_extra_specs.py b/nova/tests/api/openstack/test_flavors_extra_specs.py
similarity index 74%
rename from nova/tests/api/openstack/extensions/test_flavors_extra_specs.py
rename to nova/tests/api/openstack/test_flavors_extra_specs.py
index 2c1c335b057a..d386958db4e6 100644
--- a/nova/tests/api/openstack/extensions/test_flavors_extra_specs.py
+++ b/nova/tests/api/openstack/test_flavors_extra_specs.py
@@ -17,14 +17,13 @@
 
 import json
 import stubout
-import unittest
 import webob
 import os.path
 
 
 from nova import flags
+from nova import test
 from nova.api import openstack
-from nova.api.openstack import auth
 from nova.api.openstack import extensions
 from nova.tests.api.openstack import fakes
 import nova.wsgi
@@ -40,10 +39,6 @@ def return_flavor_extra_specs(context, flavor_id):
     return stub_flavor_extra_specs()
 
 
-def return_flavor_extra_specs(context, flavor_id):
-    return stub_flavor_extra_specs()
-
-
 def return_empty_flavor_extra_specs(context, flavor_id):
     return {}
 
@@ -62,30 +57,17 @@ def stub_flavor_extra_specs():
     return specs
 
 
-class FlavorsExtraSpecsTest(unittest.TestCase):
+class FlavorsExtraSpecsTest(test.TestCase):
 
     def setUp(self):
         super(FlavorsExtraSpecsTest, self).setUp()
-        FLAGS.osapi_extensions_path = os.path.join(os.path.dirname(__file__),
-                                                    "extensions")
-        self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.auth_data = {}
-        fakes.FakeAuthDatabase.data = {}
-        fakes.stub_out_auth(self.stubs)
         fakes.stub_out_key_pair_funcs(self.stubs)
-        self.mware = auth.AuthMiddleware(
-                      extensions.ExtensionMiddleware(
-                      openstack.APIRouterV11()))
-
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        super(FlavorsExtraSpecsTest, self).tearDown()
 
     def test_index(self):
         self.stubs.Set(nova.db.api, 'instance_type_extra_specs_get',
                        return_flavor_extra_specs)
-        request = webob.Request.blank('/flavors/1/os-extra_specs')
-        res = request.get_response(self.mware)
+        request = webob.Request.blank('/v1.1/flavors/1/os-extra_specs')
+        res = request.get_response(fakes.wsgi_app())
         self.assertEqual(200, res.status_int)
         res_dict = json.loads(res.body)
         self.assertEqual('application/json', res.headers['Content-Type'])
@@ -94,8 +76,8 @@ class FlavorsExtraSpecsTest(unittest.TestCase):
     def test_index_no_data(self):
         self.stubs.Set(nova.db.api, 'instance_type_extra_specs_get',
                        return_empty_flavor_extra_specs)
-        req = webob.Request.blank('/flavors/1/os-extra_specs')
-        res = req.get_response(self.mware)
+        req = webob.Request.blank('/v1.1/flavors/1/os-extra_specs')
+        res = req.get_response(fakes.wsgi_app())
         res_dict = json.loads(res.body)
         self.assertEqual(200, res.status_int)
         self.assertEqual('application/json', res.headers['Content-Type'])
@@ -104,8 +86,8 @@ class FlavorsExtraSpecsTest(unittest.TestCase):
     def test_show(self):
         self.stubs.Set(nova.db.api, 'instance_type_extra_specs_get',
                        return_flavor_extra_specs)
-        req = webob.Request.blank('/flavors/1/os-extra_specs/key5')
-        res = req.get_response(self.mware)
+        req = webob.Request.blank('/v1.1/flavors/1/os-extra_specs/key5')
+        res = req.get_response(fakes.wsgi_app())
         self.assertEqual(200, res.status_int)
         res_dict = json.loads(res.body)
         self.assertEqual('application/json', res.headers['Content-Type'])
@@ -114,28 +96,28 @@ class FlavorsExtraSpecsTest(unittest.TestCase):
     def test_show_spec_not_found(self):
         self.stubs.Set(nova.db.api, 'instance_type_extra_specs_get',
                        return_empty_flavor_extra_specs)
-        req = webob.Request.blank('/flavors/1/os-extra_specs/key6')
-        res = req.get_response(self.mware)
+        req = webob.Request.blank('/v1.1/flavors/1/os-extra_specs/key6')
+        res = req.get_response(fakes.wsgi_app())
         res_dict = json.loads(res.body)
         self.assertEqual(404, res.status_int)
 
     def test_delete(self):
         self.stubs.Set(nova.db.api, 'instance_type_extra_specs_delete',
                        delete_flavor_extra_specs)
-        req = webob.Request.blank('/flavors/1/os-extra_specs/key5')
+        req = webob.Request.blank('/v1.1/flavors/1/os-extra_specs/key5')
         req.method = 'DELETE'
-        res = req.get_response(self.mware)
+        res = req.get_response(fakes.wsgi_app())
         self.assertEqual(200, res.status_int)
 
     def test_create(self):
         self.stubs.Set(nova.db.api,
                        'instance_type_extra_specs_update_or_create',
                        return_create_flavor_extra_specs)
-        req = webob.Request.blank('/flavors/1/os-extra_specs')
+        req = webob.Request.blank('/v1.1/flavors/1/os-extra_specs')
         req.method = 'POST'
         req.body = '{"extra_specs": {"key1": "value1"}}'
         req.headers["content-type"] = "application/json"
-        res = req.get_response(self.mware)
+        res = req.get_response(fakes.wsgi_app())
         res_dict = json.loads(res.body)
         self.assertEqual(200, res.status_int)
         self.assertEqual('application/json', res.headers['Content-Type'])
@@ -145,21 +127,21 @@ class FlavorsExtraSpecsTest(unittest.TestCase):
         self.stubs.Set(nova.db.api,
                        'instance_type_extra_specs_update_or_create',
                        return_create_flavor_extra_specs)
-        req = webob.Request.blank('/flavors/1/os-extra_specs')
+        req = webob.Request.blank('/v1.1/flavors/1/os-extra_specs')
         req.method = 'POST'
         req.headers["content-type"] = "application/json"
-        res = req.get_response(self.mware)
+        res = req.get_response(fakes.wsgi_app())
         self.assertEqual(400, res.status_int)
 
     def test_update_item(self):
         self.stubs.Set(nova.db.api,
                        'instance_type_extra_specs_update_or_create',
                        return_create_flavor_extra_specs)
-        req = webob.Request.blank('/flavors/1/os-extra_specs/key1')
+        req = webob.Request.blank('/v1.1/flavors/1/os-extra_specs/key1')
         req.method = 'PUT'
         req.body = '{"key1": "value1"}'
         req.headers["content-type"] = "application/json"
-        res = req.get_response(self.mware)
+        res = req.get_response(fakes.wsgi_app())
         self.assertEqual(200, res.status_int)
         self.assertEqual('application/json', res.headers['Content-Type'])
         res_dict = json.loads(res.body)
@@ -169,30 +151,30 @@ class FlavorsExtraSpecsTest(unittest.TestCase):
         self.stubs.Set(nova.db.api,
                        'instance_type_extra_specs_update_or_create',
                        return_create_flavor_extra_specs)
-        req = webob.Request.blank('/flavors/1/os-extra_specs/key1')
+        req = webob.Request.blank('/v1.1/flavors/1/os-extra_specs/key1')
         req.method = 'PUT'
         req.headers["content-type"] = "application/json"
-        res = req.get_response(self.mware)
+        res = req.get_response(fakes.wsgi_app())
         self.assertEqual(400, res.status_int)
 
     def test_update_item_too_many_keys(self):
         self.stubs.Set(nova.db.api,
                        'instance_type_extra_specs_update_or_create',
                        return_create_flavor_extra_specs)
-        req = webob.Request.blank('/flavors/1/os-extra_specs/key1')
+        req = webob.Request.blank('/v1.1/flavors/1/os-extra_specs/key1')
         req.method = 'PUT'
         req.body = '{"key1": "value1", "key2": "value2"}'
         req.headers["content-type"] = "application/json"
-        res = req.get_response(self.mware)
+        res = req.get_response(fakes.wsgi_app())
         self.assertEqual(400, res.status_int)
 
     def test_update_item_body_uri_mismatch(self):
         self.stubs.Set(nova.db.api,
                        'instance_type_extra_specs_update_or_create',
                        return_create_flavor_extra_specs)
-        req = webob.Request.blank('/flavors/1/os-extra_specs/bad')
+        req = webob.Request.blank('/v1.1/flavors/1/os-extra_specs/bad')
         req.method = 'PUT'
         req.body = '{"key1": "value1"}'
         req.headers["content-type"] = "application/json"
-        res = req.get_response(self.mware)
+        res = req.get_response(fakes.wsgi_app())
         self.assertEqual(400, res.status_int)
diff --git a/nova/tests/api/openstack/test_images.py b/nova/tests/api/openstack/test_images.py
index 17f2fb75545f..3f42bc1dbe55 100644
--- a/nova/tests/api/openstack/test_images.py
+++ b/nova/tests/api/openstack/test_images.py
@@ -155,7 +155,7 @@ class GlanceImageServiceTest(_BaseImageServiceTests):
         fakes.stub_out_compute_api_snapshot(self.stubs)
         service_class = 'nova.image.glance.GlanceImageService'
         self.service = utils.import_object(service_class)
-        self.context = context.RequestContext(1, None)
+        self.context = context.RequestContext('fake', 'fake')
         self.service.delete_all()
         self.sent_to_glance = {}
         fakes.stub_out_glance_add_image(self.stubs, self.sent_to_glance)
@@ -168,7 +168,7 @@ class GlanceImageServiceTest(_BaseImageServiceTests):
         """Ensure instance_id is persisted as an image-property"""
         fixture = {'name': 'test image',
                    'is_public': False,
-                   'properties': {'instance_id': '42', 'user_id': '1'}}
+                   'properties': {'instance_id': '42', 'user_id': 'fake'}}
 
