Move aodh to authtoken

In aodh::api, use keystone::resource::authtoken to configure keystone_authtoken section in aodh.conf, with all parameters required to configure keystonemiddleware. This patch will allow to deploy aodh to use Keystone v3 authentification. Some deprecations: - aodh::api::keystone_tenant is deprecated in favor of aodh::keystone::authtoken::project_name. - aodh::api::keystone_user is deprecated in favor of aodh::keystone::authtoken::username. - aodh::api::keystone_password is deprecated in favor of aodh::keystone::authtoken::password. - aodh::api::keystone_project_domain_name is deprecated in favor of aodh::keystone::authtoken::project_domain_name - aodh::api::keystone_user_domain_name is deprecated in favor of aodh::keystone::authtoken::user_domain_name - aodh::api::keystone_auth_type is deprecated in favor of aodh::keystone::authtoken::auth_type - aodh::api::keystone_auth_uri is deprecated in favor of aodh::keystone::authtoken::auth_uri - aodh::api::keystone_identity_uri is deprecated in favor of aodh::keystone::authtoken::auth_url - aodh::api::keystone_auth_url is deprecated in favor of aodh::keystone::authtoken::auth_url - aodh::api::memcached_servers is deprecated in favor of aodh::keystone::authtoken::memcached_servers Change-Id: Id8b3d8265f3554865fd77b291f235219b147efb9 Related-Bug: #1604463
2016-07-22 00:02:54 -03:00 · 2016-07-22 00:02:54 -03:00 · 75161dd0ca
parent 330e89ebaf
commit 75161dd0ca
7 changed files with 621 additions and 133 deletions
--- a/examples/aodh.pp
+++ b/examples/aodh.pp
@ -1,8 +1,9 @@
 class { '::aodh': }
+class { '::aodh::keystone::authtoken':
+  password => 'a_big_secret',
+}
 class { '::aodh::api':
  enabled      => true,
-  keystone_password     => 'a_big_secret',
-  keystone_identity_uri => 'http://127.0.0.1:35357/',
  service_name => 'httpd',
 }
 include ::apache
--- a/manifests/api.pp
+++ b/manifests/api.pp
@ -10,44 +10,6 @@
 #   (optional) Whether the service should be managed by Puppet.
 #   Defaults to true.
 #
-# [*keystone_user*]
-#   (optional) The name of the auth user
-#   Defaults to aodh
-#
-# [*keystone_tenant*]
-#   (optional) Tenant to authenticate with.
-#   Defaults to 'services'.
-#
-# [*keystone_project_domain_name*]
-#   (optional) Project domain name to authenticate with.
-#   Defaults to 'default'.
-#
-# [*keystone_user_domain_name*]
-#   (optional) User domain name to authenticate with.
-#   Defaults to 'default'.
-#
-# [*keystone_auth_type*]
-#   (optional) An authentication type to use with an OpenStack Identity server.
-#   The value should contain auth plugin name.
-#   Defaults to 'password'.
-#
-# [*keystone_password*]
-#   Password to authenticate with.
-#   Mandatory.
-#
-# [*keystone_auth_uri*]
-#   (optional) Public Identity API endpoint.
-#   Defaults to 'false'.
-#
-# [*keystone_auth_url*]
-#   (optional) URL used by the plugin to know where to authenticate the service user.
-#   Defaults to $::os_service_default.
-#
-# [*memcached_servers*]
-#   (optinal) a list of memcached server(s) to use for caching. If left
-#   undefined, tokens will instead be cached in-process.
-#   Defaults to $::os_service_default.
-#
 # [*host*]
 #   (optional) The aodh api bind address.
 #   Defaults to 0.0.0.0
@ -73,45 +35,116 @@
 #   (optional) Run gnocchi-upgrade db sync on api nodes after installing the package.
 #   Defaults to false
 #
-# DEPRECATED PARAMETERS
+# [*auth_strategy*]
+#   (optional) Type of authentication to be used.
+#   Defaults to 'keystone'
+#
+# = DEPRECATED PARAMETERS
 #
 # [*keystone_identity_uri*]
-#   (optional) DEPRECATED. Complete admin Identity API endpoint.
+#   (optional) DEPRECATED. Use aodh::keystone::authtoken::auth_uri instead.
 #   Defaults to: undef
 #
-
+# [*keystone_user*]
+#   (optional) DEPRECATED. Use aodh::keystone::authtoken::username instead.
+#   Defaults to undef
+#
+# [*keystone_tenant*]
+#   (optional) DEPRECATED. Use aodh::keystone::authtoken::project_name instead.
+#   Defaults to undef
+#
+# [*keystone_project_domain_name*]
+#   (optional) DEPRECATED. Use aodh::keystone::authtoken::project_domain_name instead.
+#   Defaults to undef
+#
+# [*keystone_user_domain_name*]
+#   (optional) DEPRECATED. Use aodh::keystone::authtoken::user_domain_name instead.
