Move Glance to new authtoken scheme

Use glance::<service>::authtoken to configure keystone_authtoken
section in glance configs, with all parameters required
to configure keystonemiddleware.

Also changed auth_type to auth_strategy, because auth_type is
related to keystone authentication.

Change-Id: I722a1e41b2cee0b3040c37f07adfd13c33edaa5c
Closes-bug: #1604463

lib/puppet/provider/glance.rb

@@ -18,9 +18,9 @@ class Puppet::Provider::Glance < Puppet::Provider::Openstack
   end
 
   def self.glance_request(service, action, error, properties=nil)
-    @credentials.username = glance_credentials['admin_user']
+    @credentials.username = glance_credentials['username']
-    @credentials.password = glance_credentials['admin_password']
+    @credentials.password = glance_credentials['password']
-    @credentials.project_name = glance_credentials['admin_tenant_name']
+    @credentials.project_name = glance_credentials['project_name']
     @credentials.auth_url = auth_endpoint
     raise error unless @credentials.set?
     Puppet::Provider::Openstack.request(service, action, properties, @credentials)
@@ -35,18 +35,18 @@ class Puppet::Provider::Glance < Puppet::Provider::Openstack
       glance_file['keystone_authtoken']['auth_host'] and
       glance_file['keystone_authtoken']['auth_port'] and
       glance_file['keystone_authtoken']['auth_protocol'] and
-      glance_file['keystone_authtoken']['admin_tenant_name'] and
+      glance_file['keystone_authtoken']['project_name'] and
-      glance_file['keystone_authtoken']['admin_user'] and
+      glance_file['keystone_authtoken']['username'] and
-      glance_file['keystone_authtoken']['admin_password'] and
+      glance_file['keystone_authtoken']['password'] and
       glance_file['glance_store']['os_region_name']
 
         g = {}
         g['auth_host'] = glance_file['keystone_authtoken']['auth_host'].strip
         g['auth_port'] = glance_file['keystone_authtoken']['auth_port'].strip
         g['auth_protocol'] = glance_file['keystone_authtoken']['auth_protocol'].strip
-        g['admin_tenant_name'] = glance_file['keystone_authtoken']['admin_tenant_name'].strip
+        g['project_name'] = glance_file['keystone_authtoken']['project_name'].strip
-        g['admin_user'] = glance_file['keystone_authtoken']['admin_user'].strip
+        g['username'] = glance_file['keystone_authtoken']['username'].strip
-        g['admin_password'] = glance_file['keystone_authtoken']['admin_password'].strip
+        g['password'] = glance_file['keystone_authtoken']['password'].strip
         g['os_region_name'] = glance_file['glance_store']['os_region_name'].strip
 
         # auth_admin_prefix not required to be set.
@@ -54,17 +54,17 @@ class Puppet::Provider::Glance < Puppet::Provider::Openstack
 
         return g
     elsif glance_file and glance_file['keystone_authtoken'] and
-      glance_file['keystone_authtoken']['identity_uri'] and
+      glance_file['keystone_authtoken']['auth_url'] and
-      glance_file['keystone_authtoken']['admin_tenant_name'] and
+      glance_file['keystone_authtoken']['project_name'] and
-      glance_file['keystone_authtoken']['admin_user'] and
+      glance_file['keystone_authtoken']['username'] and
-      glance_file['keystone_authtoken']['admin_password'] and
+      glance_file['keystone_authtoken']['password'] and
       glance_file['glance_store']['os_region_name']
 
         g = {}
-        g['identity_uri'] = glance_file['keystone_authtoken']['identity_uri'].strip
+        g['auth_url'] = glance_file['keystone_authtoken']['auth_url'].strip
-        g['admin_tenant_name'] = glance_file['keystone_authtoken']['admin_tenant_name'].strip
+        g['project_name'] = glance_file['keystone_authtoken']['project_name'].strip
-        g['admin_user'] = glance_file['keystone_authtoken']['admin_user'].strip
+        g['username'] = glance_file['keystone_authtoken']['username'].strip
-        g['admin_password'] = glance_file['keystone_authtoken']['admin_password'].strip
+        g['password'] = glance_file['keystone_authtoken']['password'].strip
         g['os_region_name'] = glance_file['glance_store']['os_region_name'].strip
 
         return g
@@ -79,8 +79,8 @@ class Puppet::Provider::Glance < Puppet::Provider::Openstack
 
   def self.get_auth_endpoint
     g = glance_credentials
-    if g.key?('identity_uri')
+    if g.key?('auth_url')
-      "#{g['identity_uri']}/"
+      "#{g['auth_url']}/"
     else
       "#{g['auth_protocol']}://#{g['auth_host']}:#{g['auth_port']}#{g['auth_admin_prefix']}/v2.0/"
     end

manifests/api.pp

@@ -4,9 +4,6 @@
 #
 # == Parameters
 #
-# [*keystone_password*]
-#   (required) Password used to authentication.
-#
 # [*package_ensure*]
 #   (optional) Ensure state for package. On RedHat platforms this
 #   setting is ignored and the setting from the glance class is used
@@ -62,31 +59,15 @@
 #   (optional) Turn on/off delayed delete.
 #   Defaults to $::os_service_default.
 #
-# [*auth_type*]
+# [*auth_strategy*]
 #   (optional) Type is authorization being used.
 #   Defaults to 'keystone'
 #
-# [*auth_uri*]
-#   (optional) Complete public Identity API endpoint.
-#   Defaults to 'http://127.0.0.1:5000/'.
-#
-# [*identity_uri*]
-#   (optional) Complete admin Identity API endpoint.
-#   Defaults to 'http://127.0.0.1:35357/'.
-#
 # [*pipeline*]
 #   (optional) Partial name of a pipeline in your paste configuration file with the
 #   service name removed.
 #   Defaults to 'keystone'.
 #
-# [*keystone_tenant*]
-#   (optional) Tenant to authenticate to.
-#   Defaults to services.
-#
-# [*keystone_user*]
-#   (optional) User to authenticate as with keystone.
-#   Defaults to 'glance'.
-#
 # [*manage_service*]
 #   (optional) If Puppet should manage service startup / shutdown.
 #   Defaults to true.
@@ -213,21 +194,6 @@
 #   (optional) Sets the keystone region to use.
 #   Defaults to 'RegionOne'.
 #
-# [*signing_dir*]
-#   (optional) Directory used to cache files related to PKI tokens.
-#   Defaults to $::os_service_default.
-#
-# [*memcached_servers*]
-#   (optinal) a list of memcached server(s) to use for caching. If left undefined,
-#   tokens will instead be cached in-process.
-#   Defaults to $::os_service_default.
-#
-# [*token_cache_time*]
-#   (optional) In order to prevent excessive effort spent validating tokens,
-#   the middleware caches previously-seen tokens for a configurable duration (in seconds).
-#   Set to -1 to disable caching completely.
-#   Defaults to $::os_service_default.
-#
 # [*enable_proxy_headers_parsing*]
 #   (Optional) Enable paste middleware to handle SSL requests through
 #   HTTPProxyToWSGI middleware.
@@ -272,8 +238,55 @@
 #   then region name can be specified.
 #   Defaults to undef
 #
+# [*keystone_password*]
+#   (Optional) Password used to authentication.
+#   Deprecated and will be replaced by ::glance::api::authtoken::password
+#   Defaults to undef.
+#
+# [*auth_type*]
+#   (optional) Type is authorization being used.
+#   Deprecated and replaced by ::glance::api::auth_strategy
+#   Defaults to undef.
+#
+# [*auth_uri*]
+#   (optional) Complete public Identity API endpoint.
+#   Deprecated and will be replaced by ::glance::api::authtoken::auth_uri
+#   Defaults to undef.
+#
+# [*identity_uri*]
+#   (optional) Complete admin Identity API endpoint.
+#   Deprecated and will be replaced by ::glance::api::authtoken::auth_url
+#   Defaults to undef.
+#
+# [*keystone_tenant*]
+#   (optional) Tenant to authenticate to.
+#   Deprecated and will be replaced by ::glance::api::authtoken::project_name
+#   Defaults to undef.
+#
+# [*keystone_user*]
+#   (optional) User to authenticate as with keystone.
+#   Deprecated and will be replaced by ::glance::api::authtoken::username
+#   Defaults to undef.
+#
+# [*signing_dir*]
+#   (optional) Directory used to cache files related to PKI tokens.
+#   Deprecated and will be replaced by ::glance::api::authtoken::signing_dir
+#   Defaults to undef.
+#
+# [*memcached_servers*]
+#   (optinal) a list of memcached server(s) to use for caching. If left undefined,
+#   tokens will instead be cached in-process.
+#   Deprecated and will be replaced by ::glance::api::authtoken::memcached_servers
+#   Defaults to undef.
+#
+# [*token_cache_time*]
+#   (optional) In order to prevent excessive effort spent validating tokens,
+#   the middleware caches previously-seen tokens for a configurable duration (in seconds).
+#   Set to -1 to disable caching completely.
+#   Deprecated and will be replaced by ::glance::api::authtoken::token_cache_time
+#   Defaults to undef.
+#
 class glance::api(
-  $keystone_password,
   $package_ensure                       = 'present',
   $debug                                = undef,
   $bind_host                            = $::os_service_default,
@@ -287,13 +300,8 @@ class glance::api(
   $registry_client_protocol             = $::os_service_default,
   $scrub_time                           = $::os_service_default,
   $delayed_delete                       = $::os_service_default,
-  $auth_type                            = 'keystone',
+  $auth_strategy                        = 'keystone',
-  $auth_uri                             = 'http://127.0.0.1:5000/',
-  $identity_uri                         = 'http://127.0.0.1:35357/',
-  $memcached_servers                    = $::os_service_default,
   $pipeline                             = 'keystone',
-  $keystone_tenant                      = 'services',
-  $keystone_user                        = 'glance',
   $manage_service                       = true,
   $enabled                              = true,
   $use_syslog                           = undef,
@@ -323,8 +331,6 @@ class glance::api(
   $image_cache_stall_time               = $::os_service_default,
   $image_cache_dir                      = '/var/lib/glance/image-cache',
   $os_region_name                       = 'RegionOne',
-  $signing_dir                          = $::os_service_default,
-  $token_cache_time                     = $::os_service_default,
   $enable_proxy_headers_parsing         = $::os_service_default,
   $validate                             = false,
   $validation_options                   = {},
@@ -332,6 +338,15 @@ class glance::api(
   $known_stores                         = false,
   $verbose                              = undef,
   $auth_region                          = undef,
+  $keystone_password                    = undef,
+  $auth_type                            = undef,
+  $auth_uri                             = undef,
+  $identity_uri                         = undef,
+  $keystone_tenant                      = undef,
+  $keystone_user                        = undef,
+  $memcached_servers                    = undef,
+  $signing_dir                          = undef,
+  $token_cache_time                     = undef,
 ) inherits glance {
 
   include ::glance::deps
@@ -348,6 +363,45 @@ class glance::api(
     warning('auth_region is deprecated, has no effect and and will be removed in the O release.')
   }
 
+  if $keystone_password {
+    warning('glance::api::keystone_password is deprecated, please use glance::api::authtoken::password')
+  }
+
+  if $auth_type {
+    warning('glance::api::auth_type is deprecated, please use glance::api::auth_strategy')
+    $auth_strategy_real = $auth_type
+  } else {
+    $auth_strategy_real = $auth_strategy
+  }
+
+  if $auth_uri {
+    warning('glance::api::auth_uri is deprecated, please use glance::api::authtoken::auth_uri')
+  }
+
+  if $identity_uri {
+    warning('glance::api::identity_uri is deprecated, please use glance::api::authtoken::auth_url')
+  }
+
+  if $keystone_tenant {
+    warning('glance::api::keystone_tenant is deprecated, please use glance::api::authtoken::project_name')
+  }
+
+  if $keystone_user {
+    warning('glance::api::keystone_user is deprecated, please use glance::api::authtoken::username')
+  }
+
+  if $memcached_servers {
+    warning('glance::api::memcached_servers is deprecated, please use glance::api::authtoken::memcached_servers')
+  }
+
+  if $signing_dir {
+    warning('glance::api::signing_dir is deprecated, please use glance::api::authtoken::signing_dir')
+  }
+
+  if $token_cache_time {
+    warning('glance::api::token_cache_time is deprecated, please use glance::api::authtoken::token_cache_time')
+  }
+
   if ( $glance::params::api_package_name != $glance::params::registry_package_name ) {
     ensure_packages('glance-api',
       {
@@ -459,23 +513,8 @@ class glance::api(
   }
 