         image_id = self.service.create(self.context, fixture)['id']
         expected = fixture
@@ -178,7 +178,7 @@ class GlanceImageServiceTest(_BaseImageServiceTests):
         expected = {'id': image_id,
                     'name': 'test image',
                     'is_public': False,
-                    'properties': {'instance_id': '42', 'user_id': '1'}}
+                    'properties': {'instance_id': '42', 'user_id': 'fake'}}
         self.assertDictMatch(image_meta, expected)
 
         image_metas = self.service.detail(self.context)
@@ -331,11 +331,8 @@ class ImageControllerWithGlanceServiceTest(test.TestCase):
         self.orig_image_service = FLAGS.image_service
         FLAGS.image_service = 'nova.image.glance.GlanceImageService'
         self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.reset_fake_data()
-        fakes.FakeAuthDatabase.data = {}
         fakes.stub_out_networking(self.stubs)
         fakes.stub_out_rate_limiting(self.stubs)
-        fakes.stub_out_auth(self.stubs)
         fakes.stub_out_key_pair_funcs(self.stubs)
         self.fixtures = self._make_image_fixtures()
         fakes.stub_out_glance(self.stubs, initial_fixtures=self.fixtures)
@@ -352,7 +349,7 @@ class ImageControllerWithGlanceServiceTest(test.TestCase):
         """Determine if this fixture is applicable for given user id."""
         is_public = fixture["is_public"]
         try:
-            uid = int(fixture["properties"]["user_id"])
+            uid = fixture["properties"]["user_id"]
         except KeyError:
             uid = None
         return uid == user_id or is_public
@@ -424,7 +421,7 @@ class ImageControllerWithGlanceServiceTest(test.TestCase):
                 },
                 "metadata": {
                     "instance_ref": "http://localhost/v1.1/servers/42",
-                    "user_id": "1",
+                    "user_id": "fake",
                 },
                 "links": [{
                     "rel": "self",
@@ -559,7 +556,7 @@ class ImageControllerWithGlanceServiceTest(test.TestCase):
         fixtures = copy.copy(self.fixtures)
 
         for image in fixtures:
-            if not self._applicable_fixture(image, 1):
+            if not self._applicable_fixture(image, "fake"):
                 fixtures.remove(image)
                 continue
 
@@ -666,7 +663,7 @@ class ImageControllerWithGlanceServiceTest(test.TestCase):
             'name': 'queued snapshot',
             'metadata': {
                 u'instance_ref': u'http://localhost/v1.1/servers/42',
-                u'user_id': u'1',
+                u'user_id': u'fake',
             },
             'updated': self.NOW_API_FORMAT,
             'created': self.NOW_API_FORMAT,
@@ -696,7 +693,7 @@ class ImageControllerWithGlanceServiceTest(test.TestCase):
             'name': 'saving snapshot',
             'metadata': {
                 u'instance_ref': u'http://localhost/v1.1/servers/42',
-                u'user_id': u'1',
+                u'user_id': u'fake',
             },
             'updated': self.NOW_API_FORMAT,
             'created': self.NOW_API_FORMAT,
@@ -727,7 +724,7 @@ class ImageControllerWithGlanceServiceTest(test.TestCase):
             'name': 'active snapshot',
             'metadata': {
                 u'instance_ref': u'http://localhost/v1.1/servers/42',
-                u'user_id': u'1',
+                u'user_id': u'fake',
             },
             'updated': self.NOW_API_FORMAT,
             'created': self.NOW_API_FORMAT,
@@ -757,7 +754,7 @@ class ImageControllerWithGlanceServiceTest(test.TestCase):
             'name': 'killed snapshot',
             'metadata': {
                 u'instance_ref': u'http://localhost/v1.1/servers/42',
-                u'user_id': u'1',
+                u'user_id': u'fake',
             },
             'updated': self.NOW_API_FORMAT,
             'created': self.NOW_API_FORMAT,
@@ -1259,7 +1256,7 @@ class ImageControllerWithGlanceServiceTest(test.TestCase):
 
         # Snapshot for User 1
         server_ref = 'http://localhost/v1.1/servers/42'
-        snapshot_properties = {'instance_ref': server_ref, 'user_id': '1'}
+        snapshot_properties = {'instance_ref': server_ref, 'user_id': 'fake'}
         for status in ('queued', 'saving', 'active', 'killed'):
             add_fixture(id=image_id, name='%s snapshot' % status,
                         is_public=False, status=status,
@@ -1267,7 +1264,7 @@ class ImageControllerWithGlanceServiceTest(test.TestCase):
             image_id += 1
 
         # Snapshot for User 2
-        other_snapshot_properties = {'instance_id': '43', 'user_id': '2'}
+        other_snapshot_properties = {'instance_id': '43', 'user_id': 'other'}
         add_fixture(id=image_id, name='someone elses snapshot',
                     is_public=False, status='active',
                     properties=other_snapshot_properties)
diff --git a/nova/tests/api/openstack/test_servers.py b/nova/tests/api/openstack/test_servers.py
index 3fc38b73c383..e0456781abc4 100644
--- a/nova/tests/api/openstack/test_servers.py
+++ b/nova/tests/api/openstack/test_servers.py
@@ -96,8 +96,8 @@ def return_server_with_power_state(power_state):
     return _return_server
 
 
-def return_servers(context, user_id=1):
-    return [stub_instance(i, user_id) for i in xrange(5)]
+def return_servers(context, *args, **kwargs):
+    return [stub_instance(i, 'fake', 'fake') for i in xrange(5)]
 
 
 def return_servers_by_reservation(context, reservation_id=""):
@@ -140,9 +140,9 @@ def instance_addresses(context, instance_id):
     return None
 
 
-def stub_instance(id, user_id=1, private_address=None, public_addresses=None,
-                  host=None, power_state=0, reservation_id="",
-                  uuid=FAKE_UUID, interfaces=None):
+def stub_instance(id, user_id='fake', project_id='fake', private_address=None,
+                  public_addresses=None, host=None, power_state=0,
+                  reservation_id="", uuid=FAKE_UUID, interfaces=None):
     metadata = []
     metadata.append(InstanceMetadata(key='seq', value=id))
 
@@ -166,7 +166,7 @@ def stub_instance(id, user_id=1, private_address=None, public_addresses=None,
         "id": int(id),
         "admin_pass": "",
         "user_id": user_id,
-        "project_id": "",
+        "project_id": project_id,
         "image_ref": "10",
         "kernel_id": "",
         "ramdisk_id": "",
@@ -225,11 +225,9 @@ class ServersTest(test.TestCase):
     def setUp(self):
         super(ServersTest, self).setUp()
         self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.reset_fake_data()
         fakes.FakeAuthDatabase.data = {}
         fakes.stub_out_networking(self.stubs)
         fakes.stub_out_rate_limiting(self.stubs)
-        fakes.stub_out_auth(self.stubs)
         fakes.stub_out_key_pair_funcs(self.stubs)
         fakes.stub_out_image_service(self.stubs)
         self.stubs.Set(utils, 'gen_uuid', fake_gen_uuid)
@@ -237,7 +235,7 @@ class ServersTest(test.TestCase):
         self.stubs.Set(nova.db.api, 'instance_get', return_server_by_id)
         self.stubs.Set(nova.db, 'instance_get_by_uuid',
                        return_server_by_uuid)
-        self.stubs.Set(nova.db.api, 'instance_get_all_by_user',
+        self.stubs.Set(nova.db.api, 'instance_get_all_by_project',
                        return_servers)
         self.stubs.Set(nova.db.api, 'instance_add_security_group',
                        return_security_group)
@@ -636,6 +634,7 @@ class ServersTest(test.TestCase):
         res = req.get_response(fakes.wsgi_app())
         res_dict = json.loads(res.body)
 
+        self.assertEqual(len(res_dict['servers']), 5)
         i = 0
         for s in res_dict['servers']:
             self.assertEqual(s['id'], i)
@@ -699,23 +698,24 @@ class ServersTest(test.TestCase):
         res = req.get_response(fakes.wsgi_app())
         res_dict = json.loads(res.body)
 
+        self.assertEqual(len(res_dict['servers']), 5)
         for i, s in enumerate(res_dict['servers']):
             self.assertEqual(s['id'], i)
             self.assertEqual(s['name'], 'server%d' % i)
             self.assertEqual(s.get('imageId', None), None)
 
             expected_links = [
-            {
-                "rel": "self",
-                "href": "http://localhost/v1.1/servers/%d" % (i,),
-            },
-            {
-                "rel": "bookmark",
-                "href": "http://localhost/servers/%d" % (i,),
-            },
-        ]
+                {
+                    "rel": "self",
+                    "href": "http://localhost/v1.1/servers/%d" % (i,),
+                },
+                {
+                    "rel": "bookmark",
+                    "href": "http://localhost/servers/%d" % (i,),
+                },
+            ]
 