+#   Defaults to undef
+#
+# [*keystone_auth_type*]
+#   (optional) DEPRECATED. Use aodh::keystone::authtoken::auth_type instead.
+#   Defaults to undef
+#
+# [*keystone_password*]
+#   (optional) DEPRECATED. Use aodh::keystone::authtoken::password instead.
+#   Defaults to undef
+#
+# [*keystone_auth_uri*]
+#   (optional) DEPRECATED. Use aodh::keystone::authtoken::auth_uri instead.
+#   Defaults to undef
+#
+# [*keystone_auth_url*]
+#   (optional) DEPRECATED. Use aodh::keystone::authtoken::auth_url instead.
+#   Defaults to undef
+#
+# [*memcached_servers*]
+#   (optinal) DEPRECATED. Use aodh::keystone::authtoken::memcached_servers.
+#   Defaults to undef
+#
 class aodh::api (
  $manage_service                 = true,
  $enabled                        = true,
  $package_ensure                 = 'present',
-  $keystone_user                = 'aodh',
-  $keystone_tenant              = 'services',
-  $keystone_password            = false,
-  $keystone_auth_uri            = false,
-  $keystone_auth_url            = $::os_service_default,
-  $memcached_servers            = $::os_service_default,
-  $keystone_project_domain_name = 'default',
-  $keystone_user_domain_name    = 'default',
-  $keystone_auth_type           = 'password',
  $host                           = '0.0.0.0',
  $port                           = '8042',
  $service_name                   = $::aodh::params::api_service_name,
  $sync_db                        = false,
+  $auth_strategy                  = 'keystone',
  # DEPRECATED PARAMETERS
  $keystone_identity_uri          = undef,
+  $keystone_user                  = undef,
+  $keystone_tenant                = undef,
+  $keystone_password              = undef,
+  $keystone_auth_uri              = undef,
+  $keystone_auth_url              = undef,
+  $keystone_project_domain_name   = undef,
+  $keystone_user_domain_name      = undef,
+  $keystone_auth_type             = undef,
+  $memcached_servers              = undef,
 ) inherits aodh::params {

  if $keystone_identity_uri {
-    warning('keystone_identity_uri is deprecated, and will be removed in a future release.')
-    $keystone_auth_url_real = $keystone_identity_uri
-  } else {
-    $keystone_auth_url_real = $keystone_auth_url
+    warning('aodh::api::keystone_identity_uri is deprecated, user aodh::keystone::authtoken::auth_url instead.')
+  }
+
+  if $keystone_user {
+    warning('aodh::api::keystone_user is deprecated, use aodh::keystone::authtoken::username instead')
+  }
+
+  if $keystone_tenant {
+    warning('aodh::api::keystone_tenant is deprecated, use aodh::keystone::authtoken::project_name instead')
+  }
+
+  if $keystone_password {
+    warning('aodh::api::keystone_password is deprecated, use aodh::keystone::authtoken::password instead')
+  }
+
+  if $keystone_auth_uri {
+    warning('aodh::api::keystone_auth_uri is deprecated, use aodh::keystone::authtoken::auth_uri instead')
+  }
+
+  if $keystone_project_domain_name {
+    warning('aodh::api::keystone_project_domain_name is deprecated, use aodh::keystone::authtoken::project_domain_name instead')
+  }
+
+  if $keystone_user_domain_name {
+    warning('aodh::api::keystone_user_domain_name is deprecated, use aodh::keystone::authtoken::user_domain_name instead')
+  }
+
+  if $keystone_auth_type {
+    warning('aodh::api::keystone_auth_type is deprecated, use aodh::keystone::authtoken::auth_type instead')
+  }
+
+  if $memcached_servers {
+    warning('aodh::api::memcached_servers is deprecated, use aodh::keystone::authtoken::memcached_servers instead.')
  }

  include ::aodh::params
  include ::aodh::policy

-  validate_string($keystone_password)
+  if $auth_strategy == 'keystone' {
+    include ::aodh::keystone::authtoken
+  }

  Aodh_config<||> ~> Service[$service_name]
  Class['aodh::policy'] ~> Service[$service_name]
@ -164,15 +197,6 @@ class aodh::api (
  }

  aodh_config {
-    'keystone_authtoken/auth_uri'            : value => $keystone_auth_uri;
-    'keystone_authtoken/auth_url'            : value => $keystone_auth_url_real;
-    'keystone_authtoken/project_name'        : value => $keystone_tenant;
-    'keystone_authtoken/project_domain_name' : value => $keystone_project_domain_name;
-    'keystone_authtoken/user_domain_name'    : value => $keystone_user_domain_name;
-    'keystone_authtoken/auth_type'           : value => $keystone_auth_type;
-    'keystone_authtoken/username'            : value => $keystone_user;
-    'keystone_authtoken/password'            : value => $keystone_password, secret => true;
-    'keystone_authtoken/memcached_servers'   : value => join(any2array($memcached_servers), ',');
    'api/host': value => $host;
    'api/port': value => $port;
  }
--- a/manifests/keystone/authtoken.pp
+++ b/manifests/keystone/authtoken.pp
@ -0,0 +1,280 @@
+# class: aodh::keystone::authtoken
+#
+# Configure the keystone_authtoken section in the configuration file
+#
+# === Parameters
+#
+# [*username*]
+#   (Optional) The name of the service user
+#   Defaults to 'aodh'
+#
+# [*password*]
+#   (Optional) Password to create for the service user
+#   Defaults to $::os_service_default
+#
+# [*auth_url*]
+#   (Optional) The URL to use for authentication.