   # keystone config
-  if $auth_type == 'keystone' {
+  if $auth_strategy_real == 'keystone' {
-    glance_api_config {
+    include ::glance::api::authtoken
-      'keystone_authtoken/admin_tenant_name': value => $keystone_tenant;
-      'keystone_authtoken/admin_user':        value => $keystone_user;
-      'keystone_authtoken/admin_password':    value => $keystone_password, secret => true;
-      'keystone_authtoken/token_cache_time':  value => $token_cache_time;
-      'keystone_authtoken/signing_dir':       value => $signing_dir;
-      'keystone_authtoken/auth_uri':          value => $auth_uri;
-      'keystone_authtoken/identity_uri':      value => $identity_uri;
-      'keystone_authtoken/memcached_servers': value => join(any2array($memcached_servers), ',');
-    }
-    glance_cache_config {
-      'DEFAULT/auth_url'         : value => $auth_uri;
-      'DEFAULT/admin_tenant_name': value => $keystone_tenant;
-      'DEFAULT/admin_user'       : value => $keystone_user;
-      'DEFAULT/admin_password'   : value => $keystone_password, secret => true;
-    }
   }
 
   oslo::middleware { 'glance_api_config':
@@ -510,9 +549,13 @@ class glance::api(
   }
 
   if $validate {
+    $keystone_tenant_real   = pick($keystone_tenant, $::glance::api::authtoken::project_name)
+    $keystone_username_real = pick($keystone_user, $::glance::api::authtoken::username)
+    $keystone_password_real = pick($keystone_password, $::glance::api::authtoken::password)
+    $auth_uri_real          = pick($auth_uri, $::glance::api::authtoken::auth_uri)
     $defaults = {
       'glance-api' => {
-        'command'  => "glance --os-auth-url ${auth_uri} --os-tenant-name ${keystone_tenant} --os-username ${keystone_user} --os-password ${keystone_password} image-list",
+        'command'  => "glance --os-auth-url ${auth_uri_real} --os-project-name ${keystone_tenant_real} --os-username ${keystone_username_real} --os-password ${keystone_password_real} image-list",
       }
     }
     $validation_options_hash = merge ($defaults, $validation_options)

manifests/api/authtoken.pp

@@ -0,0 +1,282 @@
+# class: glance::api::authtoken
+#
+# Configure the keystone_authtoken section in the Glance API configuration file
+#
+# === Parameters
+#
+# [*username*]
+#   (Optional) The name of the service user
+#   Defaults to 'glance'
+#
+# [*password*]
+#   (Optional) Password to create for the service user
+#   Defaults to $::os_service_default
+#
+# [*auth_url*]
+#   (Optional) The URL to use for authentication.
+#   Defaults to 'http://127.0.0.1:35357'
+#
+# [*project_name*]
+#   (Optional) Service project name
+#   Defaults to 'services'
+#
+# [*user_domain_name*]
+#   (Optional) Name of domain for $username
+#   Defaults to $::os_service_default
+#
+# [*project_domain_name*]
+#   (Optional) Name of domain for $project_name
+#   Defaults to $::os_service_default
+#
+# [*insecure*]
+#  (Optional) If true, explicitly allow TLS without checking server cert
+#  against any certificate authorities.  WARNING: not recommended.  Use with
+#  caution.
+#  Defaults to $:os_service_default
+#
+# [*auth_section*]
+#  (Optional) Config Section from which to load plugin specific options
+#  Defaults to $::os_service_default.
+#
+# [*auth_type*]
+#  (Optional) Authentication type to load
+#  Defaults to 'password'
+#
+# [*auth_uri*]
+#  (Optional) Complete public Identity API endpoint.
+#  Defaults to 'http://127.0.0.1:5000'.
+#
+# [*auth_version*]
+#  (Optional) API version of the admin Identity API endpoint.
+#  Defaults to $::os_service_default.
+#
+# [*cache*]
+#  (Optional) Env key for the swift cache.
+#  Defaults to $::os_service_default.
+#
+# [*cafile*]
+#  (Optional) A PEM encoded Certificate Authority to use when verifying HTTPs
+#  connections.
+#  Defaults to $::os_service_default.
+#
+# [*certfile*]
+#  (Optional) Required if identity server requires client certificate
+#  Defaults to $::os_service_default.
+#
+# [*check_revocations_for_cached*]
+#  (Optional) If true, the revocation list will be checked for cached tokens.
+#  This requires that PKI tokens are configured on the identity server.
+#  boolean value.
+#  Defaults to $::os_service_default.
+#
+# [*delay_auth_decision*]
+#  (Optional) Do not handle authorization requests within the middleware, but
+#  delegate the authorization decision to downstream WSGI components. Boolean
+#  value
+#  Defaults to $::os_service_default.
+#
+# [*enforce_token_bind*]
+#  (Optional) Used to control the use and type of token binding. Can be set
+#  to: "disabled" to not check token binding. "permissive" (default) to
+#  validate binding information if the bind type is of a form known to the
+#  server and ignore it if not. "strict" like "permissive" but if the bind
+#  type is unknown the token will be rejected. "required" any form of token
+#  binding is needed to be allowed. Finally the name of a binding method that
+#  must be present in tokens. String value.
+#  Defaults to $::os_service_default.
+#
+# [*hash_algorithms*]
+#  (Optional) Hash algorithms to use for hashing PKI tokens. This may be a
+#  single algorithm or multiple. The algorithms are those supported by Python
+#  standard hashlib.new(). The hashes will be tried in the order given, so put
+#  the preferred one first for performance. The result of the first hash will
+#  be stored in the cache. This will typically be set to multiple values only
+#  while migrating from a less secure algorithm to a more secure one. Once all
+#  the old tokens are expired this option should be set to a single value for
+#  better performance. List value.
+#  Defaults to $::os_service_default.
+#
+# [*http_connect_timeout*]
+#  (Optional) Request timeout value for communicating with Identity API
+#  server.
+#  Defaults to $::os_service_default.
+#
+# [*http_request_max_retries*]
+#  (Optional) How many times are we trying to reconnect when communicating
+#  with Identity API Server. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*include_service_catalog*]
+#  (Optional) Indicate whether to set the X-Service-Catalog header. If False,
+#  middleware will not ask for service catalog on token validation and will
+#  not
+#  set the X-Service-Catalog header. Boolean value.
+#  Defaults to $::os_service_default.
+#
+# [*keyfile*]
+#  (Optional) Required if identity server requires client certificate
+#  Defaults to $::os_service_default.
+#
+# [*memcache_pool_conn_get_timeout*]
+#  (Optional) Number of seconds that an operation will wait to get a memcached
+#  client connection from the pool. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*memcache_pool_dead_retry*]
+#  (Optional) Number of seconds memcached server is considered dead before it
+#  is tried again. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*memcache_pool_maxsize*]
+#  (Optional) Maximum total number of open connections to every memcached
+#  server. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*memcache_pool_socket_timeout*]
+#  (Optional) Number of seconds a connection to memcached is held unused in
+#  the
+#  pool before it is closed. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*memcache_pool_unused_timeout*]
+#  (Optional) Number of seconds a connection to memcached is held unused in
+#  the
+#  pool before it is closed. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*memcache_secret_key*]
+#  (Optional, mandatory if memcache_security_strategy is defined) This string
+#  is used for key derivation.
+#  Defaults to $::os_service_default.
+#
+# [*memcache_security_strategy*]
+#  (Optional) If defined, indicate whether token data should be authenticated
+#  or
+#  authenticated and encrypted. If MAC, token data is authenticated (with
+#  HMAC)
+#  in the cache. If ENCRYPT, token data is encrypted and authenticated in the
+#  cache. If the value is not one of these options or empty, auth_token will
+#  raise an exception on initialization.
+#  Defaults to $::os_service_default.
+#
+# [*memcache_use_advanced_pool*]
+#  (Optional)  Use the advanced (eventlet safe) memcached client pool. The
+#  advanced pool will only work under python 2.x Boolean value
+#  Defaults to $::os_service_default.
+#
+# [*memcached_servers*]
+#  (Optional) Optionally specify a list of memcached server(s) to use for
+#  caching. If left undefined, tokens will instead be cached in-process.
+#  Defaults to $::os_service_default.
+#
+# [*region_name*]
+#  (Optional) The region in which the identity server can be found.
+#  Defaults to $::os_service_default.
+#
+# [*revocation_cache_time*]
+#  (Optional) Determines the frequency at which the list of revoked tokens is
+#  retrieved from the Identity service (in seconds). A high number of
+#  revocation events combined with a low cache duration may significantly
+#  reduce performance. Only valid for PKI tokens. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*signing_dir*]
+#  (Optional) Directory used to cache files related to PKI tokens.
+#  Defaults to $::os_service_default.
+#
+# [*token_cache_time*]
+#  (Optional) In order to prevent excessive effort spent validating tokens,
+#  the middleware caches previously-seen tokens for a configurable duration
+#  (in seconds). Set to -1 to disable caching completely. Integer value
+#  Defaults to $::os_service_default.
+#
+class glance::api::authtoken(
+  $username                       = 'glance',
+  $password                       = $::os_service_default,
+  $auth_url                       = 'http://127.0.0.1:35357',
+  $project_name                   = 'services',
+  $user_domain_name               = $::os_service_default,
+  $project_domain_name            = $::os_service_default,
+  $insecure                       = $::os_service_default,
+  $auth_section                   = $::os_service_default,
+  $auth_type                      = 'password',
+  $auth_uri                       = 'http://127.0.0.1:5000',
+  $auth_version                   = $::os_service_default,
+  $cache                          = $::os_service_default,
+  $cafile                         = $::os_service_default,
+  $certfile                       = $::os_service_default,
+  $check_revocations_for_cached   = $::os_service_default,
+  $delay_auth_decision            = $::os_service_default,
+  $enforce_token_bind             = $::os_service_default,
+  $hash_algorithms                = $::os_service_default,
+  $http_connect_timeout           = $::os_service_default,
+  $http_request_max_retries       = $::os_service_default,
+  $include_service_catalog        = $::os_service_default,
+  $keyfile                        = $::os_service_default,
+  $memcache_pool_conn_get_timeout = $::os_service_default,
+  $memcache_pool_dead_retry       = $::os_service_default,
+  $memcache_pool_maxsize          = $::os_service_default,
+  $memcache_pool_socket_timeout   = $::os_service_default,
+  $memcache_pool_unused_timeout   = $::os_service_default,
+  $memcache_secret_key            = $::os_service_default,
+  $memcache_security_strategy     = $::os_service_default,
+  $memcache_use_advanced_pool     = $::os_service_default,
+  $memcached_servers              = $::os_service_default,
+  $region_name                    = $::os_service_default,
+  $revocation_cache_time          = $::os_service_default,
+  $signing_dir                    = $::os_service_default,
+  $token_cache_time               = $::os_service_default,
+) {
+
+  if is_service_default($password) and $::glance::api::keystone_password == undef {
+    fail('Please set password for Glance service user')
+  }
+
+  #NOTE(degorenko): Use pick to keep backward compatibility
+  $username_real          = pick($::glance::api::keystone_user, $username)
+  $password_real          = pick($::glance::api::keystone_password, $password)
+  $project_name_real      = pick($::glance::api::keystone_tenant, $project_name)
+  $auth_url_real          = pick($::glance::api::identity_uri, $auth_url)
+  $auth_uri_real          = pick($::glance::api::auth_uri, $auth_uri)
+  $memcached_servers_real = pick($::glance::api::memcached_servers, $memcached_servers)
+  $token_cache_time_real  = pick($::glance::api::token_cache_time, $token_cache_time)
+  $signing_dir_real       = pick($::glance::api::signing_dir, $signing_dir)
+
+  keystone::resource::authtoken { 'glance_api_config':
+      username                       => $username_real,
+      password                       => $password_real,
+      project_name                   => $project_name_real,
+      auth_url                       => $auth_url_real,
+      auth_uri                       => $auth_uri_real,
+      auth_version                   => $auth_version,
+      auth_type                      => $auth_type,
+      auth_section                   => $auth_section,
+      user_domain_name               => $user_domain_name,
+      project_domain_name            => $project_domain_name,
+      insecure                       => $insecure,
+      cache                          => $cache,
+      cafile                         => $cafile,
+      certfile                       => $certfile,
+      check_revocations_for_cached   => $check_revocations_for_cached,
+      delay_auth_decision            => $delay_auth_decision,
+      enforce_token_bind             => $enforce_token_bind,
+      hash_algorithms                => $hash_algorithms,
+      http_connect_timeout           => $http_connect_timeout,
+      http_request_max_retries       => $http_request_max_retries,
+      include_service_catalog        => $include_service_catalog,
+      keyfile                        => $keyfile,
+      memcache_pool_conn_get_timeout => $memcache_pool_conn_get_timeout,
+      memcache_pool_dead_retry       => $memcache_pool_dead_retry,
+      memcache_pool_maxsize          => $memcache_pool_maxsize,
+      memcache_pool_socket_timeout   => $memcache_pool_socket_timeout,
+      memcache_secret_key            => $memcache_secret_key,
+      memcache_security_strategy     => $memcache_security_strategy,
+      memcache_use_advanced_pool     => $memcache_use_advanced_pool,
+      memcache_pool_unused_timeout   => $memcache_pool_unused_timeout,
+      memcached_servers              => $memcached_servers_real,
+      region_name                    => $region_name,
+      revocation_cache_time          => $revocation_cache_time,
+      signing_dir                    => $signing_dir_real,
+      token_cache_time               => $token_cache_time_real,
+    }
+}

