diff --git a/Gemfile b/Gemfile
index 722ad1422..3d9d4ad84 100644
--- a/Gemfile
+++ b/Gemfile
@@ -2,10 +2,13 @@ source 'https://rubygems.org'
 
 group :development, :test do
   gem 'puppetlabs_spec_helper', :require => false
-  gem 'puppet-lint-param-docs'
+  gem 'rspec-puppet', '~> 2.0.0', :require => false
+
   gem 'metadata-json-lint'
-  gem 'rspec-puppet', '~> 1.0.1'
-  gem 'rake', '10.1.1'
+  gem 'puppet-lint-param-docs'
+
+  gem 'json'
+  gem 'webmock'
 end
 
 if puppetversion = ENV['PUPPET_GEM_VERSION']
diff --git a/spec/classes/keystone_client_spec.rb b/spec/classes/keystone_client_spec.rb
index 5ed6f6bb2..2e58fad52 100644
--- a/spec/classes/keystone_client_spec.rb
+++ b/spec/classes/keystone_client_spec.rb
@@ -3,7 +3,7 @@ require 'spec_helper'
 describe 'keystone::client' do
 
   describe "with default parameters" do
-    it { should contain_package('python-keystoneclient').with(
+    it { is_expected.to contain_package('python-keystoneclient').with(
         'ensure' => 'present',
         'tag'    => 'openstack'
     ) }
@@ -14,7 +14,7 @@ describe 'keystone::client' do
       {:ensure => '2013.1'}
     end
 
-    it { should contain_package('python-keystoneclient').with(
+    it { is_expected.to contain_package('python-keystoneclient').with(
         'ensure' => '2013.1',
         'tag'    => 'openstack'
     ) }
diff --git a/spec/classes/keystone_cron_token_flush_spec.rb b/spec/classes/keystone_cron_token_flush_spec.rb
index 597042b36..88e1fd519 100644
--- a/spec/classes/keystone_cron_token_flush_spec.rb
+++ b/spec/classes/keystone_cron_token_flush_spec.rb
@@ -8,7 +8,7 @@ describe 'keystone::cron::token_flush' do
 
   describe 'with default parameters' do
     it 'configures a cron' do
-      should contain_cron('keystone-manage token_flush').with(
+      is_expected.to contain_cron('keystone-manage token_flush').with(
         :ensure      => 'present',
         :command     => 'keystone-manage token_flush >>/var/log/keystone/keystone-tokenflush.log 2>&1',
         :environment => 'PATH=/bin:/usr/bin:/usr/sbin SHELL=/bin/sh',
@@ -30,7 +30,7 @@ describe 'keystone::cron::token_flush' do
     end
 
     it 'configures a cron with delay' do
-      should contain_cron('keystone-manage token_flush').with(
+      is_expected.to contain_cron('keystone-manage token_flush').with(
         :ensure      => 'present',
         :command     => 'sleep `expr ${RANDOM} \\% 600`; keystone-manage token_flush >>/var/log/keystone/keystone-tokenflush.log 2>&1',
         :environment => 'PATH=/bin:/usr/bin:/usr/sbin SHELL=/bin/sh',
@@ -52,7 +52,7 @@ describe 'keystone::cron::token_flush' do
     end
 
     it 'configures a cron with delay' do
-      should contain_cron('keystone-manage token_flush').with(
+      is_expected.to contain_cron('keystone-manage token_flush').with(
         :ensure      => 'absent',
         :command     => 'keystone-manage token_flush >>/var/log/keystone/keystone-tokenflush.log 2>&1',
         :environment => 'PATH=/bin:/usr/bin:/usr/sbin SHELL=/bin/sh',
diff --git a/spec/classes/keystone_db_mysql_spec.rb b/spec/classes/keystone_db_mysql_spec.rb
index f20ea9b2c..2b4698dd4 100644
--- a/spec/classes/keystone_db_mysql_spec.rb
+++ b/spec/classes/keystone_db_mysql_spec.rb
@@ -20,7 +20,7 @@ describe 'keystone::db::mysql' do
   end
 