-        self.assertEqual(s['links'], expected_links)
+            self.assertEqual(s['links'], expected_links)
 
     def test_get_servers_with_limit(self):
         req = webob.Request.blank('/v1.0/servers?limit=3')
@@ -1282,10 +1282,10 @@ class ServersTest(test.TestCase):
         instances - 2 on one host and 3 on another.
         '''
 
-        def return_servers_with_host(context, user_id=1):
-            return [stub_instance(i, 1, None, None, i % 2) for i in xrange(5)]
+        def return_servers_with_host(context, *args, **kwargs):
+            return [stub_instance(i, 'fake', 'fake', None, None, i % 2) for i in xrange(5)]
 
-        self.stubs.Set(nova.db.api, 'instance_get_all_by_user',
+        self.stubs.Set(nova.db.api, 'instance_get_all_by_project',
             return_servers_with_host)
 
         req = webob.Request.blank('/v1.0/servers/detail')
@@ -2161,7 +2161,6 @@ class TestServerInstanceCreation(test.TestCase):
     def setUp(self):
         super(TestServerInstanceCreation, self).setUp()
         self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.auth_data = {}
         fakes.FakeAuthDatabase.data = {}
         fakes.stub_out_auth(self.stubs)
         fakes.stub_out_image_service(self.stubs)
diff --git a/nova/tests/test_access.py b/nova/tests/test_access.py
index 6069c5d71c0e..39558b1cf88b 100644
--- a/nova/tests/test_access.py
+++ b/nova/tests/test_access.py
@@ -41,7 +41,7 @@ class FakeApiRequest(object):
 class AccessTestCase(test.TestCase):
     def _env_for(self, ctxt, action):
         env = {}
-        env['ec2.context'] = ctxt
+        env['nova.context'] = ctxt
         env['ec2.request'] = FakeApiRequest(action)
         return env
 
diff --git a/nova/tests/test_api.py b/nova/tests/test_api.py
index 978e43abd80c..292f9d668a6f 100644
--- a/nova/tests/test_api.py
+++ b/nova/tests/test_api.py
@@ -30,6 +30,7 @@ import webob
 from nova import context
 from nova import exception
 from nova import test
+from nova import wsgi
 from nova.api import ec2
 from nova.api.ec2 import apirequest
 from nova.api.ec2 import cloud
@@ -195,7 +196,7 @@ class ApiEc2TestCase(test.TestCase):
         # NOTE(vish): skipping the Authorizer
         roles = ['sysadmin', 'netadmin']
         ctxt = context.RequestContext('fake', 'fake', roles=roles)
-        self.app = ec2.InjectContext(ctxt,
+        self.app = wsgi.InjectContext(ctxt,
                 ec2.Requestify(ec2.Authorizer(ec2.Executor()),
                                'nova.api.ec2.cloud.CloudController'))
 
diff --git a/nova/wsgi.py b/nova/wsgi.py
index eae3afcb4a81..c8ddb97d7f0c 100644
--- a/nova/wsgi.py
+++ b/nova/wsgi.py
@@ -274,6 +274,18 @@ class Middleware(Application):
         return self.process_response(response)
 
 
+class InjectContext(Middleware):
+    """Add a 'nova.context' to WSGI environ."""
+    def __init__(self, context, *args, **kwargs):
+        self.context = context
+        super(InjectContext, self).__init__(*args, **kwargs)
+
+    @webob.dec.wsgify(RequestClass=Request)
+    def __call__(self, req):
+        req.environ['nova.context'] = self.context
+        return self.application
+
+
 class Debug(Middleware):
     """Helper class for debugging a WSGI application.
 

From f9fb313ca2acaf2fd491d5b695381846969b132c Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@gmail.com>
Date: Fri, 22 Jul 2011 19:54:11 +0000
Subject: [PATCH 05/17] fix extensions tests

---
 nova/tests/api/openstack/test_extensions.py | 15 ++++++++++++---
 1 file changed, 12 insertions(+), 3 deletions(-)

diff --git a/nova/tests/api/openstack/test_extensions.py b/nova/tests/api/openstack/test_extensions.py
index 0a5603fc3940..0e709d3af9d4 100644
--- a/nova/tests/api/openstack/test_extensions.py
+++ b/nova/tests/api/openstack/test_extensions.py
@@ -79,6 +79,11 @@ class StubExtensionManager(object):
 
 class ExtensionControllerTest(test.TestCase):
 
+    def setUp(self):
+        super(ExtensionControllerTest, self).setUp()
+        ext_path = os.path.join(os.path.dirname(__file__), "extensions")
+        self.flags(osapi_extensions_path=ext_path)
+
     def test_index(self):
         app = openstack.APIRouterV11()
         ext_midware = extensions.ExtensionMiddleware(app)
@@ -96,6 +101,11 @@ class ExtensionControllerTest(test.TestCase):
 
 class ResourceExtensionTest(test.TestCase):
 
+    def setUp(self):
+        super(ResourceExtensionTest, self).setUp()
+        ext_path = os.path.join(os.path.dirname(__file__), "extensions")
+        self.flags(osapi_extensions_path=ext_path)
+
     def test_no_extension_present(self):
         manager = StubExtensionManager(None)
         app = openstack.APIRouterV11()
@@ -201,9 +211,8 @@ class RequestExtensionTest(test.TestCase):
 
     def setUp(self):
         super(RequestExtensionTest, self).setUp()
-        fakes.FakeAuthManager.reset_fake_data()
-        fakes.FakeAuthDatabase.data = {}
-        self.context = context.get_admin_context()
+        ext_path = os.path.join(os.path.dirname(__file__), "extensions")
+        self.flags(osapi_extensions_path=ext_path)
 
     def test_get_resources_with_stub_mgr(self):
 

From 0f8eee7ff32a91c866742939b1f551f3610f1276 Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@gmail.com>
Date: Fri, 22 Jul 2011 20:20:31 +0000
Subject: [PATCH 06/17] fix auth tests

---
 nova/api/openstack/auth.py |  2 +-
 nova/auth/manager.py       |  2 +-
 nova/tests/test_auth.py    | 19 +++++++++----------
 3 files changed, 11 insertions(+), 12 deletions(-)

diff --git a/nova/api/openstack/auth.py b/nova/api/openstack/auth.py
index 9caa14a4e3f3..d42abe1f865b 100644
--- a/nova/api/openstack/auth.py
+++ b/nova/api/openstack/auth.py
@@ -62,7 +62,7 @@ class AuthMiddleware(wsgi.Middleware):
             # while osapi clients don't use this header
             projects = self.auth.get_projects(user_id)
             if projects:
-                project_id = projects[0]
+                project_id = projects[0].id
             else:
                 return faults.Fault(webob.exc.HTTPUnauthorized())
 
diff --git a/nova/auth/manager.py b/nova/auth/manager.py
index b6131fb7faf6..06af7e781dac 100644
--- a/nova/auth/manager.py
+++ b/nova/auth/manager.py
@@ -785,7 +785,7 @@ class AuthManager(object):
         return read_buffer
 
     def get_environment_rc(self, user, project=None, use_dmz=True):
-        """Get credential zip for user in project"""
+        """Get environment rc for user in project"""
         if not isinstance(user, User):
             user = self.get_user(user)
         if project is None:
diff --git a/nova/tests/test_auth.py b/nova/tests/test_auth.py
index 71e0d17c9149..7c0f783bbd06 100644
--- a/nova/tests/test_auth.py
+++ b/nova/tests/test_auth.py
@@ -102,7 +102,7 @@ class _AuthManagerBaseTestCase(test.TestCase):
             self.assertEqual('classified', u.secret)
             self.assertEqual('private-party', u.access)
 
-    def test_004_signature_is_valid(self):
+    def test_signature_is_valid(self):
         with user_generator(self.manager, name='admin', secret='admin',
                             access='admin'):
             with project_generator(self.manager, name="admin",
@@ -141,15 +141,14 @@ class _AuthManagerBaseTestCase(test.TestCase):
                         '127.0.0.1',
                         '/services/Cloud'))
 
-    def test_005_can_get_credentials(self):
-        return
-        credentials = self.manager.get_user('test1').get_credentials()
-        self.assertEqual(credentials,
-        'export EC2_ACCESS_KEY="access"\n' +
-        'export EC2_SECRET_KEY="secret"\n' +
-        'export EC2_URL="http://127.0.0.1:8773/services/Cloud"\n' +
-        'export S3_URL="http://127.0.0.1:3333/"\n' +
-        'export EC2_USER_ID="test1"\n')
+    def test_can_get_credentials(self):
+        st = {'access': 'access', 'secret': 'secret'}
+        with user_and_project_generator(self.manager, user_state=st) as (u, p):
+            credentials = self.manager.get_environment_rc(u, p)
+            LOG.debug(credentials)
+            self.assertTrue('export EC2_ACCESS_KEY="access:testproj"\n'
+                            in credentials)
+            self.assertTrue('export EC2_SECRET_KEY="secret"\n' in credentials)
 
     def test_can_list_users(self):
         with user_generator(self.manager):

From e8defa6bdd5af85486d0d3acce8956670ca16882 Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@gmail.com>
Date: Fri, 22 Jul 2011 20:41:46 +0000
Subject: [PATCH 07/17] fix test_access

---
 nova/api/ec2/__init__.py  |  7 ++++++-
 nova/auth/manager.py      |  9 +++++++++
 nova/tests/test_access.py | 19 +++++++++----------
 3 files changed, 24 insertions(+), 11 deletions(-)

diff --git a/nova/api/ec2/__init__.py b/nova/api/ec2/__init__.py
index 0a743075ca4e..1ea26fdebcbc 100644
--- a/nova/api/ec2/__init__.py
+++ b/nova/api/ec2/__init__.py
@@ -156,8 +156,9 @@ class Authenticate(wsgi.Middleware):
         auth_params.pop('Signature')
 