manifests/glare.pp

@@ -25,35 +25,15 @@
 #   (optional) Number of Glance Glare worker processes to start
 #   Default: $::processorcount
 #
-# [*auth_type*]
+# [*auth_strategy*]
 #   (optional) Type is authorization being used.
 #   Defaults to 'keystone'
 #
-# [*auth_uri*]
-#   (optional) Complete public Identity API endpoint.
-#   Defaults to 'http://127.0.0.1:5000/'.
-#
-# [*identity_uri*]
-#   (optional) Complete admin Identity API endpoint.
-#   Defaults to 'http://127.0.0.1:35357/'.
-#
 # [*pipeline*]
 #   (optional) Partial name of a pipeline in your paste configuration file with the
 #   service name removed.
 #   Defaults to 'keystone'.
 #
-# [*keystone_tenant*]
-#   (optional) Tenant to authenticate to.
-#   Defaults to services.
-#
-# [*keystone_user*]
-#   (optional) User to authenticate as with keystone.
-#   Defaults to 'glance'.
-#
-# [*keystone_password*]
-#   (optional) Password used to authentication.
-#   Defaults to false.
-#
 # [*manage_service*]
 #   (optional) If Puppet should manage service startup / shutdown.
 #   Defaults to true.
@@ -93,21 +73,6 @@
 #   (optional) Sets the keystone region to use.
 #   Defaults to 'RegionOne'.
 #
-# [*signing_dir*]
-#   (optional) Directory used to cache files related to PKI tokens.
-#   Defaults to $::os_service_default.
-#
-# [*memcached_servers*]
-#   (optinal) a list of memcached server(s) to use for caching. If left undefined,
-#   tokens will instead be cached in-process.
-#   Defaults to $::os_service_default.
-#
-# [*token_cache_time*]
-#   (optional) In order to prevent excessive effort spent validating tokens,
-#   the middleware caches previously-seen tokens for a configurable duration (in seconds).
-#   Set to -1 to disable caching completely.
-#   Defaults to $::os_service_default.
-#
 # == DEPRECATED PARAMETERS
 #
 # [*auth_region*]
@@ -116,20 +81,62 @@
 #   then region name can be specified.
 #   Defaults to $::os_service_default.
 #
+# [*auth_type*]
+#   (optional) Type is authorization being used.
+#   Deprecated and replaced by ::glance::glare::auth_strategy
+#   Defaults to undef.
+#
+# [*auth_uri*]
+#   (optional) Complete public Identity API endpoint.
+#   Deprecated and will be replaced by ::glance::glare::authtoken::auth_uri
+#   Defaults to undef.
+#
+# [*identity_uri*]
+#   (optional) Complete admin Identity API endpoint.
+#   Deprecated and will be replaced by ::glance::glare::authtoken::auth_url
+#   Defaults to undef.
+#
+# [*keystone_tenant*]
+#   (optional) Tenant to authenticate to.
+#   Deprecated and will be replaced by ::glance::glare::authtoken::project_name
+#   Defaults to undef.
+#
+# [*keystone_user*]
+#   (optional) User to authenticate as with keystone.
+#   Deprecated and will be replaced by ::glance::glare::authtoken::username
+#   Defaults to undef.
+#
+# [*keystone_password*]
+#   (optional) Password used to authentication.
+#   Deprecated and will be replaced by ::glance::glare::authtoken::password
+#   Defaults to undef.
+#
+# [*signing_dir*]
+#   (optional) Directory used to cache files related to PKI tokens.
+#   Deprecated and will be replaced by ::glance::glare::authtoken::signing_dir
+#   Defaults to undef.
+#
+# [*memcached_servers*]
+#   (optinal) a list of memcached server(s) to use for caching. If left undefined,
+#   tokens will instead be cached in-process.
+#   Deprecated and will be replaced by ::glance::glare::authtoken::memcached_servers
+#   Defaults to undef.
+#
+# [*token_cache_time*]
+#   (optional) In order to prevent excessive effort spent validating tokens,
+#   the middleware caches previously-seen tokens for a configurable duration (in seconds).
+#   Set to -1 to disable caching completely.
+#   Deprecated and will be replaced by ::glance::glare::authtoken::token_cache_time
+#   Defaults to undef.
+#
 class glance::glare(
   $package_ensure            = 'present',
   $bind_host                 = '0.0.0.0',
   $bind_port                 = '9494',
   $backlog                   = '4096',
   $workers                   = $::processorcount,
-  $auth_type                 = 'keystone',
+  $auth_strategy             = 'keystone',
-  $auth_uri                  = 'http://127.0.0.1:5000/',
-  $identity_uri              = 'http://127.0.0.1:35357/',
-  $memcached_servers         = $::os_service_default,
   $pipeline                  = 'keystone',
-  $keystone_tenant           = 'services',
-  $keystone_user             = 'glance',
-  $keystone_password         = false,
   $manage_service            = true,
   $enabled                   = true,
   $cert_file                 = $::os_service_default,
@@ -139,10 +146,17 @@ class glance::glare(
   $default_store             = undef,
   $multi_store               = false,
   $os_region_name            = 'RegionOne',
-  $signing_dir               = $::os_service_default,
-  $token_cache_time          = $::os_service_default,
   # DEPRECATED PARAMETERS
-  $auth_region               = $::os_service_default,
+  $auth_region               = undef,
+  $auth_type                 = undef,
+  $auth_uri                  = undef,
+  $identity_uri              = undef,
+  $memcached_servers         = undef,
+  $keystone_tenant           = undef,
+  $keystone_user             = undef,
+  $keystone_password         = undef,
+  $signing_dir               = undef,
+  $token_cache_time          = undef,
 ) inherits glance {
 
   include ::glance::deps
@@ -154,6 +168,45 @@ class glance::glare(
     warning('auth_region is deprecated, has no effect and and will be removed in the O release.')
   }
 
+  if $keystone_password {
+    warning('glance::glare::keystone_password is deprecated, please use glance::glare::authtoken::password')
+  }
+
+  if $auth_type {
+    warning('glance::glare::auth_type is deprecated, please use glance::glare::auth_strategy')
+    $auth_strategy_real = $auth_type
+  } else {
+    $auth_strategy_real = $auth_strategy
+  }
+
+  if $auth_uri {
+    warning('glance::glare::auth_uri is deprecated, please use glance::glare::authtoken::auth_uri')
+  }
+
+  if $identity_uri {
+    warning('glance::glare::identity_uri is deprecated, please use glance::glare::authtoken::auth_url')
+  }
+
+  if $keystone_tenant {
+    warning('glance::glare::keystone_tenant is deprecated, please use glance::glare::authtoken::project_name')
+  }
+
+  if $keystone_user {
+    warning('glance::glare::keystone_user is deprecated, please use glance::glare::authtoken::username')
+  }
+
+  if $memcached_servers {
+    warning('glance::glare::memcached_servers is deprecated, please use glance::glare::authtoken::memcached_servers')
+  }
+
+  if $signing_dir {
+    warning('glance::glare::signing_dir is deprecated, please use glance::glare::authtoken::signing_dir')
+  }
+
+  if $token_cache_time {
+    warning('glance::glare::token_cache_time is deprecated, please use glance::glare::authtoken::token_cache_time')
+  }
+
   if ( $glance::params::glare_package_name != $glance::params::registry_package_name ) {
     ensure_packages('glance-glare', {
       ensure => $package_ensure,
@@ -222,20 +275,8 @@ class glance::glare(
   }
 
   # keystone config
-  if $auth_type == 'keystone' {
+  if $auth_strategy == 'keystone' {
-    if ! $keystone_password {
+    include ::glance::glare::authtoken
-      fail('Parameter keystone_password must be provided, when auth_type is keystone')
-    }
-    glance_glare_config {
-      'keystone_authtoken/admin_tenant_name': value => $keystone_tenant;
-      'keystone_authtoken/admin_user':        value => $keystone_user;
-      'keystone_authtoken/admin_password':    value => $keystone_password, secret => true;
-      'keystone_authtoken/token_cache_time':  value => $token_cache_time;
-      'keystone_authtoken/signing_dir':       value => $signing_dir;
-      'keystone_authtoken/auth_uri':          value => $auth_uri;
-      'keystone_authtoken/identity_uri':      value => $identity_uri;
-      'keystone_authtoken/memcached_servers': value => join(any2array($memcached_servers), ',');
-    }
   }
 