+#   Defaults to 'http://localhost:35357'
+#
+# [*project_name*]
+#   (Optional) Service project name
+#   Defaults to 'services'
+#
+# [*user_domain_name*]
+#   (Optional) Name of domain for $username
+#   Defaults to 'Default'
+#
+# [*project_domain_name*]
+#   (Optional) Name of domain for $project_name
+#   Defaults to 'Default'
+#
+# [*insecure*]
+#   (Optional) If true, explicitly allow TLS without checking server cert
+#   against any certificate authorities.  WARNING: not recommended.  Use with
+#   caution.
+#   Defaults to $::os_service_default
+#
+# [*auth_section*]
+#   (Optional) Config Section from which to load plugin specific options
+#   Defaults to $::os_service_default.
+#
+# [*auth_type*]
+#   (Optional) Authentication type to load
+#   Defaults to 'password'
+#
+# [*auth_uri*]
+#   (Optional) Complete public Identity API endpoint.
+#   Defaults to 'http://localhost:5000'
+#
+# [*auth_version*]
+#   (Optional) API version of the admin Identity API endpoint.
+#   Defaults to $::os_service_default.
+#
+# [*cache*]
+#   (Optional) Env key for the swift cache.
+#   Defaults to $::os_service_default.
+#
+# [*cafile*]
+#   (Optional) A PEM encoded Certificate Authority to use when verifying HTTPs
+#   connections.
+#   Defaults to $::os_service_default.
+#
+# [*certfile*]
+#   (Optional) Required if identity server requires client certificate
+#   Defaults to $::os_service_default.
+#
+# [*check_revocations_for_cached*]
+#   (Optional) If true, the revocation list will be checked for cached tokens.
+#   This requires that PKI tokens are configured on the identity server.
+#   boolean value.
+#   Defaults to $::os_service_default.
+#
+# [*delay_auth_decision*]
+#   (Optional) Do not handle authorization requests within the middleware, but
+#   delegate the authorization decision to downstream WSGI components. Boolean
+#   value
+#   Defaults to $::os_service_default.
+#
+# [*enforce_token_bind*]
+#   (Optional) Used to control the use and type of token binding. Can be set
+#   to: "disabled" to not check token binding. "permissive" (default) to
+#   validate binding information if the bind type is of a form known to the
+#   server and ignore it if not. "strict" like "permissive" but if the bind
+#   type is unknown the token will be rejected. "required" any form of token
+#   binding is needed to be allowed. Finally the name of a binding method that
+#   must be present in tokens. String value.
+#   Defaults to $::os_service_default.
+#
+# [*hash_algorithms*]
+#   (Optional) Hash algorithms to use for hashing PKI tokens. This may be a
+#   single algorithm or multiple. The algorithms are those supported by Python
+#   standard hashlib.new(). The hashes will be tried in the order given, so put
+#   the preferred one first for performance. The result of the first hash will
+#  be stored in the cache. This will typically be set to multiple values only
+#   while migrating from a less secure algorithm to a more secure one. Once all
+#   the old tokens are expired this option should be set to a single value for
+#   better performance. List value.
+#   Defaults to $::os_service_default.
+#
+# [*http_connect_timeout*]
+#   (Optional) Request timeout value for communicating with Identity API
+#   server.
+#   Defaults to $::os_service_default.
+#
+# [*http_request_max_retries*]
+#   (Optional) How many times are we trying to reconnect when communicating
+#   with Identity API Server. Integer value
+#   Defaults to $::os_service_default.
+#
+# [*include_service_catalog*]
+#   (Optional) Indicate whether to set the X-Service-Catalog header. If False,
+#   middleware will not ask for service catalog on token validation and will
+#   not set the X-Service-Catalog header. Boolean value.
+#   Defaults to $::os_service_default.
+#
+# [*keyfile*]
+#   (Optional) Required if identity server requires client certificate
+#   Defaults to $::os_service_default.
+#
+# [*memcache_pool_conn_get_timeout*]
+#   (Optional) Number of seconds that an operation will wait to get a memcached
+#   client connection from the pool. Integer value
+#   Defaults to $::os_service_default.
+#
+# [*memcache_pool_dead_retry*]
+#   (Optional) Number of seconds memcached server is considered dead before it
+#   is tried again. Integer value
+#   Defaults to $::os_service_default.
+#
+# [*memcache_pool_maxsize*]
+#   (Optional) Maximum total number of open connections to every memcached
+#   server. Integer value
+#   Defaults to $::os_service_default.