         # Authenticate the request.
+        authman = manager.AuthManager()
         try:
-            (user, project) = manager.AuthManager().authenticate(
+            (user, project) = authman.authenticate(
                     access,
                     signature,
                     auth_params,
@@ -173,9 +174,12 @@ class Authenticate(wsgi.Middleware):
         remote_address = req.remote_addr
         if FLAGS.use_forwarded_for:
             remote_address = req.headers.get('X-Forwarded-For', remote_address)
+        roles = authman.get_active_roles(user, project)
+        LOG.warn(roles)
         ctxt = context.RequestContext(user_id=user.id,
                                       project_id=project.id,
                                       is_admin=user.is_admin(),
+                                      roles=roles,
                                       remote_address=remote_address)
         req.environ['nova.context'] = ctxt
         uname = user.name
@@ -295,6 +299,7 @@ class Authorizer(wsgi.Middleware):
 
     def _matches_any_role(self, context, roles):
         """Return True if any role in roles is allowed in context."""
+        LOG.info(context.roles)
         if context.is_admin:
             return True
         if 'all' in roles:
diff --git a/nova/auth/manager.py b/nova/auth/manager.py
index 06af7e781dac..7f99d9016394 100644
--- a/nova/auth/manager.py
+++ b/nova/auth/manager.py
@@ -518,6 +518,15 @@ class AuthManager(object):
             return drv.get_user_roles(User.safe_id(user),
                                       Project.safe_id(project))
 
+    def get_active_roles(self, user, project=None):
+        """Get all active roles for context"""
+        if project:
+            roles = FLAGS.allowed_roles
+            roles.append('projectmanager')
+        else:
+            roles = FLAGS.global_roles
+        return [role for role in roles if self.has_role(user, role, project)]
+
     def get_project(self, pid):
         """Get project object by id"""
         with self.driver() as drv:
diff --git a/nova/tests/test_access.py b/nova/tests/test_access.py
index 39558b1cf88b..3b54fc249152 100644
--- a/nova/tests/test_access.py
+++ b/nova/tests/test_access.py
@@ -16,7 +16,6 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import unittest
 import webob
 
 from nova import context
@@ -93,7 +92,11 @@ class AccessTestCase(test.TestCase):
         super(AccessTestCase, self).tearDown()
 
     def response_status(self, user, methodName):
-        ctxt = context.RequestContext(user.id, self.project.id)
+        roles = manager.AuthManager().get_active_roles(user, self.project)
+        ctxt = context.RequestContext(user.id,
+                                      self.project.id,
+                                      is_admin=user.is_admin(),
+                                      roles=roles)
         environ = self._env_for(ctxt, methodName)
         req = webob.Request.blank('/', environ)
         resp = req.get_response(self.mw)
@@ -105,30 +108,26 @@ class AccessTestCase(test.TestCase):
     def shouldDeny(self, user, methodName):
         self.assertEqual(401, self.response_status(user, methodName))
 
-    def test_001_allow_all(self):
+    def test_allow_all(self):
         users = [self.testadmin, self.testpmsys, self.testnet, self.testsys]
         for user in users:
             self.shouldAllow(user, '_allow_all')
 
-    def test_002_allow_none(self):
+    def test_allow_none(self):
         self.shouldAllow(self.testadmin, '_allow_none')
         users = [self.testpmsys, self.testnet, self.testsys]
         for user in users:
             self.shouldDeny(user, '_allow_none')
 
-    def test_003_allow_project_manager(self):
+    def test_allow_project_manager(self):
         for user in [self.testadmin, self.testpmsys]:
             self.shouldAllow(user, '_allow_project_manager')
         for user in [self.testnet, self.testsys]:
             self.shouldDeny(user, '_allow_project_manager')
 
-    def test_004_allow_sys_and_net(self):
+    def test_allow_sys_and_net(self):
         for user in [self.testadmin, self.testnet, self.testsys]:
             self.shouldAllow(user, '_allow_sys_and_net')
         # denied because it doesn't have the per project sysadmin
         for user in [self.testpmsys]:
             self.shouldDeny(user, '_allow_sys_and_net')
-
-if __name__ == "__main__":
-    # TODO: Implement use_fake as an option
-    unittest.main()

From ccb5119280d341a2ea1b3e8352acbf32b7f243af Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@gmail.com>
Date: Fri, 22 Jul 2011 21:36:41 +0000
Subject: [PATCH 08/17] clean up fake auth manager in other places

---
 nova/api/ec2/__init__.py                      |  2 -
 nova/auth/manager.py                          |  3 +-
 .../openstack/contrib/test_floating_ips.py    |  5 ---
 .../api/openstack/contrib/test_multinic_xs.py |  8 ----
 nova/tests/api/openstack/test_adminapi.py     | 17 +--------
 nova/tests/api/openstack/test_flavors.py      |  5 ---
 .../api/openstack/test_image_metadata.py      | 14 +------
 .../api/openstack/test_server_metadata.py     | 14 +------
 nova/tests/api/openstack/test_servers.py      | 38 +++++--------------
 .../api/openstack/test_shared_ip_groups.py    | 13 -------
 nova/tests/api/openstack/test_zones.py        | 24 ++----------
 nova/tests/test_objectstore.py                |  3 +-
 12 files changed, 21 insertions(+), 125 deletions(-)

diff --git a/nova/api/ec2/__init__.py b/nova/api/ec2/__init__.py
index 1ea26fdebcbc..af232edda361 100644
--- a/nova/api/ec2/__init__.py
+++ b/nova/api/ec2/__init__.py
@@ -175,7 +175,6 @@ class Authenticate(wsgi.Middleware):
         if FLAGS.use_forwarded_for:
             remote_address = req.headers.get('X-Forwarded-For', remote_address)
         roles = authman.get_active_roles(user, project)
-        LOG.warn(roles)
         ctxt = context.RequestContext(user_id=user.id,
                                       project_id=project.id,
                                       is_admin=user.is_admin(),
@@ -299,7 +298,6 @@ class Authorizer(wsgi.Middleware):
 
     def _matches_any_role(self, context, roles):
         """Return True if any role in roles is allowed in context."""
-        LOG.info(context.roles)
         if context.is_admin:
             return True
         if 'all' in roles:
diff --git a/nova/auth/manager.py b/nova/auth/manager.py
index 7f99d9016394..5118abba2372 100644
--- a/nova/auth/manager.py
+++ b/nova/auth/manager.py
@@ -521,8 +521,7 @@ class AuthManager(object):
     def get_active_roles(self, user, project=None):
         """Get all active roles for context"""
         if project:
-            roles = FLAGS.allowed_roles
-            roles.append('projectmanager')
+            roles = FLAGS.allowed_roles + ['projectmanager']
         else:
             roles = FLAGS.global_roles
         return [role for role in roles if self.has_role(user, role, project)]
diff --git a/nova/tests/api/openstack/contrib/test_floating_ips.py b/nova/tests/api/openstack/contrib/test_floating_ips.py
index de006d08864c..50ad7de084c4 100644
--- a/nova/tests/api/openstack/contrib/test_floating_ips.py
+++ b/nova/tests/api/openstack/contrib/test_floating_ips.py
@@ -74,12 +74,8 @@ class FloatingIpTest(test.TestCase):
     def setUp(self):
         super(FloatingIpTest, self).setUp()
         self.controller = FloatingIPController()
-        self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.reset_fake_data()
-        fakes.FakeAuthDatabase.data = {}
         fakes.stub_out_networking(self.stubs)
         fakes.stub_out_rate_limiting(self.stubs)
-        fakes.stub_out_auth(self.stubs)
         self.stubs.Set(network.api.API, "get_floating_ip",
                        network_api_get_floating_ip)
         self.stubs.Set(network.api.API, "list_floating_ips",
@@ -96,7 +92,6 @@ class FloatingIpTest(test.TestCase):
         self._create_floating_ip()
 
     def tearDown(self):
-        self.stubs.UnsetAll()
         self._delete_floating_ip()
         super(FloatingIpTest, self).tearDown()
 
diff --git a/nova/tests/api/openstack/contrib/test_multinic_xs.py b/nova/tests/api/openstack/contrib/test_multinic_xs.py
index b0a9f76766ee..ac28f6be6778 100644
--- a/nova/tests/api/openstack/contrib/test_multinic_xs.py
+++ b/nova/tests/api/openstack/contrib/test_multinic_xs.py
@@ -42,22 +42,14 @@ def compute_api_remove_fixed_ip(self, context, instance_id, address):
 class FixedIpTest(test.TestCase):
     def setUp(self):
         super(FixedIpTest, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.reset_fake_data()
-        fakes.FakeAuthDatabase.data = {}
         fakes.stub_out_networking(self.stubs)
         fakes.stub_out_rate_limiting(self.stubs)
-        fakes.stub_out_auth(self.stubs)
         self.stubs.Set(compute.api.API, "add_fixed_ip",
                        compute_api_add_fixed_ip)
         self.stubs.Set(compute.api.API, "remove_fixed_ip",
                        compute_api_remove_fixed_ip)
         self.context = context.get_admin_context()
 
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        super(FixedIpTest, self).tearDown()
-
     def test_add_fixed_ip(self):
         global last_add_fixed_ip
         last_add_fixed_ip = (None, None)
diff --git a/nova/tests/api/openstack/test_adminapi.py b/nova/tests/api/openstack/test_adminapi.py
index e87255b186df..b83de40cf2e5 100644
--- a/nova/tests/api/openstack/test_adminapi.py
+++ b/nova/tests/api/openstack/test_adminapi.py
@@ -16,14 +16,10 @@
 #    under the License.
 