   # SSL Options

manifests/glare/authtoken.pp

@@ -0,0 +1,282 @@
+# class: glance::glare::authtoken
+#
+# Configure the keystone_authtoken section in the Glance Glare configuration file
+#
+# === Parameters
+#
+# [*username*]
+#   (Optional) The name of the service user
+#   Defaults to 'glance'
+#
+# [*password*]
+#   (Optional) Password to create for the service user
+#   Defaults to $::os_service_default
+#
+# [*auth_url*]
+#   (Optional) The URL to use for authentication.
+#   Defaults to 'http://127.0.0.1:35357'
+#
+# [*project_name*]
+#   (Optional) Service project name
+#   Defaults to 'services'
+#
+# [*user_domain_name*]
+#   (Optional) Name of domain for $username
+#   Defaults to $::os_service_default
+#
+# [*project_domain_name*]
+#   (Optional) Name of domain for $project_name
+#   Defaults to $::os_service_default
+#
+# [*insecure*]
+#  (Optional) If true, explicitly allow TLS without checking server cert
+#  against any certificate authorities.  WARNING: not recommended.  Use with
+#  caution.
+#  Defaults to $:os_service_default
+#
+# [*auth_section*]
+#  (Optional) Config Section from which to load plugin specific options
+#  Defaults to $::os_service_default.
+#
+# [*auth_type*]
+#  (Optional) Authentication type to load
+#  Defaults to 'password'
+#
+# [*auth_uri*]
+#  (Optional) Complete public Identity API endpoint.
+#  Defaults to 'http://127.0.0.1:5000'.
+#
+# [*auth_version*]
+#  (Optional) API version of the admin Identity API endpoint.
+#  Defaults to $::os_service_default.
+#
+# [*cache*]
+#  (Optional) Env key for the swift cache.
+#  Defaults to $::os_service_default.
+#
+# [*cafile*]
+#  (Optional) A PEM encoded Certificate Authority to use when verifying HTTPs
+#  connections.
+#  Defaults to $::os_service_default.
+#
+# [*certfile*]
+#  (Optional) Required if identity server requires client certificate
+#  Defaults to $::os_service_default.
+#
+# [*check_revocations_for_cached*]
+#  (Optional) If true, the revocation list will be checked for cached tokens.
+#  This requires that PKI tokens are configured on the identity server.
+#  boolean value.
+#  Defaults to $::os_service_default.
+#
+# [*delay_auth_decision*]
+#  (Optional) Do not handle authorization requests within the middleware, but
+#  delegate the authorization decision to downstream WSGI components. Boolean
+#  value
+#  Defaults to $::os_service_default.
+#
+# [*enforce_token_bind*]
+#  (Optional) Used to control the use and type of token binding. Can be set
+#  to: "disabled" to not check token binding. "permissive" (default) to
+#  validate binding information if the bind type is of a form known to the
+#  server and ignore it if not. "strict" like "permissive" but if the bind
+#  type is unknown the token will be rejected. "required" any form of token
+#  binding is needed to be allowed. Finally the name of a binding method that
+#  must be present in tokens. String value.
+#  Defaults to $::os_service_default.
+#
+# [*hash_algorithms*]
+#  (Optional) Hash algorithms to use for hashing PKI tokens. This may be a
+#  single algorithm or multiple. The algorithms are those supported by Python
+#  standard hashlib.new(). The hashes will be tried in the order given, so put
+#  the preferred one first for performance. The result of the first hash will
+#  be stored in the cache. This will typically be set to multiple values only
+#  while migrating from a less secure algorithm to a more secure one. Once all
+#  the old tokens are expired this option should be set to a single value for
+#  better performance. List value.
+#  Defaults to $::os_service_default.
+#
+# [*http_connect_timeout*]
+#  (Optional) Request timeout value for communicating with Identity API
+#  server.
+#  Defaults to $::os_service_default.
+#
+# [*http_request_max_retries*]
+#  (Optional) How many times are we trying to reconnect when communicating
+#  with Identity API Server. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*include_service_catalog*]
+#  (Optional) Indicate whether to set the X-Service-Catalog header. If False,
+#  middleware will not ask for service catalog on token validation and will
+#  not
+#  set the X-Service-Catalog header. Boolean value.
+#  Defaults to $::os_service_default.
+#
+# [*keyfile*]
+#  (Optional) Required if identity server requires client certificate
+#  Defaults to $::os_service_default.
+#
+# [*memcache_pool_conn_get_timeout*]
+#  (Optional) Number of seconds that an operation will wait to get a memcached
+#  client connection from the pool. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*memcache_pool_dead_retry*]
+#  (Optional) Number of seconds memcached server is considered dead before it
+#  is tried again. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*memcache_pool_maxsize*]
+#  (Optional) Maximum total number of open connections to every memcached
+#  server. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*memcache_pool_socket_timeout*]
+#  (Optional) Number of seconds a connection to memcached is held unused in
+#  the
+#  pool before it is closed. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*memcache_pool_unused_timeout*]
+#  (Optional) Number of seconds a connection to memcached is held unused in
+#  the
+#  pool before it is closed. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*memcache_secret_key*]
+#  (Optional, mandatory if memcache_security_strategy is defined) This string
+#  is used for key derivation.
+#  Defaults to $::os_service_default.
+#
+# [*memcache_security_strategy*]
+#  (Optional) If defined, indicate whether token data should be authenticated
+#  or
+#  authenticated and encrypted. If MAC, token data is authenticated (with
+#  HMAC)
+#  in the cache. If ENCRYPT, token data is encrypted and authenticated in the
+#  cache. If the value is not one of these options or empty, auth_token will
+#  raise an exception on initialization.
+#  Defaults to $::os_service_default.
+#
+# [*memcache_use_advanced_pool*]
+#  (Optional)  Use the advanced (eventlet safe) memcached client pool. The
+#  advanced pool will only work under python 2.x Boolean value
+#  Defaults to $::os_service_default.
+#
+# [*memcached_servers*]
+#  (Optional) Optionally specify a list of memcached server(s) to use for
+#  caching. If left undefined, tokens will instead be cached in-process.
+#  Defaults to $::os_service_default.
+#
+# [*region_name*]
+#  (Optional) The region in which the identity server can be found.
+#  Defaults to $::os_service_default.
+#
+# [*revocation_cache_time*]
+#  (Optional) Determines the frequency at which the list of revoked tokens is
+#  retrieved from the Identity service (in seconds). A high number of
+#  revocation events combined with a low cache duration may significantly
+#  reduce performance. Only valid for PKI tokens. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*signing_dir*]
+#  (Optional) Directory used to cache files related to PKI tokens.
+#  Defaults to $::os_service_default.
+#
+# [*token_cache_time*]
+#  (Optional) In order to prevent excessive effort spent validating tokens,
+#  the middleware caches previously-seen tokens for a configurable duration
+#  (in seconds). Set to -1 to disable caching completely. Integer value
+#  Defaults to $::os_service_default.
+#
+class glance::glare::authtoken(
+  $username                       = 'glance',
+  $password                       = $::os_service_default,
+  $auth_url                       = 'http://127.0.0.1:35357',
+  $project_name                   = 'services',
+  $user_domain_name               = $::os_service_default,
+  $project_domain_name            = $::os_service_default,
+  $insecure                       = $::os_service_default,
+  $auth_section                   = $::os_service_default,
+  $auth_type                      = 'password',
+  $auth_uri                       = 'http://127.0.0.1:5000',
+  $auth_version                   = $::os_service_default,
+  $cache                          = $::os_service_default,
+  $cafile                         = $::os_service_default,
+  $certfile                       = $::os_service_default,
+  $check_revocations_for_cached   = $::os_service_default,
+  $delay_auth_decision            = $::os_service_default,
+  $enforce_token_bind             = $::os_service_default,
+  $hash_algorithms                = $::os_service_default,
+  $http_connect_timeout           = $::os_service_default,
+  $http_request_max_retries       = $::os_service_default,
+  $include_service_catalog        = $::os_service_default,
+  $keyfile                        = $::os_service_default,
+  $memcache_pool_conn_get_timeout = $::os_service_default,
+  $memcache_pool_dead_retry       = $::os_service_default,
+  $memcache_pool_maxsize          = $::os_service_default,
+  $memcache_pool_socket_timeout   = $::os_service_default,
+  $memcache_pool_unused_timeout   = $::os_service_default,
+  $memcache_secret_key            = $::os_service_default,
+  $memcache_security_strategy     = $::os_service_default,
+  $memcache_use_advanced_pool     = $::os_service_default,
+  $memcached_servers              = $::os_service_default,
+  $region_name                    = $::os_service_default,
+  $revocation_cache_time          = $::os_service_default,
+  $signing_dir                    = $::os_service_default,
+  $token_cache_time               = $::os_service_default,
+) {
+
+  if is_service_default($password) and $::glance::glare::keystone_password == undef {
+    fail('Please set password for Glance service user')
+  }
+
+  #NOTE(degorenko): Use pick to keep backward compatibility
+  $username_real          = pick($::glance::glare::keystone_user, $username)
+  $password_real          = pick($::glance::glare::keystone_password, $password)
+  $project_name_real      = pick($::glance::glare::keystone_tenant, $project_name)
+  $auth_url_real          = pick($::glance::glare::identity_uri, $auth_url)
+  $auth_uri_real          = pick($::glance::glare::auth_uri, $auth_uri)
+  $memcached_servers_real = pick($::glance::glare::memcached_servers, $memcached_servers)
+  $token_cache_time_real  = pick($::glance::glare::token_cache_time, $token_cache_time)
+  $signing_dir_real       = pick($::glance::glare::signing_dir, $signing_dir)
+
+  keystone::resource::authtoken { 'glance_glare_config':
+      username                       => $username_real,
+      password                       => $password_real,
+      project_name                   => $project_name_real,
+      auth_url                       => $auth_url_real,
+      auth_uri                       => $auth_uri_real,
+      auth_version                   => $auth_version,
+      auth_type                      => $auth_type,
+      auth_section                   => $auth_section,
+      user_domain_name               => $user_domain_name,
+      project_domain_name            => $project_domain_name,
+      insecure                       => $insecure,
+      cache                          => $cache,
+      cafile                         => $cafile,
+      certfile                       => $certfile,
+      check_revocations_for_cached   => $check_revocations_for_cached,
+      delay_auth_decision            => $delay_auth_decision,
+      enforce_token_bind             => $enforce_token_bind,
+      hash_algorithms                => $hash_algorithms,
+      http_connect_timeout           => $http_connect_timeout,
+      http_request_max_retries       => $http_request_max_retries,
+      include_service_catalog        => $include_service_catalog,
+      keyfile                        => $keyfile,
+      memcache_pool_conn_get_timeout => $memcache_pool_conn_get_timeout,
+      memcache_pool_dead_retry       => $memcache_pool_dead_retry,
+      memcache_pool_maxsize          => $memcache_pool_maxsize,
+      memcache_pool_socket_timeout   => $memcache_pool_socket_timeout,
+      memcache_secret_key            => $memcache_secret_key,
+      memcache_security_strategy     => $memcache_security_strategy,
+      memcache_use_advanced_pool     => $memcache_use_advanced_pool,
+      memcache_pool_unused_timeout   => $memcache_pool_unused_timeout,
+      memcached_servers              => $memcached_servers_real,
+      region_name                    => $region_name,
+      revocation_cache_time          => $revocation_cache_time,
+      signing_dir                    => $signing_dir_real,
+      token_cache_time               => $token_cache_time_real,
+    }
+}

manifests/registry.pp

@@ -4,9 +4,6 @@
 #
 # === Parameters
 #
-#  [*keystone_password*]
-#    (required) The keystone password for administrative user
-#
 #  [*package_ensure*]
 #    (optional) Ensure state for package. Defaults to 'present'.  On RedHat
 #    platforms this setting is ignored and the setting from the glance class is
@@ -66,24 +63,9 @@
 #    (optional) If set, use this value for max_overflow with sqlalchemy.
 #    Defaults to undef.
 #
-#  [*auth_type*]
+#  [*auth_strategy*]
-#    (optional) Authentication type. Defaults to 'keystone'.
+#    (optional) Type is authorization being used.
-#
+#    Defaults to 'keystone'
-#  [*auth_uri*]
-#    (optional) Complete public Identity API endpoint.
-#    Defaults to 'http://127.0.0.1:5000/'.
-#
-#  [*identity_uri*]
-#    (optional) Complete admin Identity API endpoint.
-#    Defaults to 'http://127.0.0.1:35357/'.
-#
-#  [*keystone_tenant*]
-#    (optional) administrative tenant name to connect to keystone.
-#    Defaults to 'services'.
-#
-#  [*keystone_user*]
-#    (optional) administrative user name to connect to keystone.
-#    Defaults to 'glance'.
 #
 #  [*pipeline*]
 #    (optional) Partial name of a pipeline in your paste configuration
@@ -135,28 +117,59 @@
 #    (optional) Sets the keystone region to use.
 #    Defaults to $::os_service_default.
 #
-#  [*signing_dir*]
-#    Directory used to cache files related to PKI tokens.
-#    Defaults to $::os_service_default.
-#
-# [*memcached_servers*]
-#   (optinal) a list of memcached server(s) to use for caching. If left undefined,
-#   tokens will instead be cached in-process.
-#   Defaults to $::os_service_default.
-#
-#  [*token_cache_time*]
-#    In order to prevent excessive effort spent validating tokens,
-#    the middleware caches previously-seen tokens for a configurable duration (in seconds).
-#    Set to -1 to disable caching completely.
-#    Defaults to $::os_service_default.
-#
 #  DEPRECATED PARAMETERS
 #
 #  [*verbose*]
 #    (optional) Deprecated. Enable verbose logs (true|false). Defaults to undef.
 #
+#  [*keystone_password*]
+#    (optional) The keystone password for administrative user.
+#    Deprecated and will be replaced by ::glance::registry::authtoken::password
+#    Default to undef.
+#
+#  [*auth_type*]
+#    (optional) Authentication type. Defaults to undef.
+#    Deprecated and will be replaced by ::glance::registry::auth_strategy
+#
+#  [*auth_uri*]
+#    (optional) Complete public Identity API endpoint.
+#    Deprecated and will be replaced by ::glance::registry::authtoken::auth_uri
+#    Defaults to undef.
+#
+#  [*identity_uri*]
+#    (optional) Complete admin Identity API endpoint.
+#    Deprecated and will be replaced by ::glance::registry::authtoken::auth_url
+#    Defaults to undef.
+#
+#  [*keystone_tenant*]
+#    (optional) administrative tenant name to connect to keystone.
+#    Deprecated and will be replaced by ::glance::registry::authtoken::project_name
+#    Defaults to undef.
+#
+#  [*keystone_user*]
+#    (optional) administrative user name to connect to keystone.
+#    Deprecated and will be replaced by ::glance::registry::authtoken::username
+#    Defaults to undef.
+#
+#  [*signing_dir*]
+#    Directory used to cache files related to PKI tokens.
+#    Deprecated and will be replaced by ::glance::registry::authtoken::signing_dir
+#    Defaults to undef.
+#
+#  [*memcached_servers*]
+#   (optinal) a list of memcached server(s) to use for caching. If left undefined,
+#   tokens will instead be cached in-process.
+#    Deprecated and will be replaced by ::glance::registry::authtoken::memcached_servers
+#   Defaults to undef.
+#
+#  [*token_cache_time*]
+#    In order to prevent excessive effort spent validating tokens,
+#    the middleware caches previously-seen tokens for a configurable duration (in seconds).
+#    Set to -1 to disable caching completely.
+#    Deprecated and will be replaced by ::glance::registry::authtoken::token_cache_time
+#    Defaults to undef.
+#
 class glance::registry(
-  $keystone_password,
   $package_ensure          = 'present',
   $debug                   = undef,
   $bind_host               = $::os_service_default,
@@ -171,11 +184,7 @@ class glance::registry(
   $database_max_retries    = undef,
   $database_retry_interval = undef,
   $database_max_overflow   = undef,
-  $auth_type               = 'keystone',
+  $auth_strategy           = 'keystone',
-  $auth_uri                = 'http://127.0.0.1:5000/',
-  $identity_uri            = 'http://127.0.0.1:35357/',
-  $keystone_tenant         = 'services',
-  $keystone_user           = 'glance',
   $pipeline                = 'keystone',
   $use_syslog              = undef,
   $use_stderr              = undef,
@@ -188,11 +197,17 @@ class glance::registry(
   $ca_file                 = $::os_service_default,
   $sync_db                 = true,
   $os_region_name          = $::os_service_default,
-  $signing_dir             = $::os_service_default,
-  $memcached_servers       = $::os_service_default,
-  $token_cache_time        = $::os_service_default,
   # Deprecated
   $verbose                 = undef,
+  $keystone_password       = undef,
+  $auth_type               = undef,
+  $auth_uri                = undef,
+  $identity_uri            = undef,
+  $keystone_tenant         = undef,
+  $keystone_user           = undef,
+  $signing_dir             = undef,
+  $memcached_servers       = undef,
+  $token_cache_time        = undef,
 ) inherits glance {
 
   include ::glance::deps
@@ -203,6 +218,45 @@ class glance::registry(
     warning('verbose is deprecated, has no effect and will be removed after Newton cycle.')
   }
 