+#
+# [*memcache_pool_socket_timeout*]
+#   (Optional) Number of seconds a connection to memcached is held unused in
+#   the pool before it is closed. Integer value
+#   Defaults to $::os_service_default.
+#
+# [*memcache_pool_unused_timeout*]
+#   (Optional) Number of seconds a connection to memcached is held unused in
+#   the pool before it is closed. Integer value
+#   Defaults to $::os_service_default.
+#
+# [*memcache_secret_key*]
+#   (Optional, mandatory if memcache_security_strategy is defined) This string
+#   is used for key derivation.
+#   Defaults to $::os_service_default.
+#
+# [*memcache_security_strategy*]
+#   (Optional) If defined, indicate whether token data should be authenticated
+#   or authenticated and encrypted. If MAC, token data is authenticated (with
+#   HMAC) in the cache. If ENCRYPT, token data is encrypted and authenticated in the
+#   cache. If the value is not one of these options or empty, auth_token will
+#   raise an exception on initialization.
+#   Defaults to $::os_service_default.
+#
+# [*memcache_use_advanced_pool*]
+#   (Optional)  Use the advanced (eventlet safe) memcached client pool. The
+#   advanced pool will only work under python 2.x Boolean value
+#   Defaults to $::os_service_default.
+#
+# [*memcached_servers*]
+#   (Optional) Optionally specify a list of memcached server(s) to use for
+#   caching. If left undefined, tokens will instead be cached in-process.
+#   Defaults to $::os_service_default.
+#
+# [*region_name*]
+#   (Optional) The region in which the identity server can be found.
+#   Defaults to $::os_service_default.
+#
+# [*revocation_cache_time*]
+#   (Optional) Determines the frequency at which the list of revoked tokens is
+#   retrieved from the Identity service (in seconds). A high number of
+#   revocation events combined with a low cache duration may significantly
+#   reduce performance. Only valid for PKI tokens. Integer value
+#   Defaults to $::os_service_default.
+#
+# [*signing_dir*]
+#   (Optional) Directory used to cache files related to PKI tokens.
+#   Defaults to $::os_service_default.
+#
+# [*token_cache_time*]
+#   (Optional) In order to prevent excessive effort spent validating tokens,
+#   the middleware caches previously-seen tokens for a configurable duration
+#   (in seconds). Set to -1 to disable caching completely. Integer value
+#   Defaults to $::os_service_default.
+#
+class aodh::keystone::authtoken(
+  $username                       = 'aodh',
+  $password                       = $::os_service_default,
+  $auth_url                       = 'http://localhost:35357',
+  $project_name                   = 'services',
+  $user_domain_name               = 'Default',
+  $project_domain_name            = 'Default',
+  $insecure                       = $::os_service_default,
+  $auth_section                   = $::os_service_default,
+  $auth_type                      = 'password',
+  $auth_uri                       = 'http://localhost:5000',
+  $auth_version                   = $::os_service_default,
+  $cache                          = $::os_service_default,
+  $cafile                         = $::os_service_default,
+  $certfile                       = $::os_service_default,
+  $check_revocations_for_cached   = $::os_service_default,
+  $delay_auth_decision            = $::os_service_default,
+  $enforce_token_bind             = $::os_service_default,
+  $hash_algorithms                = $::os_service_default,
+  $http_connect_timeout           = $::os_service_default,
+  $http_request_max_retries       = $::os_service_default,
+  $include_service_catalog        = $::os_service_default,
+  $keyfile                        = $::os_service_default,
+  $memcache_pool_conn_get_timeout = $::os_service_default,
+  $memcache_pool_dead_retry       = $::os_service_default,
+  $memcache_pool_maxsize          = $::os_service_default,
+  $memcache_pool_socket_timeout   = $::os_service_default,
+  $memcache_pool_unused_timeout   = $::os_service_default,
+  $memcache_secret_key            = $::os_service_default,
+  $memcache_security_strategy     = $::os_service_default,
+  $memcache_use_advanced_pool     = $::os_service_default,
+  $memcached_servers              = $::os_service_default,
+  $region_name                    = $::os_service_default,
+  $revocation_cache_time          = $::os_service_default,
+  $signing_dir                    = $::os_service_default,
+  $token_cache_time               = $::os_service_default,
+) {
+
+  if is_service_default($password) and ! $::aodh::api::keystone_password {
+    fail('Please set password for Aodh service user')
+  }
+
+  $username_real = pick($::aodh::api::keystone_user, $username)
+  $password_real = pick($::aodh::api::keystone_password, $password)
+  $project_name_real = pick($::aodh::api::keystone_tenant, $project_name)
+  $auth_uri_real = pick($::aodh::api::keystone_auth_uri, $auth_uri)
+  $auth_url_real = pick($::aodh::api::keystone_identity_uri,
+$::aodh::api::keystone_auth_url, $auth_url)
+  $memcached_servers_real = pick($::aodh::api::memcached_servers, $memcached_servers)
+  $user_domain_name_real = pick($::aodh::api::keystone_user_domain_name,
+$user_domain_name)
+  $project_domain_name_real = pick($::aodh::api::keystone_project_domain_name, $project_domain_name)
+  $auth_type_real = pick($::aodh::api::keystone_auth_type, $auth_type)