 
-import stubout
 import webob
-from paste import urlmap
 
 from nova import flags
 from nova import test
-from nova.api import openstack
-from nova.api.openstack import auth
 from nova.tests.api.openstack import fakes
 
 FLAGS = flags.FLAGS
@@ -33,21 +29,12 @@ class AdminAPITest(test.TestCase):
 
     def setUp(self):
         super(AdminAPITest, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.reset_fake_data()
-        fakes.FakeAuthDatabase.data = {}
         fakes.stub_out_networking(self.stubs)
         fakes.stub_out_rate_limiting(self.stubs)
-        fakes.stub_out_auth(self.stubs)
         self.allow_admin = FLAGS.allow_admin_api
 
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        FLAGS.allow_admin_api = self.allow_admin
-        super(AdminAPITest, self).tearDown()
-
     def test_admin_enabled(self):
-        FLAGS.allow_admin_api = True
+        self.flags(allow_admin_api=True)
         # We should still be able to access public operations.
         req = webob.Request.blank('/v1.0/flavors')
         res = req.get_response(fakes.wsgi_app())
@@ -55,7 +42,7 @@ class AdminAPITest(test.TestCase):
         # TODO: Confirm admin operations are available.
 
     def test_admin_disabled(self):
-        FLAGS.allow_admin_api = False
+        self.flags(allow_admin_api=False)
         # We should still be able to access public operations.
         req = webob.Request.blank('/v1.0/flavors')
         res = req.get_response(fakes.wsgi_app())
diff --git a/nova/tests/api/openstack/test_flavors.py b/nova/tests/api/openstack/test_flavors.py
index 4ac35b26b160..d0fe72001f13 100644
--- a/nova/tests/api/openstack/test_flavors.py
+++ b/nova/tests/api/openstack/test_flavors.py
@@ -16,7 +16,6 @@
 #    under the License.
 
 import json
-import stubout
 import webob
 import xml.dom.minidom as minidom
 
@@ -56,12 +55,8 @@ def return_instance_type_not_found(context, flavor_id):
 class FlavorsTest(test.TestCase):
     def setUp(self):
         super(FlavorsTest, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.reset_fake_data()
-        fakes.FakeAuthDatabase.data = {}
         fakes.stub_out_networking(self.stubs)
         fakes.stub_out_rate_limiting(self.stubs)
-        fakes.stub_out_auth(self.stubs)
         self.stubs.Set(nova.db.api, "instance_type_get_all",
                        return_instance_types)
         self.stubs.Set(nova.db.api, "instance_type_get_by_flavor_id",
diff --git a/nova/tests/api/openstack/test_image_metadata.py b/nova/tests/api/openstack/test_image_metadata.py
index d9fb61e2a158..0e9d9fe55487 100644
--- a/nova/tests/api/openstack/test_image_metadata.py
+++ b/nova/tests/api/openstack/test_image_metadata.py
@@ -16,8 +16,6 @@
 #    under the License.
 
 import json
-import stubout
-import unittest
 import webob
 import xml.dom.minidom as minidom
 
@@ -85,23 +83,13 @@ class ImageMetaDataTest(test.TestCase):
 
     def setUp(self):
         super(ImageMetaDataTest, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
-        self.orig_image_service = FLAGS.image_service
-        FLAGS.image_service = 'nova.image.glance.GlanceImageService'
-        fakes.FakeAuthManager.auth_data = {}
-        fakes.FakeAuthDatabase.data = {}
-        fakes.stub_out_auth(self.stubs)
+        self.flags(image_service='nova.image.glance.GlanceImageService')
         # NOTE(dprince) max out properties/metadata in image 3 for testing
         img3 = self.IMAGE_FIXTURES[2]
         for num in range(FLAGS.quota_metadata_items):
             img3['properties']['key%i' % num] = "blah"
         fakes.stub_out_glance(self.stubs, self.IMAGE_FIXTURES)
 
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        FLAGS.image_service = self.orig_image_service
-        super(ImageMetaDataTest, self).tearDown()
-
     def test_index(self):
         req = webob.Request.blank('/v1.1/images/1/meta')
         req.environ['api.version'] = '1.1'
diff --git a/nova/tests/api/openstack/test_server_metadata.py b/nova/tests/api/openstack/test_server_metadata.py
index 0431e68d2227..f904850679f3 100644
--- a/nova/tests/api/openstack/test_server_metadata.py
+++ b/nova/tests/api/openstack/test_server_metadata.py
@@ -16,14 +16,12 @@
 #    under the License.
 
 import json
-import stubout
-import unittest
 import webob
 
 
 from nova import exception
 from nova import flags
-from nova.api import openstack
+from nova import test
 from nova.tests.api.openstack import fakes
 import nova.wsgi
 
@@ -76,21 +74,13 @@ def return_server_nonexistant(context, server_id):
     raise exception.InstanceNotFound()
 
 
-class ServerMetaDataTest(unittest.TestCase):
+class ServerMetaDataTest(test.TestCase):
 
     def setUp(self):
         super(ServerMetaDataTest, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.auth_data = {}
-        fakes.FakeAuthDatabase.data = {}
-        fakes.stub_out_auth(self.stubs)
         fakes.stub_out_key_pair_funcs(self.stubs)
         self.stubs.Set(nova.db.api, 'instance_get', return_server)
 
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        super(ServerMetaDataTest, self).tearDown()
-
     def test_index(self):
         self.stubs.Set(nova.db.api, 'instance_metadata_get',
                        return_server_metadata)
diff --git a/nova/tests/api/openstack/test_servers.py b/nova/tests/api/openstack/test_servers.py
index e0456781abc4..91025fcb9545 100644
--- a/nova/tests/api/openstack/test_servers.py
+++ b/nova/tests/api/openstack/test_servers.py
@@ -20,7 +20,6 @@ import json
 import unittest
 from xml.dom import minidom
 
-import stubout
 import webob
 
 from nova import context
@@ -224,8 +223,6 @@ class ServersTest(test.TestCase):
 
     def setUp(self):
         super(ServersTest, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthDatabase.data = {}
         fakes.stub_out_networking(self.stubs)
         fakes.stub_out_rate_limiting(self.stubs)
         fakes.stub_out_key_pair_funcs(self.stubs)
@@ -250,15 +247,9 @@ class ServersTest(test.TestCase):
         self.stubs.Set(nova.compute.API, 'resume', fake_compute_api)
         self.stubs.Set(nova.compute.API, "get_diagnostics", fake_compute_api)
         self.stubs.Set(nova.compute.API, "get_actions", fake_compute_api)
-        self.allow_admin = FLAGS.allow_admin_api
 
         self.webreq = common.webob_factory('/v1.0/servers')
 
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        FLAGS.allow_admin_api = self.allow_admin
-        super(ServersTest, self).tearDown()
-
     def test_get_server_by_id(self):
         req = webob.Request.blank('/v1.0/servers/1')
         res = req.get_response(fakes.wsgi_app())
@@ -853,7 +844,7 @@ class ServersTest(test.TestCase):
     def test_create_instance_via_zones(self):
         """Server generated ReservationID"""
         self._setup_for_create_instance()
-        FLAGS.allow_admin_api = True
+        self.flags(allow_admin_api=True)
 
         body = dict(server=dict(
             name='server_test', imageId=3, flavorId=2,
@@ -875,7 +866,7 @@ class ServersTest(test.TestCase):
     def test_create_instance_via_zones_with_resid(self):
         """User supplied ReservationID"""
         self._setup_for_create_instance()
-        FLAGS.allow_admin_api = True
+        self.flags(allow_admin_api=True)
 
         body = dict(server=dict(
             name='server_test', imageId=3, flavorId=2,
@@ -1305,7 +1296,7 @@ class ServersTest(test.TestCase):
             self.assertEqual(s['flavorId'], 1)
 
     def test_server_pause(self):
-        FLAGS.allow_admin_api = True
+        self.flags(allow_admin_api=True)
         body = dict(server=dict(
             name='server_test', imageId=2, flavorId=2, metadata={},
             personality={}))
@@ -1317,7 +1308,7 @@ class ServersTest(test.TestCase):
         self.assertEqual(res.status_int, 202)
 
     def test_server_unpause(self):
-        FLAGS.allow_admin_api = True
+        self.flags(allow_admin_api=True)
         body = dict(server=dict(
             name='server_test', imageId=2, flavorId=2, metadata={},
             personality={}))
@@ -1329,7 +1320,7 @@ class ServersTest(test.TestCase):
         self.assertEqual(res.status_int, 202)
 
     def test_server_suspend(self):
-        FLAGS.allow_admin_api = True
+        self.flags(allow_admin_api=True)
         body = dict(server=dict(
             name='server_test', imageId=2, flavorId=2, metadata={},
             personality={}))
@@ -1341,7 +1332,7 @@ class ServersTest(test.TestCase):
         self.assertEqual(res.status_int, 202)
 
     def test_server_resume(self):
-        FLAGS.allow_admin_api = True
+        self.flags(allow_admin_api=True)
         body = dict(server=dict(
             name='server_test', imageId=2, flavorId=2, metadata={},
             personality={}))
@@ -1353,7 +1344,7 @@ class ServersTest(test.TestCase):
         self.assertEqual(res.status_int, 202)
 