+  if $keystone_password {
+    warning('glance::registry::keystone_password is deprecated, please use glance::registry::authtoken::password')
+  }
+
+  if $auth_type {
+    warning('glance::registry::auth_type is deprecated, please use glance::registry::auth_strategy')
+    $auth_strategy_real = $auth_type
+  } else {
+    $auth_strategy_real = $auth_strategy
+  }
+
+  if $auth_uri {
+    warning('glance::registry::auth_uri is deprecated, please use glance::registry::authtoken::auth_uri')
+  }
+
+  if $identity_uri {
+    warning('glance::registry::identity_uri is deprecated, please use glance::registry::authtoken::auth_url')
+  }
+
+  if $keystone_tenant {
+    warning('glance::registry::keystone_tenant is deprecated, please use glance::registry::authtoken::project_name')
+  }
+
+  if $keystone_user {
+    warning('glance::registry::keystone_user is deprecated, please use glance::registry::authtoken::username')
+  }
+
+  if $memcached_servers {
+    warning('glance::registry::memcached_servers is deprecated, please use glance::registry::authtoken::memcached_servers')
+  }
+
+  if $signing_dir {
+    warning('glance::registry::signing_dir is deprecated, please use glance::registry::authtoken::signing_dir')
+  }
+
+  if $token_cache_time {
+    warning('glance::registry::token_cache_time is deprecated, please use glance::registry::authtoken::token_cache_time')
+  }
+
   if ( $glance::params::api_package_name != $glance::params::registry_package_name ) {
     ensure_packages( 'glance-registry',
       {
@@ -236,17 +290,8 @@ class glance::registry(
   }
 
   # keystone config
-  if $auth_type == 'keystone' {
+  if $auth_strategy_real == 'keystone' {
-    glance_registry_config {
+    include ::glance::registry::authtoken
-      'keystone_authtoken/admin_tenant_name': value => $keystone_tenant;
-      'keystone_authtoken/admin_user':        value => $keystone_user;
-      'keystone_authtoken/admin_password':    value => $keystone_password, secret => true;
-      'keystone_authtoken/token_cache_time':  value => $token_cache_time;
-      'keystone_authtoken/signing_dir':       value => $signing_dir;
-      'keystone_authtoken/auth_uri':          value => $auth_uri;
-      'keystone_authtoken/identity_uri':      value => $identity_uri;
-      'keystone_authtoken/memcached_servers': value => join(any2array($memcached_servers), ',');
-    }
   }
 
   # SSL Options

manifests/registry/authtoken.pp

@@ -0,0 +1,282 @@
+# class: glance::registry::authtoken
+#
+# Configure the keystone_authtoken section in the Glance API configuration file
+#
+# === Parameters
+#
+# [*username*]
+#   (Optional) The name of the service user
+#   Defaults to 'glance'
+#
+# [*password*]
+#   (Optional) Password to create for the service user
+#   Defaults to $::os_service_default
+#
+# [*auth_url*]
+#   (Optional) The URL to use for authentication.
+#   Defaults to 'http://127.0.0.1:35357'
+#
+# [*project_name*]
+#   (Optional) Service project name
+#   Defaults to 'services'
+#
+# [*user_domain_name*]
+#   (Optional) Name of domain for $username
+#   Defaults to $::os_service_default
+#
+# [*project_domain_name*]
+#   (Optional) Name of domain for $project_name
+#   Defaults to $::os_service_default
+#
+# [*insecure*]
+#  (Optional) If true, explicitly allow TLS without checking server cert
+#  against any certificate authorities.  WARNING: not recommended.  Use with
+#  caution.
+#  Defaults to $:os_service_default
+#
+# [*auth_section*]
+#  (Optional) Config Section from which to load plugin specific options
+#  Defaults to $::os_service_default.
+#
+# [*auth_type*]
+#  (Optional) Authentication type to load
+#  Defaults to 'password'.
+#
+# [*auth_uri*]
+#  (Optional) Complete public Identity API endpoint.
+#  Defaults to 'http://127.0.0.1:5000'.
+#
+# [*auth_version*]
+#  (Optional) API version of the admin Identity API endpoint.
+#  Defaults to $::os_service_default.
+#
+# [*cache*]
+#  (Optional) Env key for the swift cache.
+#  Defaults to $::os_service_default.
+#
+# [*cafile*]
+#  (Optional) A PEM encoded Certificate Authority to use when verifying HTTPs
+#  connections.
+#  Defaults to $::os_service_default.
+#
+# [*certfile*]
+#  (Optional) Required if identity server requires client certificate
+#  Defaults to $::os_service_default.
+#
+# [*check_revocations_for_cached*]
+#  (Optional) If true, the revocation list will be checked for cached tokens.
+#  This requires that PKI tokens are configured on the identity server.
+#  boolean value.
+#  Defaults to $::os_service_default.
+#
+# [*delay_auth_decision*]
+#  (Optional) Do not handle authorization requests within the middleware, but
+#  delegate the authorization decision to downstream WSGI components. Boolean
+#  value
+#  Defaults to $::os_service_default.
+#
+# [*enforce_token_bind*]
+#  (Optional) Used to control the use and type of token binding. Can be set
+#  to: "disabled" to not check token binding. "permissive" (default) to
+#  validate binding information if the bind type is of a form known to the
+#  server and ignore it if not. "strict" like "permissive" but if the bind
+#  type is unknown the token will be rejected. "required" any form of token
+#  binding is needed to be allowed. Finally the name of a binding method that
+#  must be present in tokens. String value.
+#  Defaults to $::os_service_default.
+#
+# [*hash_algorithms*]
+#  (Optional) Hash algorithms to use for hashing PKI tokens. This may be a
+#  single algorithm or multiple. The algorithms are those supported by Python
+#  standard hashlib.new(). The hashes will be tried in the order given, so put
+#  the preferred one first for performance. The result of the first hash will
+#  be stored in the cache. This will typically be set to multiple values only
+#  while migrating from a less secure algorithm to a more secure one. Once all
+#  the old tokens are expired this option should be set to a single value for
+#  better performance. List value.
+#  Defaults to $::os_service_default.
+#
+# [*http_connect_timeout*]
+#  (Optional) Request timeout value for communicating with Identity API
+#  server.
+#  Defaults to $::os_service_default.
+#
+# [*http_request_max_retries*]
+#  (Optional) How many times are we trying to reconnect when communicating
+#  with Identity API Server. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*include_service_catalog*]
+#  (Optional) Indicate whether to set the X-Service-Catalog header. If False,
+#  middleware will not ask for service catalog on token validation and will
+#  not
+#  set the X-Service-Catalog header. Boolean value.
+#  Defaults to $::os_service_default.
+#
+# [*keyfile*]
+#  (Optional) Required if identity server requires client certificate
+#  Defaults to $::os_service_default.
+#
+# [*memcache_pool_conn_get_timeout*]
+#  (Optional) Number of seconds that an operation will wait to get a memcached
+#  client connection from the pool. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*memcache_pool_dead_retry*]
+#  (Optional) Number of seconds memcached server is considered dead before it
+#  is tried again. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*memcache_pool_maxsize*]
+#  (Optional) Maximum total number of open connections to every memcached
+#  server. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*memcache_pool_socket_timeout*]
+#  (Optional) Number of seconds a connection to memcached is held unused in
+#  the
+#  pool before it is closed. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*memcache_pool_unused_timeout*]
+#  (Optional) Number of seconds a connection to memcached is held unused in
+#  the
+#  pool before it is closed. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*memcache_secret_key*]
+#  (Optional, mandatory if memcache_security_strategy is defined) This string
+#  is used for key derivation.
+#  Defaults to $::os_service_default.
+#
+# [*memcache_security_strategy*]
+#  (Optional) If defined, indicate whether token data should be authenticated
+#  or
+#  authenticated and encrypted. If MAC, token data is authenticated (with
+#  HMAC)
+#  in the cache. If ENCRYPT, token data is encrypted and authenticated in the
+#  cache. If the value is not one of these options or empty, auth_token will
+#  raise an exception on initialization.
+#  Defaults to $::os_service_default.
+#
+# [*memcache_use_advanced_pool*]
+#  (Optional)  Use the advanced (eventlet safe) memcached client pool. The
+#  advanced pool will only work under python 2.x Boolean value
+#  Defaults to $::os_service_default.
+#
+# [*memcached_servers*]
+#  (Optional) Optionally specify a list of memcached server(s) to use for
+#  caching. If left undefined, tokens will instead be cached in-process.
+#  Defaults to $::os_service_default.
+#
+# [*region_name*]
+#  (Optional) The region in which the identity server can be found.
+#  Defaults to $::os_service_default.
+#
+# [*revocation_cache_time*]
+#  (Optional) Determines the frequency at which the list of revoked tokens is
+#  retrieved from the Identity service (in seconds). A high number of
+#  revocation events combined with a low cache duration may significantly
+#  reduce performance. Only valid for PKI tokens. Integer value
+#  Defaults to $::os_service_default.
+#
+# [*signing_dir*]
+#  (Optional) Directory used to cache files related to PKI tokens.
+#  Defaults to $::os_service_default.
+#
+# [*token_cache_time*]
+#  (Optional) In order to prevent excessive effort spent validating tokens,
+#  the middleware caches previously-seen tokens for a configurable duration
+#  (in seconds). Set to -1 to disable caching completely. Integer value
+#  Defaults to $::os_service_default.
+#
+class glance::registry::authtoken(
+  $username                       = 'glance',
+  $password                       = $::os_service_default,
+  $auth_url                       = 'http://127.0.0.1:35357',
+  $project_name                   = 'services',
+  $user_domain_name               = $::os_service_default,
+  $project_domain_name            = $::os_service_default,
+  $insecure                       = $::os_service_default,
+  $auth_section                   = $::os_service_default,
+  $auth_type                      = 'password',
+  $auth_uri                       = 'http://127.0.0.1:5000',
+  $auth_version                   = $::os_service_default,
+  $cache                          = $::os_service_default,
+  $cafile                         = $::os_service_default,
+  $certfile                       = $::os_service_default,
+  $check_revocations_for_cached   = $::os_service_default,
+  $delay_auth_decision            = $::os_service_default,
+  $enforce_token_bind             = $::os_service_default,
+  $hash_algorithms                = $::os_service_default,
+  $http_connect_timeout           = $::os_service_default,
+  $http_request_max_retries       = $::os_service_default,
+  $include_service_catalog        = $::os_service_default,
+  $keyfile                        = $::os_service_default,
+  $memcache_pool_conn_get_timeout = $::os_service_default,
+  $memcache_pool_dead_retry       = $::os_service_default,
+  $memcache_pool_maxsize          = $::os_service_default,
+  $memcache_pool_socket_timeout   = $::os_service_default,
+  $memcache_pool_unused_timeout   = $::os_service_default,
+  $memcache_secret_key            = $::os_service_default,
+  $memcache_security_strategy     = $::os_service_default,
+  $memcache_use_advanced_pool     = $::os_service_default,
+  $memcached_servers              = $::os_service_default,
+  $region_name                    = $::os_service_default,
+  $revocation_cache_time          = $::os_service_default,
+  $signing_dir                    = $::os_service_default,
+  $token_cache_time               = $::os_service_default,
+) {
+
+  if is_service_default($password) and $::glance::registry::keystone_password == undef {
+    fail('Please set password for Glance service user')
+  }
+
+  #NOTE(degorenko): Use pick to keep backward compatibility
+  $username_real          = pick($::glance::registry::keystone_user, $username)
+  $password_real          = pick($::glance::registry::keystone_password, $password)
+  $project_name_real      = pick($::glance::registry::keystone_tenant, $project_name)
+  $auth_url_real          = pick($::glance::registry::identity_uri, $auth_url)
+  $auth_uri_real          = pick($::glance::registry::auth_uri, $auth_uri)
+  $memcached_servers_real = pick($::glance::registry::memcached_servers, $memcached_servers)
+  $token_cache_time_real  = pick($::glance::registry::token_cache_time, $token_cache_time)
+  $signing_dir_real       = pick($::glance::registry::signing_dir, $signing_dir)
+
+  keystone::resource::authtoken { 'glance_registry_config':
+      username                       => $username_real,
+      password                       => $password_real,
+      project_name                   => $project_name_real,
+      auth_url                       => $auth_url_real,
+      auth_uri                       => $auth_uri_real,
+      auth_version                   => $auth_version,
+      auth_type                      => $auth_type,
+      auth_section                   => $auth_section,
+      user_domain_name               => $user_domain_name,
+      project_domain_name            => $project_domain_name,
+      insecure                       => $insecure,
+      cache                          => $cache,
+      cafile                         => $cafile,
+      certfile                       => $certfile,
+      check_revocations_for_cached   => $check_revocations_for_cached,
+      delay_auth_decision            => $delay_auth_decision,
+      enforce_token_bind             => $enforce_token_bind,
+      hash_algorithms                => $hash_algorithms,
+      http_connect_timeout           => $http_connect_timeout,
+      http_request_max_retries       => $http_request_max_retries,
+      include_service_catalog        => $include_service_catalog,
+      keyfile                        => $keyfile,
+      memcache_pool_conn_get_timeout => $memcache_pool_conn_get_timeout,
+      memcache_pool_dead_retry       => $memcache_pool_dead_retry,
+      memcache_pool_maxsize          => $memcache_pool_maxsize,
+      memcache_pool_socket_timeout   => $memcache_pool_socket_timeout,
+      memcache_secret_key            => $memcache_secret_key,
+      memcache_security_strategy     => $memcache_security_strategy,
+      memcache_use_advanced_pool     => $memcache_use_advanced_pool,
+      memcache_pool_unused_timeout   => $memcache_pool_unused_timeout,
+      memcached_servers              => $memcached_servers_real,
+      region_name                    => $region_name,
+      revocation_cache_time          => $revocation_cache_time,
+      signing_dir                    => $signing_dir_real,
+      token_cache_time               => $token_cache_time_real,
+    }
+}