+
+
+  keystone::resource::authtoken { 'aodh_config':
+    username                       => $username_real,
+    password                       => $password_real,
+    project_name                   => $project_name_real,
+    auth_url                       => $auth_url_real,
+    auth_uri                       => $auth_uri_real,
+    auth_version                   => $auth_version,
+    auth_type                      => $auth_type_real,
+    auth_section                   => $auth_section,
+    user_domain_name               => $user_domain_name_real,
+    project_domain_name            => $project_domain_name_real,
+    insecure                       => $insecure,
+    cache                          => $cache,
+    cafile                         => $cafile,
+    certfile                       => $certfile,
+    check_revocations_for_cached   => $check_revocations_for_cached,
+    delay_auth_decision            => $delay_auth_decision,
+    enforce_token_bind             => $enforce_token_bind,
+    hash_algorithms                => $hash_algorithms,
+    http_connect_timeout           => $http_connect_timeout,
+    http_request_max_retries       => $http_request_max_retries,
+    include_service_catalog        => $include_service_catalog,
+    keyfile                        => $keyfile,
+    memcache_pool_conn_get_timeout => $memcache_pool_conn_get_timeout,
+    memcache_pool_dead_retry       => $memcache_pool_dead_retry,
+    memcache_pool_maxsize          => $memcache_pool_maxsize,
+    memcache_pool_socket_timeout   => $memcache_pool_socket_timeout,
+    memcache_secret_key            => $memcache_secret_key,
+    memcache_security_strategy     => $memcache_security_strategy,
+    memcache_use_advanced_pool     => $memcache_use_advanced_pool,
+    memcache_pool_unused_timeout   => $memcache_pool_unused_timeout,
+    memcached_servers              => $memcached_servers_real,
+    region_name                    => $region_name,
+    revocation_cache_time          => $revocation_cache_time,
+    signing_dir                    => $signing_dir,
+    token_cache_time               => $token_cache_time,
+  }
+}
--- a/releasenotes/notes/authtoken_resource-1b264c4c326a462c.yaml
+++ b/releasenotes/notes/authtoken_resource-1b264c4c326a462c.yaml
@ -0,0 +1,25 @@
+---
+features:
+  - Configure keystonemiddleware in a consistent way with all options required
+    for Keystone v3.
+deprecations:
+  - aodh::api::keystone_tenant is deprecated in favor of
+    aodh::keystone::authtoken::project_name.
+  - aodh::api::keystone_user is deprecated in favor of
+    aodh::keystone::authtoken::username.
+  - aodh::api::keystone_password is deprecated in favor of
+    aodh::keystone::authtoken::password.
+  - aodh::api::keystone_project_domain_name is deprecated in favor of
+    aodh::keystone::authtoken::project_domain_name
+  - aodh::api::keystone_user_domain_name is deprecated in favor of
+    aodh::keystone::authtoken::user_domain_name
+  - aodh::api::keystone_auth_type is deprecated in favor of
+    aodh::keystone::authtoken::auth_type
+  - aodh::api::keystone_auth_uri is deprecated in favor of
+    aodh::keystone::authtoken::auth_uri
+  - aodh::api::keystone_identity_uri is deprecated in favor of
+    aodh::keystone::authtoken::auth_url
+  - aodh::api::keystone_auth_url is deprecated in favor of
+    aodh::keystone::authtoken::auth_url
+  - aodh::api::memcached_servers is deprecated in favor of
+    aodh::keystone::authtoken::memcached_servers
--- a/spec/acceptance/aodh_wsgi_apache_spec.rb
+++ b/spec/acceptance/aodh_wsgi_apache_spec.rb
@ -42,10 +42,11 @@ describe 'basic aodh' do
      class { '::aodh::keystone::auth':
        password => 'a_big_secret',
      }
+      class { '::aodh::keystone::authtoken':
+        password => 'a_big_secret',
+      }
      class { '::aodh::api':
        enabled      => true,
-        keystone_password     => 'a_big_secret',
-        keystone_auth_uri     => 'http://127.0.0.1:5000',
        service_name => 'httpd',
      }
      include ::apache
--- a/spec/classes/aodh_api_spec.rb
+++ b/spec/classes/aodh_api_spec.rb
@ -11,11 +11,6 @@ describe 'aodh::api' do
    { :enabled           => true,
      :manage_service    => true,
      :keystone_password => 'aodh-passw0rd',
-      :keystone_tenant              => 'services',
-      :keystone_user                => 'aodh',
-      :keystone_project_domain_name => 'default',
-      :keystone_user_domain_name    => 'default',
-      :keystone_auth_type           => 'password',
      :package_ensure    => 'latest',
      :port              => '8042',
      :host              => '0.0.0.0',
@ -24,11 +19,6 @@ describe 'aodh::api' do

  shared_examples_for 'aodh-api' do

-    context 'without required parameter keystone_password' do
-      before { params.delete(:keystone_password) }
-      it { expect { is_expected.to raise_error(Puppet::Error) } }
-    end
-
    it { is_expected.to contain_class('aodh::params') }
    it { is_expected.to contain_class('aodh::policy') }

@ -40,14 +30,7 @@ describe 'aodh::api' do
      )
    end

-    it 'configures keystone authentication middleware' do
-      is_expected.to contain_aodh_config('keystone_authtoken/project_name').with_value( params[:keystone_tenant] )
-      is_expected.to contain_aodh_config('keystone_authtoken/username').with_value( params[:keystone_user] )