     def test_server_reset_network(self):
-        FLAGS.allow_admin_api = True
+        self.flags(allow_admin_api=True)
         body = dict(server=dict(
             name='server_test', imageId=2, flavorId=2, metadata={},
             personality={}))
@@ -1365,7 +1356,7 @@ class ServersTest(test.TestCase):
         self.assertEqual(res.status_int, 202)
 
     def test_server_inject_network_info(self):
-        FLAGS.allow_admin_api = True
+        self.flags(allow_admin_api=True)
         body = dict(server=dict(
             name='server_test', imageId=2, flavorId=2, metadata={},
             personality={}))
@@ -1652,7 +1643,7 @@ class ServersTest(test.TestCase):
         self.assertEqual(self.server_delete_called, True)
 
     def test_rescue_accepted(self):
-        FLAGS.allow_admin_api = True
+        self.flags(allow_admin_api=True)
         body = {}
 
         self.called = False
@@ -1671,7 +1662,7 @@ class ServersTest(test.TestCase):
         self.assertEqual(res.status_int, 202)
 
     def test_rescue_raises_handled(self):
-        FLAGS.allow_admin_api = True
+        self.flags(allow_admin_api=True)
         body = {}
 
         def rescue_mock(*args, **kwargs):
@@ -2160,17 +2151,8 @@ class TestServerInstanceCreation(test.TestCase):
 
     def setUp(self):
         super(TestServerInstanceCreation, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthDatabase.data = {}
-        fakes.stub_out_auth(self.stubs)
         fakes.stub_out_image_service(self.stubs)
         fakes.stub_out_key_pair_funcs(self.stubs)
-        self.allow_admin = FLAGS.allow_admin_api
-
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        FLAGS.allow_admin_api = self.allow_admin
-        super(TestServerInstanceCreation, self).tearDown()
 
     def _setup_mock_compute_api_for_personality(self):
 
diff --git a/nova/tests/api/openstack/test_shared_ip_groups.py b/nova/tests/api/openstack/test_shared_ip_groups.py
index c2bd7e45a124..36fa1de0ff13 100644
--- a/nova/tests/api/openstack/test_shared_ip_groups.py
+++ b/nova/tests/api/openstack/test_shared_ip_groups.py
@@ -15,26 +15,13 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import stubout
 import webob
 
 from nova import test
-from nova.api.openstack import shared_ip_groups
 from nova.tests.api.openstack import fakes
 
 
 class SharedIpGroupsTest(test.TestCase):
-    def setUp(self):
-        super(SharedIpGroupsTest, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.reset_fake_data()
-        fakes.FakeAuthDatabase.data = {}
-        fakes.stub_out_auth(self.stubs)
-
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        super(SharedIpGroupsTest, self).tearDown()
-
     def test_get_shared_ip_groups(self):
         req = webob.Request.blank('/v1.0/shared_ip_groups')
         res = req.get_response(fakes.wsgi_app())
diff --git a/nova/tests/api/openstack/test_zones.py b/nova/tests/api/openstack/test_zones.py
index 6a6e13d93122..4a208ea24e6c 100644
--- a/nova/tests/api/openstack/test_zones.py
+++ b/nova/tests/api/openstack/test_zones.py
@@ -95,31 +95,15 @@ def zone_select(context, specs):
 class ZonesTest(test.TestCase):
     def setUp(self):
         super(ZonesTest, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.reset_fake_data()
-        fakes.FakeAuthDatabase.data = {}
+        self.flags(allow_admin_api=True)
         fakes.stub_out_networking(self.stubs)
         fakes.stub_out_rate_limiting(self.stubs)
-        fakes.stub_out_auth(self.stubs)
-
-        self.allow_admin = FLAGS.allow_admin_api
-        FLAGS.allow_admin_api = True
 
         self.stubs.Set(nova.db, 'zone_get', zone_get)
         self.stubs.Set(nova.db, 'zone_update', zone_update)
         self.stubs.Set(nova.db, 'zone_create', zone_create)
         self.stubs.Set(nova.db, 'zone_delete', zone_delete)
 
-        self.old_zone_name = FLAGS.zone_name
-        self.old_zone_capabilities = FLAGS.zone_capabilities
-
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        FLAGS.allow_admin_api = self.allow_admin
-        FLAGS.zone_name = self.old_zone_name
-        FLAGS.zone_capabilities = self.old_zone_capabilities
-        super(ZonesTest, self).tearDown()
-
     def test_get_zone_list_scheduler(self):
         self.stubs.Set(api, '_call_scheduler', zone_get_all_scheduler)
         req = webob.Request.blank('/v1.0/zones')
@@ -190,8 +174,8 @@ class ZonesTest(test.TestCase):
         self.assertFalse('username' in res_dict['zone'])
 
     def test_zone_info(self):
-        FLAGS.zone_name = 'darksecret'
-        FLAGS.zone_capabilities = ['cap1=a;b', 'cap2=c;d']
+        caps = ['cap1=a;b', 'cap2=c;d']
+        self.flags(zone_name='darksecret', zone_capabilities=caps)
         self.stubs.Set(api, '_call_scheduler', zone_capabilities)
 
         body = dict(zone=dict(username='zeb', password='sneaky'))
@@ -205,7 +189,7 @@ class ZonesTest(test.TestCase):
         self.assertEqual(res_dict['zone']['cap2'], 'c;d')
 
     def test_zone_select(self):
-        FLAGS.build_plan_encryption_key = 'c286696d887c9aa0611bbb3e2025a45a'
+        self.flags(build_plan_encryption_key='c286696d887c9aa0611bbb3e2025a45a')
         self.stubs.Set(api, 'select', zone_select)
 
         req = webob.Request.blank('/v1.0/zones/select')
diff --git a/nova/tests/test_objectstore.py b/nova/tests/test_objectstore.py
index af4ee27cd028..0b2dce20e43d 100644
--- a/nova/tests/test_objectstore.py
+++ b/nova/tests/test_objectstore.py
@@ -52,8 +52,7 @@ class S3APITestCase(test.TestCase):
     def setUp(self):
         """Setup users, projects, and start a test server."""
         super(S3APITestCase, self).setUp()
-        self.flags(auth_driver='nova.auth.ldapdriver.FakeLdapDriver',
-                   buckets_path=os.path.join(OSS_TEMPDIR, 'buckets'),
+        self.flags(buckets_path=os.path.join(OSS_TEMPDIR, 'buckets'),
                    s3_host='127.0.0.1')
 
         shutil.rmtree(FLAGS.buckets_path)

From 634a195da129fb043184ac1589efd0bdac5df256 Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@gmail.com>
Date: Fri, 22 Jul 2011 21:40:10 +0000
Subject: [PATCH 09/17] remove some more stubouts and fakes

---
 nova/tests/api/openstack/test_accounts.py | 10 +---------
 nova/tests/api/openstack/test_auth.py     |  4 ----
 nova/tests/api/openstack/test_users.py    |  9 +--------
 3 files changed, 2 insertions(+), 21 deletions(-)

diff --git a/nova/tests/api/openstack/test_accounts.py b/nova/tests/api/openstack/test_accounts.py
index 64abcf48ce33..89dbf52134c0 100644
--- a/nova/tests/api/openstack/test_accounts.py
+++ b/nova/tests/api/openstack/test_accounts.py
@@ -16,7 +16,6 @@
 
 import json
 
-import stubout
 import webob
 
 from nova import flags
@@ -41,7 +40,7 @@ def fake_admin_check(self, req):
 class AccountsTest(test.TestCase):
     def setUp(self):
         super(AccountsTest, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
+        self.flags(allow_admin_api=True)
         self.stubs.Set(accounts.Controller, '__init__',
                        fake_init)
         self.stubs.Set(accounts.Controller, '_check_admin',
@@ -52,8 +51,6 @@ class AccountsTest(test.TestCase):
         fakes.stub_out_rate_limiting(self.stubs)
         fakes.stub_out_auth(self.stubs)
 
-        self.allow_admin = FLAGS.allow_admin_api
-        FLAGS.allow_admin_api = True
         fakemgr = fakes.FakeAuthManager()
         joeuser = User('id1', 'guy1', 'acc1', 'secret1', False)
         superuser = User('id2', 'guy2', 'acc2', 'secret2', True)
@@ -62,11 +59,6 @@ class AccountsTest(test.TestCase):
         fakemgr.create_project('test1', joeuser)
         fakemgr.create_project('test2', superuser)
 
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        FLAGS.allow_admin_api = self.allow_admin
-        super(AccountsTest, self).tearDown()
-
     def test_get_account(self):
         req = webob.Request.blank('/v1.0/accounts/test1')
         res = req.get_response(fakes.wsgi_app())
diff --git a/nova/tests/api/openstack/test_auth.py b/nova/tests/api/openstack/test_auth.py
index 1b1d443689f2..306ae1aa05ec 100644
--- a/nova/tests/api/openstack/test_auth.py
+++ b/nova/tests/api/openstack/test_auth.py
@@ -17,7 +17,6 @@
 
 import datetime
 
-import stubout
 import webob
 import webob.dec
 
@@ -43,7 +42,6 @@ class Test(test.TestCase):
         fakes.stub_out_networking(self.stubs)
 
     def tearDown(self):
-        self.stubs.UnsetAll()
         fakes.fake_data_store = {}
         super(Test, self).tearDown()
 