releasenotes/notes/authtoken-2439e462e0a84399.yaml

@@ -0,0 +1,25 @@
+---
+features:
+  - Configure keystonemiddleware in a consistent way with all options required for Keystone v3.
+deprecations:
+  - glance::api::identity_uri is deprecated, use glance::api::authtoken::auth_url instead.
+  - glance::api::auth_uri is deprecated, use glance::api::authtoken::auth_uri instead.
+  - glance::api::keystone_tenant is deprecated, use glance::api::authtoken::project_name instead.
+  - glance::api::keystone_user is deprecated, use glance::api::authtoken::username instead.
+  - glance::api::keystone_password is deprecated, use glance::api::authtoken::password instead.
+  - glance::api::memcached_servers is deprecated, use glance::api::authtoken::memcached_servers instead.
+  - glance::glare::identity_uri is deprecated, use glance::glare::authtoken::auth_url instead.
+  - glance::glare::auth_uri is deprecated, use glance::glare::authtoken::auth_uri instead.
+  - glance::glare::keystone_tenant is deprecated, use glance::glare::authtoken::project_name instead.
+  - glance::glare::keystone_user is deprecated, use glance::glare::authtoken::username instead.
+  - glance::glare::keystone_password is deprecated, use glance::glare::authtoken::password instead.
+  - glance::glare::memcached_servers is deprecated, use glance::glare::authtoken::memcached_servers instead.
+  - glance::registry::identity_uri is deprecated, use glance::registry::authtoken::auth_url instead.
+  - glance::registry::auth_uri is deprecated, use glance::registry::authtoken::auth_uri instead.
+  - glance::registry::keystone_tenant is deprecated, use glance::registry::authtoken::project_name instead.
+  - glance::registry::keystone_user is deprecated, use glance::registry::authtoken::username instead.
+  - glance::registry::keystone_password is deprecated, use glance::registry::authtoken::password instead.
+  - glance::registry::memcached_servers is deprecated, use glance::registry::authtoken::memcached_servers instead.
+  - glance::api::auth_type is deprecated, use glance::api::auth_strategy instead.
+  - glance::glare::auth_type is deprecated, use glance::glare::auth_strategy instead.
+  - glance::registry::auth_type is deprecated, use glance::registry::auth_strategy instead.

spec/acceptance/basic_glance_spec.rb

@@ -24,20 +24,25 @@ describe 'glance class' do
       class { '::glance::keystone::glare_auth':
         password => 'a_big_secret',
       }
+      class { '::glance::api::authtoken':
+        password => 'a_big_secret',
+      }
       class { '::glance::api':
         database_connection => 'mysql+pymysql://glance:a_big_secret@127.0.0.1/glance?charset=utf8',
-        keystone_password   => 'a_big_secret',
+      }
+      class { '::glance::registry::authtoken':
+        password => 'a_big_secret',
       }
       class { '::glance::registry':
         database_connection => 'mysql+pymysql://glance:a_big_secret@127.0.0.1/glance?charset=utf8',
-        keystone_password   => 'a_big_secret',
       }
       class { '::glance::glare::db':
         database_connection => 'mysql+pymysql://glance:a_big_secret@127.0.0.1/glance?charset=utf8',
       }
-      class { '::glance::glare':
+      class { '::glance::glare::authtoken':
-        keystone_password   => 'a_big_secret',
+        password => 'a_big_secret',
       }
+      include ::glance::glare
 
       glance_image { 'test_image':
         ensure           => present,

spec/classes/glance_api_authtoken_spec.rb

@@ -0,0 +1,145 @@
+require 'spec_helper'
+
+describe 'glance::api::authtoken' do
+
+  let :params do
+    { :password => 'glance_api_password', }
+  end
+
+  shared_examples 'glance_api authtoken' do
+
+    context 'with default parameters' do
+
+      it 'configure keystone_authtoken' do
+        is_expected.to contain_glance_api_config('keystone_authtoken/username').with_value('glance')
+        is_expected.to contain_glance_api_config('keystone_authtoken/password').with_value('glance_api_password')
+        is_expected.to contain_glance_api_config('keystone_authtoken/auth_url').with_value('http://127.0.0.1:35357')
+        is_expected.to contain_glance_api_config('keystone_authtoken/project_name').with_value('services')
+        is_expected.to contain_glance_api_config('keystone_authtoken/user_domain_name').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/project_domain_name').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/insecure').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/auth_section').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/auth_type').with_value('password')
+        is_expected.to contain_glance_api_config('keystone_authtoken/auth_uri').with_value('http://127.0.0.1:5000')
+        is_expected.to contain_glance_api_config('keystone_authtoken/auth_version').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/cache').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/cafile').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/certfile').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/check_revocations_for_cached').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/delay_auth_decision').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/enforce_token_bind').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/hash_algorithms').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/http_connect_timeout').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/http_request_max_retries').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/include_service_catalog').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/keyfile').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/memcache_pool_dead_retry').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/memcache_pool_maxsize').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/memcache_pool_socket_timeout').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/memcache_pool_unused_timeout').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/memcache_secret_key').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/memcache_security_strategy').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/memcache_use_advanced_pool').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/memcached_servers').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/region_name').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/revocation_cache_time').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/signing_dir').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_api_config('keystone_authtoken/token_cache_time').with_value('<SERVICE DEFAULT>')
+      end
+    end
+
+    context 'when overriding parameters' do
+      before do
+        params.merge!({
+          :auth_uri                             => 'https://10.0.0.1:9999/',
+          :username                             => 'myuser',
+          :password                             => 'mypasswd',
+          :auth_url                             => 'http://:127.0.0.1:35357',
+          :project_name                         => 'service_project',
+          :user_domain_name                     => 'domainX',
+          :project_domain_name                  => 'domainX',
+          :insecure                             => false,
+          :auth_section                         => 'new_section',
+          :auth_type                            => 'password',
+          :auth_version                         => 'v3',
+          :cache                                => 'somevalue',
+          :cafile                               => '/opt/stack/data/cafile.pem',
+          :certfile                             => 'certfile.crt',
+          :check_revocations_for_cached         => false,
+          :delay_auth_decision                  => false,
+          :enforce_token_bind                   => 'permissive',
+          :hash_algorithms                      => 'md5',
+          :http_connect_timeout                 => '300',
+          :http_request_max_retries             => '3',
+          :include_service_catalog              => true,
+          :keyfile                              => 'keyfile',
+          :memcache_pool_conn_get_timeout       => '9',
+          :memcache_pool_dead_retry             => '302',
+          :memcache_pool_maxsize                => '11',
+          :memcache_pool_socket_timeout         => '2',
+          :memcache_pool_unused_timeout         => '61',
+          :memcache_secret_key                  => 'secret_key',
+          :memcache_security_strategy           => 'ENCRYPT',
+          :memcache_use_advanced_pool           => true,
+          :memcached_servers                    => ['memcached01:11211','memcached02:11211'],
+          :region_name                          => 'region2',
+          :revocation_cache_time                => '11',
+          :signing_dir                          => '/var/cache',
+          :token_cache_time                     => '301',
+        })
+      end
+
+      it 'configure keystone_authtoken' do
+        is_expected.to contain_glance_api_config('keystone_authtoken/auth_uri').with_value('https://10.0.0.1:9999/')
+        is_expected.to contain_glance_api_config('keystone_authtoken/username').with_value(params[:username])
+        is_expected.to contain_glance_api_config('keystone_authtoken/password').with_value(params[:password]).with_secret(true)
+        is_expected.to contain_glance_api_config('keystone_authtoken/auth_url').with_value(params[:auth_url])
+        is_expected.to contain_glance_api_config('keystone_authtoken/project_name').with_value(params[:project_name])
+        is_expected.to contain_glance_api_config('keystone_authtoken/user_domain_name').with_value(params[:user_domain_name])
+        is_expected.to contain_glance_api_config('keystone_authtoken/project_domain_name').with_value(params[:project_domain_name])
+        is_expected.to contain_glance_api_config('keystone_authtoken/insecure').with_value(params[:insecure])
+        is_expected.to contain_glance_api_config('keystone_authtoken/auth_section').with_value(params[:auth_section])
+        is_expected.to contain_glance_api_config('keystone_authtoken/auth_type').with_value(params[:auth_type])
+        is_expected.to contain_glance_api_config('keystone_authtoken/auth_version').with_value(params[:auth_version])
+        is_expected.to contain_glance_api_config('keystone_authtoken/cache').with_value(params[:cache])
+        is_expected.to contain_glance_api_config('keystone_authtoken/cafile').with_value(params[:cafile])
+        is_expected.to contain_glance_api_config('keystone_authtoken/certfile').with_value(params[:certfile])
+        is_expected.to contain_glance_api_config('keystone_authtoken/check_revocations_for_cached').with_value(params[:check_revocations_for_cached])
+        is_expected.to contain_glance_api_config('keystone_authtoken/delay_auth_decision').with_value(params[:delay_auth_decision])
+        is_expected.to contain_glance_api_config('keystone_authtoken/enforce_token_bind').with_value(params[:enforce_token_bind])
+        is_expected.to contain_glance_api_config('keystone_authtoken/hash_algorithms').with_value(params[:hash_algorithms])
+        is_expected.to contain_glance_api_config('keystone_authtoken/http_connect_timeout').with_value(params[:http_connect_timeout])
+        is_expected.to contain_glance_api_config('keystone_authtoken/http_request_max_retries').with_value(params[:http_request_max_retries])
+        is_expected.to contain_glance_api_config('keystone_authtoken/include_service_catalog').with_value(params[:include_service_catalog])
+        is_expected.to contain_glance_api_config('keystone_authtoken/keyfile').with_value(params[:keyfile])
+        is_expected.to contain_glance_api_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value(params[:memcache_pool_conn_get_timeout])
+        is_expected.to contain_glance_api_config('keystone_authtoken/memcache_pool_dead_retry').with_value(params[:memcache_pool_dead_retry])
+        is_expected.to contain_glance_api_config('keystone_authtoken/memcache_pool_maxsize').with_value(params[:memcache_pool_maxsize])
+        is_expected.to contain_glance_api_config('keystone_authtoken/memcache_pool_socket_timeout').with_value(params[:memcache_pool_socket_timeout])
+        is_expected.to contain_glance_api_config('keystone_authtoken/memcache_pool_unused_timeout').with_value(params[:memcache_pool_unused_timeout])
+        is_expected.to contain_glance_api_config('keystone_authtoken/memcache_secret_key').with_value(params[:memcache_secret_key])
+        is_expected.to contain_glance_api_config('keystone_authtoken/memcache_security_strategy').with_value(params[:memcache_security_strategy])
+        is_expected.to contain_glance_api_config('keystone_authtoken/memcache_use_advanced_pool').with_value(params[:memcache_use_advanced_pool])
+        is_expected.to contain_glance_api_config('keystone_authtoken/memcached_servers').with_value('memcached01:11211,memcached02:11211')
+        is_expected.to contain_glance_api_config('keystone_authtoken/region_name').with_value(params[:region_name])
+        is_expected.to contain_glance_api_config('keystone_authtoken/revocation_cache_time').with_value(params[:revocation_cache_time])
+        is_expected.to contain_glance_api_config('keystone_authtoken/signing_dir').with_value(params[:signing_dir])
+        is_expected.to contain_glance_api_config('keystone_authtoken/token_cache_time').with_value(params[:token_cache_time])
+      end
+    end
+  end
+
+  on_supported_os({
+    :supported_os => OSDefaults.get_supported_os
+  }).each do |os,facts|
+    context "on #{os}" do
+      let (:facts) do
+        facts.merge!(OSDefaults.get_facts())
+      end
+
+      it_configures 'glance_api authtoken'
+    end
+  end
+
+end

spec/classes/glance_api_spec.rb

@@ -13,16 +13,12 @@ describe 'glance::api' do
       :registry_client_protocol => '<SERVICE DEFAULT>',
       :log_file                 => '/var/log/glance/api.log',
       :log_dir                  => '/var/log/glance',
-      :auth_type                => 'keystone',
+      :auth_strategy            => 'keystone',
       :enabled                  => true,
       :manage_service           => true,
       :backlog                  => '<SERVICE DEFAULT>',
       :workers                  => '7',
-      :keystone_tenant          => 'services',
-      :keystone_user            => 'glance',
       :keystone_password        => 'ChangeMe',
-      :token_cache_time         => '<SERVICE DEFAULT>',
-      :memcached_servers        => '<SERVICE DEFAULT>',
       :show_image_direct_url    => '<SERVICE DEFAULT>',
       :show_multiple_locations  => '<SERVICE DEFAULT>',
       :location_strategy        => '<SERVICE DEFAULT>',
@@ -35,14 +31,12 @@ describe 'glance::api' do
       :image_cache_stall_time   => '<SERVICE DEFAULT>',
       :image_cache_max_size     => '<SERVICE DEFAULT>',
       :os_region_name           => 'RegionOne',
-      :signing_dir              => '<SERVICE DEFAULT>',
       :pipeline                 => 'keystone',
-      :auth_uri                 => 'http://127.0.0.1:5000/',
-      :identity_uri             => 'http://127.0.0.1:35357/',
     }
   end
 