   describe 'with only required params' do
-    it { should contain_openstacklib__db__mysql('keystone').with(
+    it { is_expected.to contain_openstacklib__db__mysql('keystone').with(
       'user'          => 'keystone',
       'password_hash' => '*B552157B14BCEDDCEAA06767A012F31BDAA9CE3D',
       'dbname'        => 'keystone',
diff --git a/spec/classes/keystone_db_postgresql_spec.rb b/spec/classes/keystone_db_postgresql_spec.rb
index 36dcb1823..ecdad5a28 100644
--- a/spec/classes/keystone_db_postgresql_spec.rb
+++ b/spec/classes/keystone_db_postgresql_spec.rb
@@ -24,7 +24,7 @@ describe 'keystone::db::postgresql' do
         req_params
       end
 
-      it { should contain_postgresql__server__db('keystone').with(
+      it { is_expected.to contain_postgresql__server__db('keystone').with(
         :user     => 'keystone',
         :password => 'md5c530c33636c58ae83ca933f39319273e'
       )}
@@ -47,7 +47,7 @@ describe 'keystone::db::postgresql' do
         req_params
       end
 
-      it { should contain_postgresql__server__db('keystone').with(
+      it { is_expected.to contain_postgresql__server__db('keystone').with(
         :user     => 'keystone',
         :password => 'md5c530c33636c58ae83ca933f39319273e'
       )}
diff --git a/spec/classes/keystone_endpoint_spec.rb b/spec/classes/keystone_endpoint_spec.rb
index 87ba0bf2a..217d791f9 100644
--- a/spec/classes/keystone_endpoint_spec.rb
+++ b/spec/classes/keystone_endpoint_spec.rb
@@ -2,14 +2,14 @@ require 'spec_helper'
 
 describe 'keystone::endpoint' do
 
-  it { should contain_keystone_service('keystone').with(
+  it { is_expected.to contain_keystone_service('keystone').with(
     :ensure      => 'present',
     :type        => 'identity',
     :description => 'OpenStack Identity Service'
   )}
 
   describe 'with default parameters' do
-    it { should contain_keystone_endpoint('RegionOne/keystone').with(
+    it { is_expected.to contain_keystone_endpoint('RegionOne/keystone').with(
       :ensure       => 'present',
       :public_url   => 'http://127.0.0.1:5000/v2.0',
       :admin_url    => 'http://127.0.0.1:35357/v2.0',
@@ -26,7 +26,7 @@ describe 'keystone::endpoint' do
         :internal_url => 'https://identity-int.some.tld/some/internal/endpoint' }
     end
 
-    it { should contain_keystone_endpoint('RegionOne/keystone').with(
+    it { is_expected.to contain_keystone_endpoint('RegionOne/keystone').with(
       :ensure       => 'present',
       :public_url   => 'https://identity.some.tld/the/main/endpoint/v42.6',
       :admin_url    => 'https://identity-int.some.tld/some/admin/endpoint/v42.6',
@@ -41,7 +41,7 @@ describe 'keystone::endpoint' do
     end
 
     it 'internal_url should default to public_url' do
-      should contain_keystone_endpoint('RegionOne/keystone').with(
+      is_expected.to contain_keystone_endpoint('RegionOne/keystone').with(
         :ensure       => 'present',
         :public_url   => 'https://identity.some.tld/the/main/endpoint/v2.0',
         :internal_url => 'https://identity.some.tld/the/main/endpoint/v2.0'
diff --git a/spec/classes/keystone_ldap_spec.rb b/spec/classes/keystone_ldap_spec.rb
index 088526e86..966ca6af7 100644
--- a/spec/classes/keystone_ldap_spec.rb
+++ b/spec/classes/keystone_ldap_spec.rb
@@ -85,104 +85,104 @@ describe 'keystone::ldap' do
         :auth_pool_connection_lifetime => 200,
       }
     end
-    it { should contain_package('python-ldap') }
-    it { should contain_package('python-ldappool') }
+    it { is_expected.to contain_package('python-ldap') }
+    it { is_expected.to contain_package('python-ldappool') }
     it 'should have basic params' do
       # basic params
-      should contain_keystone_config('ldap/url').with_value('ldap://foo')
-      should contain_keystone_config('ldap/user').with_value('cn=foo,dc=example,dc=com')
-      should contain_keystone_config('ldap/password').with_value('abcdefg').with_secret(true)
-      should contain_keystone_config('ldap/suffix').with_value('dc=example,dc=com')
-      should contain_keystone_config('ldap/query_scope').with_value('sub')
-      should contain_keystone_config('ldap/page_size').with_value('50')
+      is_expected.to contain_keystone_config('ldap/url').with_value('ldap://foo')
+      is_expected.to contain_keystone_config('ldap/user').with_value('cn=foo,dc=example,dc=com')
+      is_expected.to contain_keystone_config('ldap/password').with_value('abcdefg').with_secret(true)
+      is_expected.to contain_keystone_config('ldap/suffix').with_value('dc=example,dc=com')
+      is_expected.to contain_keystone_config('ldap/query_scope').with_value('sub')
+      is_expected.to contain_keystone_config('ldap/page_size').with_value('50')
 