@@ -237,7 +235,6 @@ class TestFunctional(test.TestCase):
 class TestLimiter(test.TestCase):
     def setUp(self):
         super(TestLimiter, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
         self.stubs.Set(nova.api.openstack.auth.AuthMiddleware,
             '__init__', fakes.fake_auth_init)
         self.stubs.Set(context, 'RequestContext', fakes.FakeRequestContext)
@@ -246,7 +243,6 @@ class TestLimiter(test.TestCase):
         fakes.stub_out_networking(self.stubs)
 
     def tearDown(self):
-        self.stubs.UnsetAll()
         fakes.fake_data_store = {}
         super(TestLimiter, self).tearDown()
 
diff --git a/nova/tests/api/openstack/test_users.py b/nova/tests/api/openstack/test_users.py
index effb2f5926dc..705c02f6b301 100644
--- a/nova/tests/api/openstack/test_users.py
+++ b/nova/tests/api/openstack/test_users.py
@@ -15,7 +15,6 @@
 
 import json
 
-import stubout
 import webob
 
 from nova import flags
@@ -41,7 +40,7 @@ def fake_admin_check(self, req):
 class UsersTest(test.TestCase):
     def setUp(self):
         super(UsersTest, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
+        self.flags(allow_admin_api=True)
         self.stubs.Set(users.Controller, '__init__',
                        fake_init)
         self.stubs.Set(users.Controller, '_check_admin',
@@ -58,16 +57,10 @@ class UsersTest(test.TestCase):
         fakes.stub_out_auth(self.stubs)
 
         self.allow_admin = FLAGS.allow_admin_api
-        FLAGS.allow_admin_api = True
         fakemgr = fakes.FakeAuthManager()
         fakemgr.add_user(User('id1', 'guy1', 'acc1', 'secret1', False))
         fakemgr.add_user(User('id2', 'guy2', 'acc2', 'secret2', True))
 
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        FLAGS.allow_admin_api = self.allow_admin
-        super(UsersTest, self).tearDown()
-
     def test_get_user_list(self):
         req = webob.Request.blank('/v1.0/users')
         res = req.get_response(fakes.wsgi_app())

From 3b9af8a63abb21aac1ef9ef8dcb801b7a3686ce8 Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@gmail.com>
Date: Fri, 22 Jul 2011 21:52:11 +0000
Subject: [PATCH 10/17] pull out auth manager from db

---
 nova/db/sqlalchemy/models.py | 16 ----------------
 1 file changed, 16 deletions(-)

diff --git a/nova/db/sqlalchemy/models.py b/nova/db/sqlalchemy/models.py
index c1150f7ca680..14dc09e9fdf6 100644
--- a/nova/db/sqlalchemy/models.py
+++ b/nova/db/sqlalchemy/models.py
@@ -177,14 +177,6 @@ class Instance(BASE, NovaBase):
     user_id = Column(String(255))
     project_id = Column(String(255))
 
-    @property
-    def user(self):
-        return auth.manager.AuthManager().get_user(self.user_id)
-
-    @property
-    def project(self):
-        return auth.manager.AuthManager().get_project(self.project_id)
-
     image_ref = Column(String(255))
     kernel_id = Column(String(255))
     ramdisk_id = Column(String(255))
@@ -465,14 +457,6 @@ class SecurityGroup(BASE, NovaBase):
         'Instance.deleted == False)',
                              backref='security_groups')
 
-    @property
-    def user(self):
-        return auth.manager.AuthManager().get_user(self.user_id)
-
-    @property
-    def project(self):
-        return auth.manager.AuthManager().get_project(self.project_id)
-
 
 class SecurityGroupIngressRule(BASE, NovaBase):
     """Represents a rule in a security group."""

From 164afd51017721b9cbaf2880b9dada3d4cd9b42c Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@gmail.com>
Date: Fri, 22 Jul 2011 22:04:52 +0000
Subject: [PATCH 11/17] remove auth manager from instance helper

---
 nova/api/openstack/create_instance_helper.py | 5 +++--
 nova/auth/manager.py                         | 4 ----
 2 files changed, 3 insertions(+), 6 deletions(-)

diff --git a/nova/api/openstack/create_instance_helper.py b/nova/api/openstack/create_instance_helper.py
index 7249f12611cf..2034e8ada999 100644
--- a/nova/api/openstack/create_instance_helper.py
+++ b/nova/api/openstack/create_instance_helper.py
@@ -20,6 +20,7 @@ import webob
 from webob import exc
 from xml.dom import minidom
 
+from nova import db
 from nova import exception
 from nova import flags
 from nova import log as logging
@@ -29,7 +30,6 @@ from nova import utils
 
 from nova.compute import instance_types
 from nova.api.openstack import wsgi
-from nova.auth import manager as auth_manager
 
 
 LOG = logging.getLogger('nova.api.openstack.create_instance_helper')
@@ -77,7 +77,8 @@ class CreateInstanceHelper(object):
 
         key_name = None
         key_data = None
-        key_pairs = auth_manager.AuthManager.get_key_pairs(context)
+        key_pairs = db.key_pair_get_all_by_user(context.elevated(),
+                                                context.user_id)
         if key_pairs:
             key_pair = key_pairs[0]
             key_name = key_pair['name']
diff --git a/nova/auth/manager.py b/nova/auth/manager.py
index 5118abba2372..6205cfb56d5c 100644
--- a/nova/auth/manager.py
+++ b/nova/auth/manager.py
@@ -738,10 +738,6 @@ class AuthManager(object):
         with self.driver() as drv:
             drv.modify_user(uid, access_key, secret_key, admin)
 
-    @staticmethod
-    def get_key_pairs(context):
-        return db.key_pair_get_all_by_user(context.elevated(), context.user_id)
-
     def get_credentials(self, user, project=None, use_dmz=True):
         """Get credential zip for user in project"""
         if not isinstance(user, User):

From 4e4bbda2a15df9f2366488d092bc466655a170b9 Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@gmail.com>
Date: Fri, 22 Jul 2011 22:12:22 +0000
Subject: [PATCH 12/17] pep cleanup

---
 nova/context.py                          | 3 ++-
 nova/tests/api/openstack/test_servers.py | 3 ++-
 nova/tests/api/openstack/test_zones.py   | 3 ++-
 nova/tests/test_api.py                   | 1 -
 4 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/nova/context.py b/nova/context.py
index e7c60142cebb..db19f136c785 100644
--- a/nova/context.py
+++ b/nova/context.py
@@ -31,7 +31,8 @@ class RequestContext(object):
     """
 
     def __init__(self, user_id, project_id, is_admin=None, read_deleted=False,
-                 roles=None, remote_address=None, timestamp=None, request_id=None):
+                 roles=None, remote_address=None, timestamp=None,
+                 request_id=None):
         self.user_id = user_id
         self.project_id = project_id
         self.roles = roles or []
diff --git a/nova/tests/api/openstack/test_servers.py b/nova/tests/api/openstack/test_servers.py
index f05310325f6f..98d4bed52caf 100644
--- a/nova/tests/api/openstack/test_servers.py
+++ b/nova/tests/api/openstack/test_servers.py
@@ -1306,7 +1306,8 @@ class ServersTest(test.TestCase):
         '''
 
         def return_servers_with_host(context, *args, **kwargs):
-            return [stub_instance(i, 'fake', 'fake', None, None, i % 2) for i in xrange(5)]
+            return [stub_instance(i, 'fake', 'fake', None, None, i % 2)
+                    for i in xrange(5)]
 
         self.stubs.Set(nova.db.api, 'instance_get_all_by_project',
             return_servers_with_host)
diff --git a/nova/tests/api/openstack/test_zones.py b/nova/tests/api/openstack/test_zones.py
index 4a208ea24e6c..3deb844aa284 100644
--- a/nova/tests/api/openstack/test_zones.py
+++ b/nova/tests/api/openstack/test_zones.py
@@ -189,7 +189,8 @@ class ZonesTest(test.TestCase):
         self.assertEqual(res_dict['zone']['cap2'], 'c;d')
 
     def test_zone_select(self):
-        self.flags(build_plan_encryption_key='c286696d887c9aa0611bbb3e2025a45a')
+        key = 'c286696d887c9aa0611bbb3e2025a45a'
+        self.flags(build_plan_encryption_key=key)
         self.stubs.Set(api, 'select', zone_select)
 
         req = webob.Request.blank('/v1.0/zones/select')
diff --git a/nova/tests/test_api.py b/nova/tests/test_api.py
index 292f9d668a6f..3ec1c9abff4c 100644
--- a/nova/tests/test_api.py
+++ b/nova/tests/test_api.py
@@ -395,7 +395,6 @@ class ApiEc2TestCase(test.TestCase):
         self.expect_http()
         self.mox.ReplayAll()
 
-
         security_group_name = "".join(random.choice("sdiuisudfsdcnpaqwertasd")
                                       for x in range(random.randint(4, 8)))
 

From 8de3c0fcaee546fae3d415ef5ddcbb51fb1db6d7 Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@gmail.com>
Date: Mon, 25 Jul 2011 17:49:09 +0000
Subject: [PATCH 13/17] fix for reviews