   shared_examples_for 'glance::api' do
+
     [{:keystone_password => 'ChangeMe'},
      {
         :debug                    => true,
@@ -51,14 +45,11 @@ describe 'glance::api' do
         :registry_host            => '127.0.0.1',
         :registry_port            => '9111',
         :registry_client_protocol => 'https',
-        :auth_type                => 'not_keystone',
+        :auth_strategy            => 'not_keystone',
         :enabled                  => false,
         :backlog                  => '4095',
         :workers                  => '5',
-        :keystone_tenant          => 'admin2',
+        :keystone_password        => 'ChangeMe',
-        :keystone_user            => 'admin2',
-        :keystone_password        => 'ChangeMe2',
-        :token_cache_time         => '300',
         :show_image_direct_url    => true,
         :show_multiple_locations  => true,
         :location_strategy        => 'store_type',
@@ -68,14 +59,11 @@ describe 'glance::api' do
         :image_cache_stall_time   => '10',
         :image_cache_max_size     => '10737418240',
         :os_region_name           => 'RegionOne2',
-        :signing_dir              => '/path/to/dir',
         :pipeline                 => 'keystone2',
-        :auth_uri                 => 'http://127.0.0.1:5000/v2.0',
-        :identity_uri             => 'http://127.0.0.1:35357/v2.0',
       }
     ].each do |param_set|
 
-      describe "when #{param_set == {:keystone_password => 'ChangeMe'} ? "using default" : "specifying"} class parameters" do
+      describe "when #{param_set.empty? ? "using default" : "specifying"} class parameters" do
 
         let :param_hash do
           default_params.merge(param_set)
@@ -154,22 +142,6 @@ describe 'glance::api' do
             :purge => false
           })
         end
-
-        it 'is_expected.to configure itself for keystone if that is the auth_type' do
-          if params[:auth_type] == 'keystone'
-            is_expected.to contain('paste_deploy/flavor').with_value('keystone+cachemanagement')
-            is_expected.to contain_glance_api_config('keystone_authtoken/memcached_servers').with_value(param_hash[:memcached_servers])
-            ['admin_tenant_name', 'admin_user', 'admin_password', 'token_cache_time', 'signing_dir', 'auth_uri', 'identity_uri'].each do |config|
-              is_expected.to contain_glance_api_config("keystone_authtoken/#{config}").with_value(param_hash[config.intern])
-            end
-            is_expected.to contain_glance_api_config('keystone_authtoken/admin_password').with_value(param_hash[:keystone_password]).with_secret(true)
-
-            ['admin_tenant_name', 'admin_user', 'admin_password'].each do |config|
-              is_expected.to contain_glance_cache_config("keystone_authtoken/#{config}").with_value(param_hash[config.intern])
-            end
-            is_expected.to contain_glance_cache_config('keystone_authtoken/admin_password').with_value(param_hash[:keystone_password]).with_secret(true)
-          end
-        end
       end
 
     end
@@ -224,7 +196,6 @@ describe 'glance::api' do
       describe "with pipeline incorrect value #{pipeline}" do
         let :params do
           {
-            :keystone_password => 'ChangeMe',
             :pipeline          => pipeline
           }
         end
@@ -342,7 +313,7 @@ describe 'glance::api' do
         :provider    => 'shell',
         :tries       => '10',
         :try_sleep   => '2',
-        :command     => 'glance --os-auth-url http://127.0.0.1:5000/ --os-tenant-name services --os-username glance --os-password ChangeMe image-list',
+        :command     => 'glance --os-auth-url http://127.0.0.1:5000 --os-project-name services --os-username glance --os-password ChangeMe image-list',
       )}
 
       it { is_expected.to contain_anchor('create glance-api anchor').with(
@@ -380,6 +351,32 @@ describe 'glance::api' do
         :require => 'Exec[execute glance-api validation]',
       )}
     end
+
+    describe 'with deprecated auth parameters' do
+      let :params do
+        default_params.merge({
+          :auth_type         => 'keystone',
+          :keystone_tenant   => 'services',
+          :keystone_user     => 'glance',
+          :keystone_password => 'password',
+          :token_cache_time  => '1000',
+          :memcached_servers => 'localhost:11211',
+          :signing_dir       => '/tmp/keystone',
+          :auth_uri          => 'http://127.0.0.1:5000',
+          :identity_uri      => 'http://127.0.0.1:35357',
+        })
+      end
+      it 'deprecated auth parameters' do
+        is_expected.to contain_glance_api_config('keystone_authtoken/memcached_servers').with_value(params[:memcached_servers])
+        is_expected.to contain_glance_api_config('keystone_authtoken/username').with_value(params[:keystone_user])
+        is_expected.to contain_glance_api_config('keystone_authtoken/project_name').with_value(params[:keystone_tenant])
+        is_expected.to contain_glance_api_config('keystone_authtoken/password').with_value(params[:keystone_password])
+        is_expected.to contain_glance_api_config('keystone_authtoken/token_cache_time').with_value(params[:token_cache_time])
+        is_expected.to contain_glance_api_config('keystone_authtoken/signing_dir').with_value(params[:signing_dir])
+        is_expected.to contain_glance_api_config('keystone_authtoken/auth_uri').with_value(params[:auth_uri])
+        is_expected.to contain_glance_api_config('keystone_authtoken/auth_url').with_value(params[:identity_uri])
+      end
+    end
   end
 
   shared_examples_for 'glance::api Debian' do

spec/classes/glance_glare_authtoken_spec.rb

@@ -0,0 +1,145 @@
+require 'spec_helper'
+
+describe 'glance::glare::authtoken' do
+
+  let :params do
+    { :password => 'glance_glare_password', }
+  end
+
+  shared_examples 'glance_glare authtoken' do
+
+    context 'with default parameters' do
+
+      it 'configure keystone_authtoken' do
+        is_expected.to contain_glance_glare_config('keystone_authtoken/username').with_value('glance')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/password').with_value('glance_glare_password')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/auth_url').with_value('http://127.0.0.1:35357')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/project_name').with_value('services')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/user_domain_name').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/project_domain_name').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/insecure').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/auth_section').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/auth_type').with_value('password')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/auth_uri').with_value('http://127.0.0.1:5000')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/auth_version').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/cache').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/cafile').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/certfile').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/check_revocations_for_cached').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/delay_auth_decision').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/enforce_token_bind').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/hash_algorithms').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/http_connect_timeout').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/http_request_max_retries').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/include_service_catalog').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/keyfile').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_pool_dead_retry').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_pool_maxsize').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_pool_socket_timeout').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_pool_unused_timeout').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_secret_key').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_security_strategy').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_use_advanced_pool').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/memcached_servers').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/region_name').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/revocation_cache_time').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/signing_dir').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/token_cache_time').with_value('<SERVICE DEFAULT>')
+      end
+    end
+
+    context 'when overriding parameters' do
+      before do
+        params.merge!({
+          :auth_uri                             => 'https://10.0.0.1:9999/',
+          :username                             => 'myuser',
+          :password                             => 'mypasswd',
+          :auth_url                             => 'http://:127.0.0.1:35357',
+          :project_name                         => 'service_project',
+          :user_domain_name                     => 'domainX',
+          :project_domain_name                  => 'domainX',
+          :insecure                             => false,
+          :auth_section                         => 'new_section',
+          :auth_type                            => 'password',
+          :auth_version                         => 'v3',
+          :cache                                => 'somevalue',
+          :cafile                               => '/opt/stack/data/cafile.pem',
+          :certfile                             => 'certfile.crt',
+          :check_revocations_for_cached         => false,
+          :delay_auth_decision                  => false,
+          :enforce_token_bind                   => 'permissive',
+          :hash_algorithms                      => 'md5',
+          :http_connect_timeout                 => '300',
+          :http_request_max_retries             => '3',
+          :include_service_catalog              => true,
+          :keyfile                              => 'keyfile',
+          :memcache_pool_conn_get_timeout       => '9',
+          :memcache_pool_dead_retry             => '302',
+          :memcache_pool_maxsize                => '11',
+          :memcache_pool_socket_timeout         => '2',
+          :memcache_pool_unused_timeout         => '61',
+          :memcache_secret_key                  => 'secret_key',
+          :memcache_security_strategy           => 'ENCRYPT',
+          :memcache_use_advanced_pool           => true,
+          :memcached_servers                    => ['memcached01:11211','memcached02:11211'],
+          :region_name                          => 'region2',
+          :revocation_cache_time                => '11',
+          :signing_dir                          => '/var/cache',
+          :token_cache_time                     => '301',
+        })
+      end
+
+      it 'configure keystone_authtoken' do
+        is_expected.to contain_glance_glare_config('keystone_authtoken/auth_uri').with_value('https://10.0.0.1:9999/')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/username').with_value(params[:username])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/password').with_value(params[:password]).with_secret(true)
+        is_expected.to contain_glance_glare_config('keystone_authtoken/auth_url').with_value(params[:auth_url])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/project_name').with_value(params[:project_name])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/user_domain_name').with_value(params[:user_domain_name])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/project_domain_name').with_value(params[:project_domain_name])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/insecure').with_value(params[:insecure])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/auth_section').with_value(params[:auth_section])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/auth_type').with_value(params[:auth_type])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/auth_version').with_value(params[:auth_version])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/cache').with_value(params[:cache])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/cafile').with_value(params[:cafile])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/certfile').with_value(params[:certfile])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/check_revocations_for_cached').with_value(params[:check_revocations_for_cached])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/delay_auth_decision').with_value(params[:delay_auth_decision])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/enforce_token_bind').with_value(params[:enforce_token_bind])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/hash_algorithms').with_value(params[:hash_algorithms])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/http_connect_timeout').with_value(params[:http_connect_timeout])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/http_request_max_retries').with_value(params[:http_request_max_retries])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/include_service_catalog').with_value(params[:include_service_catalog])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/keyfile').with_value(params[:keyfile])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value(params[:memcache_pool_conn_get_timeout])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_pool_dead_retry').with_value(params[:memcache_pool_dead_retry])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_pool_maxsize').with_value(params[:memcache_pool_maxsize])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_pool_socket_timeout').with_value(params[:memcache_pool_socket_timeout])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_pool_unused_timeout').with_value(params[:memcache_pool_unused_timeout])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_secret_key').with_value(params[:memcache_secret_key])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_security_strategy').with_value(params[:memcache_security_strategy])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/memcache_use_advanced_pool').with_value(params[:memcache_use_advanced_pool])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/memcached_servers').with_value('memcached01:11211,memcached02:11211')
+        is_expected.to contain_glance_glare_config('keystone_authtoken/region_name').with_value(params[:region_name])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/revocation_cache_time').with_value(params[:revocation_cache_time])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/signing_dir').with_value(params[:signing_dir])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/token_cache_time').with_value(params[:token_cache_time])
+      end
+    end
+  end
+
+  on_supported_os({
+    :supported_os => OSDefaults.get_supported_os
+  }).each do |os,facts|
+    context "on #{os}" do
+      let (:facts) do
+        facts.merge!(OSDefaults.get_facts())
+      end
+
+      it_configures 'glance_glare authtoken'
+    end
+  end
+
+end

spec/classes/glance_glare_spec.rb

@@ -11,18 +11,11 @@ describe 'glance::glare' do
       :manage_service           => true,
       :backlog                  => '4096',
       :workers                  => '7',
-      :keystone_tenant          => 'services',
-      :keystone_user            => 'glance',
       :keystone_password        => 'ChangeMe',
-      :token_cache_time         => '<SERVICE DEFAULT>',
-      :memcached_servers        => '<SERVICE DEFAULT>',
       :stores                   => false,
       :default_store            => false,
       :os_region_name           => 'RegionOne',
-      :signing_dir              => '<SERVICE DEFAULT>',
       :pipeline                 => 'keystone',
-      :auth_uri                 => 'http://127.0.0.1:5000/',
-      :identity_uri             => 'http://127.0.0.1:35357/',
     }
   end
 
@@ -35,15 +28,9 @@ describe 'glance::glare' do
         :enabled                  => false,
         :backlog                  => '4095',
         :workers                  => '5',
-        :keystone_tenant          => 'admin2',
-        :keystone_user            => 'admin2',
         :keystone_password        => 'ChangeMe2',
-        :token_cache_time         => '300',
         :os_region_name           => 'RegionOne2',
-        :signing_dir              => '/path/to/dir',
         :pipeline                 => 'keystone2',
-        :auth_uri                 => 'http://127.0.0.1:5000/v2.0',
-        :identity_uri             => 'http://127.0.0.1:35357/v2.0',
       }
     ].each do |param_set|
 