       # users
-      should contain_keystone_config('ldap/user_tree_dn').with_value('cn=users,dc=example,dc=com')
-      should contain_keystone_config('ldap/user_filter').with_value('(memberOf=cn=openstack,cn=groups,cn=accounts,dc=example,dc=com)')
-      should contain_keystone_config('ldap/user_objectclass').with_value('inetUser')
-      should contain_keystone_config('ldap/user_id_attribute').with_value('uid')
-      should contain_keystone_config('ldap/user_name_attribute').with_value('cn')
-      should contain_keystone_config('ldap/user_mail_attribute').with_value('mail')
-      should contain_keystone_config('ldap/user_enabled_attribute').with_value('UserAccountControl')
-      should contain_keystone_config('ldap/user_enabled_mask').with_value('2')
-      should contain_keystone_config('ldap/user_enabled_default').with_value('512')
-      should contain_keystone_config('ldap/user_enabled_invert').with_value('False')
-      should contain_keystone_config('ldap/user_attribute_ignore').with_value('')
-      should contain_keystone_config('ldap/user_default_project_id_attribute').with_value('defaultProject')
-      should contain_keystone_config('ldap/user_tree_dn').with_value('cn=users,dc=example,dc=com')
-      should contain_keystone_config('ldap/user_allow_create').with_value('False')
-      should contain_keystone_config('ldap/user_allow_update').with_value('False')
-      should contain_keystone_config('ldap/user_allow_delete').with_value('False')
-      should contain_keystone_config('ldap/user_pass_attribute').with_value('krbPassword')
-      should contain_keystone_config('ldap/user_enabled_emulation').with_value('True')
-      should contain_keystone_config('ldap/user_enabled_emulation_dn').with_value('cn=openstack-enabled,cn=groups,cn=accounts,dc=example,dc=com')
-      should contain_keystone_config('ldap/user_additional_attribute_mapping').with_value('description:name, gecos:name')
+      is_expected.to contain_keystone_config('ldap/user_tree_dn').with_value('cn=users,dc=example,dc=com')
+      is_expected.to contain_keystone_config('ldap/user_filter').with_value('(memberOf=cn=openstack,cn=groups,cn=accounts,dc=example,dc=com)')
+      is_expected.to contain_keystone_config('ldap/user_objectclass').with_value('inetUser')
+      is_expected.to contain_keystone_config('ldap/user_id_attribute').with_value('uid')
+      is_expected.to contain_keystone_config('ldap/user_name_attribute').with_value('cn')
+      is_expected.to contain_keystone_config('ldap/user_mail_attribute').with_value('mail')
+      is_expected.to contain_keystone_config('ldap/user_enabled_attribute').with_value('UserAccountControl')
+      is_expected.to contain_keystone_config('ldap/user_enabled_mask').with_value('2')
+      is_expected.to contain_keystone_config('ldap/user_enabled_default').with_value('512')
+      is_expected.to contain_keystone_config('ldap/user_enabled_invert').with_value('False')
+      is_expected.to contain_keystone_config('ldap/user_attribute_ignore').with_value('')
+      is_expected.to contain_keystone_config('ldap/user_default_project_id_attribute').with_value('defaultProject')
+      is_expected.to contain_keystone_config('ldap/user_tree_dn').with_value('cn=users,dc=example,dc=com')
+      is_expected.to contain_keystone_config('ldap/user_allow_create').with_value('False')
+      is_expected.to contain_keystone_config('ldap/user_allow_update').with_value('False')
+      is_expected.to contain_keystone_config('ldap/user_allow_delete').with_value('False')
+      is_expected.to contain_keystone_config('ldap/user_pass_attribute').with_value('krbPassword')
+      is_expected.to contain_keystone_config('ldap/user_enabled_emulation').with_value('True')
+      is_expected.to contain_keystone_config('ldap/user_enabled_emulation_dn').with_value('cn=openstack-enabled,cn=groups,cn=accounts,dc=example,dc=com')
+      is_expected.to contain_keystone_config('ldap/user_additional_attribute_mapping').with_value('description:name, gecos:name')
 