-      is_expected.to contain_aodh_config('keystone_authtoken/password').with_value( params[:keystone_password] ).with_secret(true)
-      is_expected.to contain_aodh_config('keystone_authtoken/project_domain_name').with_value( params[:keystone_project_domain_name] )
-      is_expected.to contain_aodh_config('keystone_authtoken/user_domain_name').with_value( params[:keystone_user_domain_name] )
-      is_expected.to contain_aodh_config('keystone_authtoken/auth_type').with_value( params[:keystone_auth_type] )
-      is_expected.to contain_aodh_config('keystone_authtoken/memcached_servers').with_value('<SERVICE DEFAULT>')
+    it 'configures api' do
      is_expected.to contain_aodh_config('api/host').with_value( params[:host] )
      is_expected.to contain_aodh_config('api/port').with_value( params[:port] )
    end
@ -80,6 +63,44 @@ describe 'aodh::api' do
      it { is_expected.to contain_class('aodh::db::sync') }
    end

+
+    context 'with deprecated parameters' do
+      before do
+        params.merge!({
+          :keystone_user                => 'dummy',
+          :keystone_password            => 'mypassword',
+          :keystone_tenant              => 'tenant',
+          :keystone_auth_uri            => 'https://10.0.0.1:5000/deprecated',
+          :keystone_identity_uri        => 'https://10.0.0.1:35357/deprecated',
+          :keystone_auth_url            => 'https://10.0.0.1:35357/deprecated',
+          :memcached_servers            => ['memcached01:11211','memcached02:11211'],
+          :keystone_project_domain_name => 'domainX',
+          :keystone_user_domain_name    => 'domainX',
+          :keystone_auth_type           => 'auth',
+        })
+      end
+      it 'configures keystone_authtoken middleware' do
+        is_expected.to contain_aodh_config(
+          'keystone_authtoken/auth_uri').with_value('https://10.0.0.1:5000/deprecated')
+        is_expected.to contain_aodh_config(
+          'keystone_authtoken/username').with_value(params[:keystone_user])
+        is_expected.to contain_aodh_config(
+          'keystone_authtoken/password').with_value(params[:keystone_password]).with_secret(true)
+        is_expected.to contain_aodh_config(
+          'keystone_authtoken/auth_url').with_value(params[:keystone_identity_uri])
+        is_expected.to contain_aodh_config(
+          'keystone_authtoken/project_name').with_value(params[:keystone_tenant])
+        is_expected.to contain_aodh_config(
+          'keystone_authtoken/user_domain_name').with_value(params[:keystone_user_domain_name])
+        is_expected.to contain_aodh_config(
+          'keystone_authtoken/project_domain_name').with_value(params[:keystone_project_domain_name])
+        is_expected.to contain_aodh_config(
+          'keystone_authtoken/auth_type').with_value(params[:keystone_auth_type])
+        is_expected.to contain_aodh_config(
+          'keystone_authtoken/memcached_servers').with_value('memcached01:11211,memcached02:11211')
+      end
+    end
+
    context 'with disabled service managing' do
      before do
        params.merge!({
@ -134,40 +155,29 @@ describe 'aodh::api' do
      it_raises 'a Puppet::Error', /Invalid service_name/
    end

-    context "with custom keystone auth_uri" do
-      before do
-        params.merge!({
-          :keystone_auth_uri => 'https://foo.bar:5000',
-          :keystone_auth_url => 'https://foo.bar:35357',
-        })
-      end
-      it 'configures auth_uri but deprecates old auth settings' do
-        is_expected.to contain_aodh_config('keystone_authtoken/auth_uri').with_value("https://foo.bar:5000");
-        is_expected.to contain_aodh_config('keystone_authtoken/auth_url').with_value("https://foo.bar:35357");
-      end
-    end
-
-    context "with memcached servers" do
-      before do
-        params.merge!({
-          :memcached_servers => '1.1.1.1:11211',
-        })
-      end
-      it 'configures auth_uri but deprecates old auth settings' do
-        is_expected.to contain_aodh_config('keystone_authtoken/memcached_servers').with_value('1.1.1.1:11211');
-      end
-    end
-
-    context "with deprecated keystone auth_uri" do
+    context "with deprecated keystone options" do
      before do
        params.merge!({
+          :keystone_user                => 'user',
+          :keystone_password            => 'userpassword',
+          :keystone_tenant              => 'tenant',
+          :keystone_project_domain_name => 'domainx',
+          :keystone_user_domain_name    => 'domainx',
+          :keystone_auth_type           => 'password',
          :keystone_auth_uri            => 'https://foo.bar:5000',
+          :keystone_auth_url            => 'https://foo.bar:35357/deprecated',
          :keystone_identity_uri        => 'https://foo.bar:35357/deprecated',
        })
      end
      it 'configures auth_uri but deprecates old auth settings' do
        is_expected.to contain_aodh_config('keystone_authtoken/auth_uri').with_value("https://foo.bar:5000");
        is_expected.to contain_aodh_config('keystone_authtoken/auth_url').with_value("https://foo.bar:35357/deprecated");
+        is_expected.to contain_aodh_config('keystone_authtoken/username').with_value('user')
+        is_expected.to contain_aodh_config('keystone_authtoken/password').with_value('userpassword')