@@ -98,11 +85,6 @@ describe 'glance::glare' do
         it 'is_expected.to configure itself for keystone if that is the auth_type' do
           if params[:auth_type] == 'keystone'
             is_expected.to contain('paste_deploy/flavor').with_value('keystone+cachemanagement')
-            is_expected.to contain_glance_glare_config('keystone_authtoken/memcached_servers').with_value(param_hash[:memcached_servers])
-            ['admin_tenant_name', 'admin_user', 'admin_password', 'token_cache_time', 'signing_dir', 'auth_uri', 'identity_uri'].each do |config|
-              is_expected.to contain_glance_glare_config("keystone_authtoken/#{config}").with_value(param_hash[config.intern])
-            end
-            is_expected.to contain_glance_glare_config('keystone_authtoken/admin_password').with_value(param_hash[:keystone_password]).with_secret(true)
           end
         end
       end
@@ -250,6 +232,32 @@ describe 'glance::glare' do
       it { is_expected.to contain_glance_glare_config('glance_store/default_store').with_value('glance.store.filesystem.Store') }
       it { is_expected.to contain_glance_glare_config('glance_store/stores').with_value('glance.store.filesystem.Store') }
     end
+
+    describe 'with deprecated auth parameters' do
+      let :params do
+        default_params.merge({
+          :auth_type         => 'keystone',
+          :keystone_tenant   => 'services',
+          :keystone_user     => 'glance',
+          :keystone_password => 'password',
+          :token_cache_time  => '1000',
+          :memcached_servers => 'localhost:11211',
+          :signing_dir       => '/tmp/keystone',
+          :auth_uri          => 'http://127.0.0.1:5000',
+          :identity_uri      => 'http://127.0.0.1:35357',
+        })
+      end
+      it 'deprecated auth parameters' do
+        is_expected.to contain_glance_glare_config('keystone_authtoken/memcached_servers').with_value(params[:memcached_servers])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/username').with_value(params[:keystone_user])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/project_name').with_value(params[:keystone_tenant])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/password').with_value(params[:keystone_password])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/token_cache_time').with_value(params[:token_cache_time])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/signing_dir').with_value(params[:signing_dir])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/auth_uri').with_value(params[:auth_uri])
+        is_expected.to contain_glance_glare_config('keystone_authtoken/auth_url').with_value(params[:identity_uri])
+      end
+    end
   end
 
   shared_examples_for 'glance::glare Debian' do

spec/classes/glance_registry_authtoken_spec.rb

@@ -0,0 +1,145 @@
+require 'spec_helper'
+
+describe 'glance::registry::authtoken' do
+
+  let :params do
+    { :password => 'glance_registry_password', }
+  end
+
+  shared_examples 'glance_registry authtoken' do
+
+    context 'with default parameters' do
+
+      it 'configure keystone_authtoken' do
+        is_expected.to contain_glance_registry_config('keystone_authtoken/username').with_value('glance')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/password').with_value('glance_registry_password')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/auth_url').with_value('http://127.0.0.1:35357')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/project_name').with_value('services')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/user_domain_name').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/project_domain_name').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/insecure').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/auth_section').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/auth_type').with_value('password')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/auth_uri').with_value('http://127.0.0.1:5000')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/auth_version').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/cache').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/cafile').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/certfile').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/check_revocations_for_cached').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/delay_auth_decision').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/enforce_token_bind').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/hash_algorithms').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/http_connect_timeout').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/http_request_max_retries').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/include_service_catalog').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/keyfile').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_pool_dead_retry').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_pool_maxsize').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_pool_socket_timeout').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_pool_unused_timeout').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_secret_key').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_security_strategy').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_use_advanced_pool').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/memcached_servers').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/region_name').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/revocation_cache_time').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/signing_dir').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/token_cache_time').with_value('<SERVICE DEFAULT>')
+      end
+    end
+
+    context 'when overriding parameters' do
+      before do
+        params.merge!({
+          :auth_uri                             => 'https://10.0.0.1:9999/',
+          :username                             => 'myuser',
+          :password                             => 'mypasswd',
+          :auth_url                             => 'http://:127.0.0.1:35357',
+          :project_name                         => 'service_project',
+          :user_domain_name                     => 'domainX',
+          :project_domain_name                  => 'domainX',
+          :insecure                             => false,
+          :auth_section                         => 'new_section',
+          :auth_type                            => 'password',
+          :auth_version                         => 'v3',
+          :cache                                => 'somevalue',
+          :cafile                               => '/opt/stack/data/cafile.pem',
+          :certfile                             => 'certfile.crt',
+          :check_revocations_for_cached         => false,
+          :delay_auth_decision                  => false,
+          :enforce_token_bind                   => 'permissive',
+          :hash_algorithms                      => 'md5',
+          :http_connect_timeout                 => '300',
+          :http_request_max_retries             => '3',
+          :include_service_catalog              => true,
+          :keyfile                              => 'keyfile',
+          :memcache_pool_conn_get_timeout       => '9',
+          :memcache_pool_dead_retry             => '302',
+          :memcache_pool_maxsize                => '11',
+          :memcache_pool_socket_timeout         => '2',
+          :memcache_pool_unused_timeout         => '61',
+          :memcache_secret_key                  => 'secret_key',
+          :memcache_security_strategy           => 'ENCRYPT',
+          :memcache_use_advanced_pool           => true,
+          :memcached_servers                    => ['memcached01:11211','memcached02:11211'],
+          :region_name                          => 'region2',
+          :revocation_cache_time                => '11',
+          :signing_dir                          => '/var/cache',
+          :token_cache_time                     => '301',
+        })
+      end
+
+      it 'configure keystone_authtoken' do
+        is_expected.to contain_glance_registry_config('keystone_authtoken/auth_uri').with_value('https://10.0.0.1:9999/')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/username').with_value(params[:username])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/password').with_value(params[:password]).with_secret(true)
+        is_expected.to contain_glance_registry_config('keystone_authtoken/auth_url').with_value(params[:auth_url])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/project_name').with_value(params[:project_name])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/user_domain_name').with_value(params[:user_domain_name])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/project_domain_name').with_value(params[:project_domain_name])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/insecure').with_value(params[:insecure])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/auth_section').with_value(params[:auth_section])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/auth_type').with_value(params[:auth_type])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/auth_version').with_value(params[:auth_version])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/cache').with_value(params[:cache])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/cafile').with_value(params[:cafile])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/certfile').with_value(params[:certfile])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/check_revocations_for_cached').with_value(params[:check_revocations_for_cached])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/delay_auth_decision').with_value(params[:delay_auth_decision])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/enforce_token_bind').with_value(params[:enforce_token_bind])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/hash_algorithms').with_value(params[:hash_algorithms])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/http_connect_timeout').with_value(params[:http_connect_timeout])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/http_request_max_retries').with_value(params[:http_request_max_retries])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/include_service_catalog').with_value(params[:include_service_catalog])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/keyfile').with_value(params[:keyfile])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_pool_conn_get_timeout').with_value(params[:memcache_pool_conn_get_timeout])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_pool_dead_retry').with_value(params[:memcache_pool_dead_retry])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_pool_maxsize').with_value(params[:memcache_pool_maxsize])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_pool_socket_timeout').with_value(params[:memcache_pool_socket_timeout])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_pool_unused_timeout').with_value(params[:memcache_pool_unused_timeout])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_secret_key').with_value(params[:memcache_secret_key])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_security_strategy').with_value(params[:memcache_security_strategy])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/memcache_use_advanced_pool').with_value(params[:memcache_use_advanced_pool])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/memcached_servers').with_value('memcached01:11211,memcached02:11211')
+        is_expected.to contain_glance_registry_config('keystone_authtoken/region_name').with_value(params[:region_name])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/revocation_cache_time').with_value(params[:revocation_cache_time])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/signing_dir').with_value(params[:signing_dir])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/token_cache_time').with_value(params[:token_cache_time])
+      end
+    end
+  end
+
+  on_supported_os({
+    :supported_os => OSDefaults.get_supported_os
+  }).each do |os,facts|
+    context "on #{os}" do
+      let (:facts) do
+        facts.merge!(OSDefaults.get_facts())
+      end
+
+      it_configures 'glance_registry authtoken'
+    end
+  end
+
+end

spec/classes/glance_registry_spec.rb

@@ -1,3 +1,4 @@
+require 'spec_helper'
 
 describe 'glance::registry' do
   let :default_params do
@@ -12,17 +13,10 @@ describe 'glance::registry' do
       :enabled                => true,
       :manage_service         => true,
       :auth_type              => 'keystone',
-      :auth_uri               => 'http://127.0.0.1:5000/',
-      :identity_uri           => 'http://127.0.0.1:35357/',
-      :keystone_tenant        => 'services',
-      :keystone_user          => 'glance',
       :keystone_password      => 'ChangeMe',
       :purge_config           => false,
       :sync_db                => true,
       :os_region_name         => '<SERVICE DEFAULT>',
-      :signing_dir            => '<SERVICE DEFAULT>',
-      :token_cache_time       => '<SERVICE DEFAULT>',
-      :memcached_servers      => '<SERVICE DEFAULT>',
       :ca_file                => '<SERVICE DEFAULT>',
       :cert_file              => '<SERVICE DEFAULT>',
       :key_file               => '<SERVICE DEFAULT>',
@@ -38,15 +32,9 @@ describe 'glance::registry' do
         :workers                => '5',
         :enabled                => false,
         :auth_type              => 'keystone',
-        :auth_uri               => 'http://127.0.0.1:5000/v2.0',
-        :identity_uri           => 'http://127.0.0.1:35357/v2.0',
-        :keystone_tenant        => 'admin',
-        :keystone_user          => 'admin',
         :keystone_password      => 'ChangeMe',
         :sync_db                => false,
         :os_region_name         => 'RegionOne2',
-        :signing_dir            => '/path/to/dir',
-        :token_cache_time       => '300',
       }
     ].each do |param_set|
 
@@ -92,21 +80,8 @@ describe 'glance::registry' do
           ].each do |config|
             is_expected.to contain_glance_registry_config("DEFAULT/#{config}").with_value(param_hash[config.intern])
           end
-          [
-           'auth_uri',
-           'identity_uri'
-          ].each do |config|
-            is_expected.to contain_glance_registry_config("keystone_authtoken/#{config}").with_value(param_hash[config.intern])
-          end
           if param_hash[:auth_type] == 'keystone'
             is_expected.to contain_glance_registry_config("paste_deploy/flavor").with_value('keystone')
-            is_expected.to contain_glance_registry_config('keystone_authtoken/memcached_servers').with_value(param_hash[:memcached_servers])
-            is_expected.to contain_glance_registry_config("keystone_authtoken/admin_tenant_name").with_value(param_hash[:keystone_tenant])
-            is_expected.to contain_glance_registry_config("keystone_authtoken/admin_user").with_value(param_hash[:keystone_user])
-            is_expected.to contain_glance_registry_config("keystone_authtoken/admin_password").with_value(param_hash[:keystone_password])
-            is_expected.to contain_glance_registry_config("keystone_authtoken/admin_password").with_value(param_hash[:keystone_password]).with_secret(true)
-            is_expected.to contain_glance_registry_config("keystone_authtoken/token_cache_time").with_value(param_hash[:token_cache_time])
-            is_expected.to contain_glance_registry_config("keystone_authtoken/signing_dir").with_value(param_hash[:signing_dir])
           end
         end
         it 'is_expected.to lay down default glance_store registry config' do
@@ -208,6 +183,32 @@ describe 'glance::registry' do
         it { is_expected.to contain_glance_registry_config('DEFAULT/key_file').with_value('/tmp/key_file') }
       end
     end
+
+    describe 'with deprecated auth parameters' do
+      let :params do
+        default_params.merge({
+          :auth_type         => 'keystone',
+          :keystone_tenant   => 'services',
+          :keystone_user     => 'glance',
+          :keystone_password => 'password',
+          :token_cache_time  => '1000',
+          :memcached_servers => 'localhost:11211',
+          :signing_dir       => '/tmp/keystone',
+          :auth_uri          => 'http://127.0.0.1:5000',
+          :identity_uri      => 'http://127.0.0.1:35357',
+        })
+      end
+      it 'deprecated auth parameters' do
+        is_expected.to contain_glance_registry_config('keystone_authtoken/memcached_servers').with_value(params[:memcached_servers])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/username').with_value(params[:keystone_user])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/project_name').with_value(params[:keystone_tenant])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/password').with_value(params[:keystone_password])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/token_cache_time').with_value(params[:token_cache_time])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/signing_dir').with_value(params[:signing_dir])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/auth_uri').with_value(params[:auth_uri])
+        is_expected.to contain_glance_registry_config('keystone_authtoken/auth_url').with_value(params[:identity_uri])
+      end
+    end
   end
 
   shared_examples_for 'glance::registry Debian' do