       # projects/tenants
-      should contain_keystone_config('ldap/project_tree_dn').with_value('ou=projects,ou=openstack,dc=example,dc=com')
-      should contain_keystone_config('ldap/project_filter').with_value('')
-      should contain_keystone_config('ldap/project_objectclass').with_value('organizationalUnit')
-      should contain_keystone_config('ldap/project_id_attribute').with_value('ou')
-      should contain_keystone_config('ldap/project_member_attribute').with_value('member')
-      should contain_keystone_config('ldap/project_desc_attribute').with_value('description')
-      should contain_keystone_config('ldap/project_name_attribute').with_value('ou')
-      should contain_keystone_config('ldap/project_enabled_attribute').with_value('enabled')
-      should contain_keystone_config('ldap/project_domain_id_attribute').with_value('businessCategory')
-      should contain_keystone_config('ldap/project_attribute_ignore').with_value('')
-      should contain_keystone_config('ldap/project_allow_create').with_value('True')
-      should contain_keystone_config('ldap/project_allow_update').with_value('True')
-      should contain_keystone_config('ldap/project_allow_delete').with_value('True')
-      should contain_keystone_config('ldap/project_enabled_emulation').with_value('False')
-      should contain_keystone_config('ldap/project_enabled_emulation_dn').with_value('True')
-      should contain_keystone_config('ldap/project_additional_attribute_mapping').with_value('cn=enabled,ou=openstack,dc=example,dc=com')
+      is_expected.to contain_keystone_config('ldap/project_tree_dn').with_value('ou=projects,ou=openstack,dc=example,dc=com')
+      is_expected.to contain_keystone_config('ldap/project_filter').with_value('')
+      is_expected.to contain_keystone_config('ldap/project_objectclass').with_value('organizationalUnit')
+      is_expected.to contain_keystone_config('ldap/project_id_attribute').with_value('ou')
+      is_expected.to contain_keystone_config('ldap/project_member_attribute').with_value('member')
+      is_expected.to contain_keystone_config('ldap/project_desc_attribute').with_value('description')
+      is_expected.to contain_keystone_config('ldap/project_name_attribute').with_value('ou')
+      is_expected.to contain_keystone_config('ldap/project_enabled_attribute').with_value('enabled')
+      is_expected.to contain_keystone_config('ldap/project_domain_id_attribute').with_value('businessCategory')
+      is_expected.to contain_keystone_config('ldap/project_attribute_ignore').with_value('')
+      is_expected.to contain_keystone_config('ldap/project_allow_create').with_value('True')
+      is_expected.to contain_keystone_config('ldap/project_allow_update').with_value('True')
+      is_expected.to contain_keystone_config('ldap/project_allow_delete').with_value('True')
+      is_expected.to contain_keystone_config('ldap/project_enabled_emulation').with_value('False')
+      is_expected.to contain_keystone_config('ldap/project_enabled_emulation_dn').with_value('True')
+      is_expected.to contain_keystone_config('ldap/project_additional_attribute_mapping').with_value('cn=enabled,ou=openstack,dc=example,dc=com')
 