+        is_expected.to contain_aodh_config('keystone_authtoken/project_name').with_value('tenant')
+        is_expected.to contain_aodh_config('keystone_authtoken/user_domain_name').with_value('domainx')
+        is_expected.to contain_aodh_config('keystone_authtoken/project_domain_name').with_value('domainx')
+        is_expected.to contain_aodh_config('keystone_authtoken/auth_type').with_value('password')
      end
    end
  end
--- a/spec/classes/aodh_keystone_authtoken_spec.rb
+++ b/spec/classes/aodh_keystone_authtoken_spec.rb
@ -0,0 +1,147 @@
+require 'spec_helper'
+
+describe 'aodh::keystone::authtoken' do
+
+  let :params do
+    { :password => 'aodh_password', }
+  end
+
+  shared_examples 'aodh authtoken' do
+
+    context 'with default parameters' do
+
+      it 'configure keystone_authtoken' do
+        is_expected.to contain_aodh_config('keystone_authtoken/username').with_value('aodh')
+        is_expected.to contain_aodh_config('keystone_authtoken/password').with_value('aodh_password')
+        is_expected.to contain_aodh_config('keystone_authtoken/auth_url').with_value('http://localhost:35357')
+        is_expected.to contain_aodh_config('keystone_authtoken/project_name').with_value('services')
+        is_expected.to contain_aodh_config('keystone_authtoken/user_domain_name').with_value('Default')
+        is_expected.to contain_aodh_config('keystone_authtoken/project_domain_name').with_value('Default')
+        is_expected.to contain_aodh_config('keystone_authtoken/insecure').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/auth_section').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/auth_type').with_value('password')
+        is_expected.to contain_aodh_config('keystone_authtoken/auth_uri').with_value('http://localhost:5000')
+        is_expected.to contain_aodh_config('keystone_authtoken/auth_version').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/cache').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/cafile').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/certfile').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/check_revocations_for_cached').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/delay_auth_decision').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/enforce_token_bind').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/hash_algorithms').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/http_connect_timeout').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/http_request_max_retries').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/include_service_catalog').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/keyfile').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/memcache_pool_dead_retry').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/memcache_pool_maxsize').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/memcache_pool_socket_timeout').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/memcache_pool_unused_timeout').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/memcache_secret_key').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/memcache_security_strategy').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/memcache_use_advanced_pool').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/memcached_servers').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/region_name').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/revocation_cache_time').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/signing_dir').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_aodh_config('keystone_authtoken/token_cache_time').with_value('<SERVICE DEFAULT>')
+      end
+    end
+
+    context 'when overriding parameters' do
+      before do
+        params.merge!({
+          :auth_uri                             => 'https://10.0.0.1:9999/',
+          :username                             => 'myuser',
+          :password                             => 'mypasswd',
+          :auth_url                             => 'http://:127.0.0.1:35357',
+          :project_name                         => 'service_project',
+          :user_domain_name                     => 'domainX',
+          :project_domain_name                  => 'domainX',
+          :insecure                             => false,
+          :auth_section                         => 'new_section',
+          :auth_type                            => 'password',
+          :auth_version                         => 'v3',
+          :cache                                => 'somevalue',
+          :cafile                               =>
+'/opt/stack/data/cafile.pem',
+          :certfile                             => 'certfile.crt',
+          :check_revocations_for_cached         => false,
+          :delay_auth_decision                  => false,
+          :enforce_token_bind                   => 'permissive',
+          :hash_algorithms                      => 'md5',
+          :http_connect_timeout                 => '300',
+          :http_request_max_retries             => '3',
+          :include_service_catalog              => true,
+          :keyfile                              => 'keyfile',
+          :memcache_pool_conn_get_timeout       => '9',
+          :memcache_pool_dead_retry             => '302',