---
 nova/api/openstack/create_instance_helper.py | 2 ++
 nova/compute/api.py                          | 1 -
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/nova/api/openstack/create_instance_helper.py b/nova/api/openstack/create_instance_helper.py
index 2034e8ada999..573153f682d0 100644
--- a/nova/api/openstack/create_instance_helper.py
+++ b/nova/api/openstack/create_instance_helper.py
@@ -77,6 +77,8 @@ class CreateInstanceHelper(object):
 
         key_name = None
         key_data = None
+        # TODO(vish): Key pair access should move into a common library
+        #             instead of being accessed directly from the db.
         key_pairs = db.key_pair_get_all_by_user(context.elevated(),
                                                 context.user_id)
         if key_pairs:
diff --git a/nova/compute/api.py b/nova/compute/api.py
index d1c3fd6fd622..487d23b0df66 100644
--- a/nova/compute/api.py
+++ b/nova/compute/api.py
@@ -676,7 +676,6 @@ class API(base.Base):
         all instances in the system.
         """
 
-        LOG.info(locals())
         if reservation_id is not None:
             recurse_zones = True
             instances = self.db.instance_get_all_by_reservation(

From d811f82e524bd7634dd59f0074129fb41fb28c12 Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@gmail.com>
Date: Thu, 28 Jul 2011 01:31:09 +0000
Subject: [PATCH 14/17] fix tests broken in the merge

---
 nova/tests/test_db_api.py    | 34 +++++++++++++---------------------
 nova/tests/test_quota.py     |  4 +---
 nova/tests/test_vmwareapi.py |  2 +-
 3 files changed, 15 insertions(+), 25 deletions(-)

diff --git a/nova/tests/test_db_api.py b/nova/tests/test_db_api.py
index 107fd03e36bb..54448f9d6f72 100644
--- a/nova/tests/test_db_api.py
+++ b/nova/tests/test_db_api.py
@@ -22,7 +22,6 @@ from nova import test
 from nova import context
 from nova import db
 from nova import flags
-from nova.auth import manager
 
 FLAGS = flags.FLAGS
 
@@ -45,42 +44,35 @@ def _setup_networking(instance_id, ip='1.2.3.4', flo_addr='1.2.1.2'):
     db.fixed_ip_create(ctxt, fixed_ip)
     fix_ref = db.fixed_ip_get_by_address(ctxt, ip)
     db.floating_ip_create(ctxt, {'address': flo_addr,
-                                        'fixed_ip_id': fix_ref.id})
+                                 'fixed_ip_id': fix_ref['id']})
 
 
 class DbApiTestCase(test.TestCase):
     def setUp(self):
         super(DbApiTestCase, self).setUp()
-        self.manager = manager.AuthManager()
-        self.user = self.manager.create_user('admin', 'admin', 'admin', True)
-        self.project = self.manager.create_project('proj', 'admin', 'proj')
-        self.context = context.RequestContext(user=self.user,
-                                              project=self.project)
-
-    def tearDown(self):
-        self.manager.delete_project(self.project)
-        self.manager.delete_user(self.user)
-        super(DbApiTestCase, self).tearDown()
+        self.user_id = 'fake'
+        self.project_id = 'fake'
+        self.context = context.RequestContext(self.user_id, self.project_id)
 
     def test_instance_get_project_vpn(self):
-        result = db.fixed_ip_get_all(self.context)
         values = {'instance_type_id': FLAGS.default_instance_type,
                   'image_ref': FLAGS.vpn_image_id,
-                  'project_id': self.project.id
+                  'project_id': self.project_id
                  }
         instance = db.instance_create(self.context, values)
-        result = db.instance_get_project_vpn(self.context, self.project.id)
-        self.assertEqual(instance.id, result.id)
+        result = db.instance_get_project_vpn(self.context.elevated(),
+                                             self.project_id)
+        self.assertEqual(instance['id'], result['id'])
 
     def test_instance_get_project_vpn_joins(self):
-        result = db.fixed_ip_get_all(self.context)
         values = {'instance_type_id': FLAGS.default_instance_type,
                   'image_ref': FLAGS.vpn_image_id,
-                  'project_id': self.project.id
+                  'project_id': self.project_id
                  }
         instance = db.instance_create(self.context, values)
-        _setup_networking(instance.id)
-        result = db.instance_get_project_vpn(self.context, self.project.id)
-        self.assertEqual(instance.id, result.id)
+        _setup_networking(instance['id'])
+        result = db.instance_get_project_vpn(self.context.elevated(),
+                                             self.project_id)
+        self.assertEqual(instance['id'], result['id'])
         self.assertEqual(result['fixed_ips'][0]['floating_ips'][0].address,
                          '1.2.1.2')
diff --git a/nova/tests/test_quota.py b/nova/tests/test_quota.py
index 0ffab0ee14e4..92393b5360e7 100644
--- a/nova/tests/test_quota.py
+++ b/nova/tests/test_quota.py
@@ -20,10 +20,8 @@ from nova import compute
 from nova import context
 from nova import db
 from nova import flags
-from nova import network
 from nova import quota
 from nova import test
-from nova import utils
 from nova import volume
 from nova.compute import instance_types
 
@@ -267,7 +265,7 @@ class QuotaTestCase(test.TestCase):
         address = '192.168.0.100'
         db.floating_ip_create(context.get_admin_context(),
                               {'address': address,
-                               'project_id': self.project.id})
+                               'project_id': self.project_id})
         self.assertRaises(quota.QuotaError,
                           self.network.allocate_floating_ip,
                           self.context,
diff --git a/nova/tests/test_vmwareapi.py b/nova/tests/test_vmwareapi.py
index be5246fdf70c..3d87d67ad1b7 100644
--- a/nova/tests/test_vmwareapi.py
+++ b/nova/tests/test_vmwareapi.py
@@ -19,6 +19,7 @@
 Test suite for VMWareAPI.
 """
 
+from nova import context
 from nova import db
 from nova import flags
 from nova import test
@@ -42,7 +43,6 @@ class VMWareAPIVMTestCase(test.TestCase):
         self.flags(vmwareapi_host_ip='test_url',
                    vmwareapi_host_username='test_username',
                    vmwareapi_host_password='test_pass')
-        self.manager = manager.AuthManager()
         self.user_id = 'fake'
         self.project_id = 'fake'
         self.context = context.RequestContext(self.user_id, self.project_id)

From 559b73ed18a271dd35c7b9d00306c8c5b33bd45b Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@gmail.com>
Date: Thu, 28 Jul 2011 01:36:55 +0000
Subject: [PATCH 15/17] remove authman from images/s3.py and replace with flags

---
 nova/image/s3.py | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/nova/image/s3.py b/nova/image/s3.py
index 8685c96fd756..ccbfa89cdffc 100644
--- a/nova/image/s3.py
+++ b/nova/image/s3.py
@@ -34,7 +34,6 @@ from nova import flags
 from nova import image
 from nova import log as logging
 from nova import utils
-from nova.auth import manager
 from nova.image import service
 from nova.api.ec2 import ec2utils
 
@@ -43,6 +42,10 @@ LOG = logging.getLogger("nova.image.s3")
 FLAGS = flags.FLAGS
 flags.DEFINE_string('image_decryption_dir', '/tmp',
                     'parent dir for tempdir used for image decryption')
+flags.DEFINE_string('s3_access_key', 'notchecked',
+                    'access key to use for s3 server for images')
+flags.DEFINE_string('s3_secret_key', 'notchecked',
+                    'secret key to use for s3 server for images')
 
 
 class S3ImageService(service.BaseImageService):
@@ -82,11 +85,10 @@ class S3ImageService(service.BaseImageService):
 
     @staticmethod
     def _conn(context):
-        # TODO(vish): is there a better way to get creds to sign
-        #             for the user?
-        authman = manager.AuthManager()
-        access = authman.get_access_key(context.user_id, context.project_id)
-        secret = str(authman.get_user(context.user_id).secret)
+        # NOTE(vish): access and secret keys for s3 server are not
+        #             checked in nova-objectstore
+        access = FLAGS.s3_access_key
+        secret = FLAGS.s3_secret_key
         calling = boto.s3.connection.OrdinaryCallingFormat()
         return boto.s3.connection.S3Connection(aws_access_key_id=access,
                                                aws_secret_access_key=secret,

From 969ba5028d8b07cece4b4c940ce02f661cecbb71 Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@gmail.com>
Date: Thu, 28 Jul 2011 12:04:49 -0700
Subject: [PATCH 16/17] simplify if statement

---
 nova/context.py | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/nova/context.py b/nova/context.py
index db19f136c785..5b2776d4e4f9 100644
--- a/nova/context.py
+++ b/nova/context.py
@@ -38,10 +38,7 @@ class RequestContext(object):
         self.roles = roles or []
         self.is_admin = is_admin
         if self.is_admin is None:
-            if 'admin' in self.roles:
-                self.is_admin = True
-            else:
-                self.is_admin = False
+            self.admin = 'admin' in self.roles
         self.read_deleted = read_deleted
         self.remote_address = remote_address
         if not timestamp:

From 1e8a7f2846ce0a3fb3d9e31fc7d4dbf27d54fac2 Mon Sep 17 00:00:00 2001
From: Vishvananda Ishaya <vishvananda@gmail.com>
Date: Thu, 28 Jul 2011 19:06:48 -0700
Subject: [PATCH 17/17] remove extra log statement

---
 nova/compute/api.py | 1 -
 1 file changed, 1 deletion(-)

diff --git a/nova/compute/api.py b/nova/compute/api.py
index 51c5ae155759..8f7b3c3ef8d4 100644
--- a/nova/compute/api.py
+++ b/nova/compute/api.py
@@ -689,7 +689,6 @@ class API(base.Base):
                     raise
                 instances = None
         elif project_id or not context.is_admin:
-            LOG.info(context.project_id)
             if not context.project_id:
                 instances = self.db.instance_get_all_by_user(
                     context, context.user_id)