+          :memcache_pool_maxsize                => '11',
+          :memcache_pool_socket_timeout         => '2',
+          :memcache_pool_unused_timeout         => '61',
+          :memcache_secret_key                  => 'secret_key',
+          :memcache_security_strategy           => 'ENCRYPT',
+          :memcache_use_advanced_pool           => true,
+          :memcached_servers                    =>
+['memcached01:11211','memcached02:11211'],
+          :region_name                          => 'region2',
+          :revocation_cache_time                => '11',
+          :signing_dir                          => '/var/cache',
+          :token_cache_time                     => '301',
+        })
+      end
+
+      it 'configure keystone_authtoken' do
+        is_expected.to contain_aodh_config('keystone_authtoken/auth_uri').with_value('https://10.0.0.1:9999/')
+        is_expected.to contain_aodh_config('keystone_authtoken/username').with_value(params[:username])
+        is_expected.to contain_aodh_config('keystone_authtoken/password').with_value(params[:password]).with_secret(true)
+        is_expected.to contain_aodh_config('keystone_authtoken/auth_url').with_value(params[:auth_url])
+        is_expected.to contain_aodh_config('keystone_authtoken/project_name').with_value(params[:project_name])
+        is_expected.to contain_aodh_config('keystone_authtoken/user_domain_name').with_value(params[:user_domain_name])
+        is_expected.to contain_aodh_config('keystone_authtoken/project_domain_name').with_value(params[:project_domain_name])
+        is_expected.to contain_aodh_config('keystone_authtoken/insecure').with_value(params[:insecure])
+        is_expected.to contain_aodh_config('keystone_authtoken/auth_section').with_value(params[:auth_section])
+        is_expected.to contain_aodh_config('keystone_authtoken/auth_type').with_value(params[:auth_type])
+        is_expected.to contain_aodh_config('keystone_authtoken/auth_version').with_value(params[:auth_version])
+        is_expected.to contain_aodh_config('keystone_authtoken/cache').with_value(params[:cache])
+        is_expected.to contain_aodh_config('keystone_authtoken/cafile').with_value(params[:cafile])
+        is_expected.to contain_aodh_config('keystone_authtoken/certfile').with_value(params[:certfile])
+        is_expected.to contain_aodh_config('keystone_authtoken/check_revocations_for_cached').with_value(params[:check_revocations_for_cached])
+        is_expected.to contain_aodh_config('keystone_authtoken/delay_auth_decision').with_value(params[:delay_auth_decision])
+        is_expected.to contain_aodh_config('keystone_authtoken/enforce_token_bind').with_value(params[:enforce_token_bind])
+        is_expected.to contain_aodh_config('keystone_authtoken/hash_algorithms').with_value(params[:hash_algorithms])
+        is_expected.to contain_aodh_config('keystone_authtoken/http_connect_timeout').with_value(params[:http_connect_timeout])
+        is_expected.to contain_aodh_config('keystone_authtoken/http_request_max_retries').with_value(params[:http_request_max_retries])
+        is_expected.to contain_aodh_config('keystone_authtoken/include_service_catalog').with_value(params[:include_service_catalog])
+        is_expected.to contain_aodh_config('keystone_authtoken/keyfile').with_value(params[:keyfile])
+        is_expected.to contain_aodh_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value(params[:memcache_pool_conn_get_timeout])
+        is_expected.to contain_aodh_config('keystone_authtoken/memcache_pool_dead_retry').with_value(params[:memcache_pool_dead_retry])
+        is_expected.to contain_aodh_config('keystone_authtoken/memcache_pool_maxsize').with_value(params[:memcache_pool_maxsize])
+        is_expected.to contain_aodh_config('keystone_authtoken/memcache_pool_socket_timeout').with_value(params[:memcache_pool_socket_timeout])
+        is_expected.to contain_aodh_config('keystone_authtoken/memcache_pool_unused_timeout').with_value(params[:memcache_pool_unused_timeout])
+        is_expected.to contain_aodh_config('keystone_authtoken/memcache_secret_key').with_value(params[:memcache_secret_key])
+        is_expected.to contain_aodh_config('keystone_authtoken/memcache_security_strategy').with_value(params[:memcache_security_strategy])
+        is_expected.to contain_aodh_config('keystone_authtoken/memcache_use_advanced_pool').with_value(params[:memcache_use_advanced_pool])
+        is_expected.to contain_aodh_config('keystone_authtoken/memcached_servers').with_value('memcached01:11211,memcached02:11211')
+        is_expected.to contain_aodh_config('keystone_authtoken/region_name').with_value(params[:region_name])
+        is_expected.to contain_aodh_config('keystone_authtoken/revocation_cache_time').with_value(params[:revocation_cache_time])
+        is_expected.to contain_aodh_config('keystone_authtoken/signing_dir').with_value(params[:signing_dir])
+        is_expected.to contain_aodh_config('keystone_authtoken/token_cache_time').with_value(params[:token_cache_time])
+      end
+    end
+  end
+
+  on_supported_os({
+    :supported_os => OSDefaults.get_supported_os
+  }).each do |os,facts|
+    context "on #{os}" do
+      let (:facts) do
+        facts.merge!(OSDefaults.get_facts())
+      end
+
+      it_configures 'aodh authtoken'
+    end
+  end
+
+end