       # roles
-      should contain_keystone_config('ldap/role_tree_dn').with_value('ou=roles,ou=openstack,dc=example,dc=com')
-      should contain_keystone_config('ldap/role_filter').with_value('')
-      should contain_keystone_config('ldap/role_objectclass').with_value('organizationalRole')
-      should contain_keystone_config('ldap/role_id_attribute').with_value('cn')
-      should contain_keystone_config('ldap/role_name_attribute').with_value('ou')
-      should contain_keystone_config('ldap/role_member_attribute').with_value('roleOccupant')
-      should contain_keystone_config('ldap/role_attribute_ignore').with_value('description')
-      should contain_keystone_config('ldap/role_allow_create').with_value('True')
-      should contain_keystone_config('ldap/role_allow_update').with_value('True')
-      should contain_keystone_config('ldap/role_allow_delete').with_value('True')
-      should contain_keystone_config('ldap/role_additional_attribute_mapping').with_value('')
+      is_expected.to contain_keystone_config('ldap/role_tree_dn').with_value('ou=roles,ou=openstack,dc=example,dc=com')
+      is_expected.to contain_keystone_config('ldap/role_filter').with_value('')
+      is_expected.to contain_keystone_config('ldap/role_objectclass').with_value('organizationalRole')
+      is_expected.to contain_keystone_config('ldap/role_id_attribute').with_value('cn')
+      is_expected.to contain_keystone_config('ldap/role_name_attribute').with_value('ou')
+      is_expected.to contain_keystone_config('ldap/role_member_attribute').with_value('roleOccupant')
+      is_expected.to contain_keystone_config('ldap/role_attribute_ignore').with_value('description')
+      is_expected.to contain_keystone_config('ldap/role_allow_create').with_value('True')
+      is_expected.to contain_keystone_config('ldap/role_allow_update').with_value('True')
+      is_expected.to contain_keystone_config('ldap/role_allow_delete').with_value('True')
+      is_expected.to contain_keystone_config('ldap/role_additional_attribute_mapping').with_value('')
 
       # groups
-      should contain_keystone_config('ldap/group_tree_dn').with_value('ou=groups,ou=openstack,dc=example,dc=com')
-      should contain_keystone_config('ldap/group_filter').with_value('cn=enabled-groups,cn=groups,cn=accounts,dc=example,dc=com')
-      should contain_keystone_config('ldap/group_objectclass').with_value('organizationalRole')
-      should contain_keystone_config('ldap/group_id_attribute').with_value('cn')
-      should contain_keystone_config('ldap/group_member_attribute').with_value('roleOccupant')
-      should contain_keystone_config('ldap/group_desc_attribute').with_value('description')
-      should contain_keystone_config('ldap/group_name_attribute').with_value('cn')
-      should contain_keystone_config('ldap/group_attribute_ignore').with_value('')
-      should contain_keystone_config('ldap/group_allow_create').with_value('False')
-      should contain_keystone_config('ldap/group_allow_update').with_value('False')
-      should contain_keystone_config('ldap/group_allow_delete').with_value('False')
-      should contain_keystone_config('ldap/group_additional_attribute_mapping').with_value('')
+      is_expected.to contain_keystone_config('ldap/group_tree_dn').with_value('ou=groups,ou=openstack,dc=example,dc=com')
+      is_expected.to contain_keystone_config('ldap/group_filter').with_value('cn=enabled-groups,cn=groups,cn=accounts,dc=example,dc=com')
+      is_expected.to contain_keystone_config('ldap/group_objectclass').with_value('organizationalRole')
+      is_expected.to contain_keystone_config('ldap/group_id_attribute').with_value('cn')
+      is_expected.to contain_keystone_config('ldap/group_member_attribute').with_value('roleOccupant')
+      is_expected.to contain_keystone_config('ldap/group_desc_attribute').with_value('description')
+      is_expected.to contain_keystone_config('ldap/group_name_attribute').with_value('cn')
+      is_expected.to contain_keystone_config('ldap/group_attribute_ignore').with_value('')
+      is_expected.to contain_keystone_config('ldap/group_allow_create').with_value('False')
+      is_expected.to contain_keystone_config('ldap/group_allow_update').with_value('False')
+      is_expected.to contain_keystone_config('ldap/group_allow_delete').with_value('False')
+      is_expected.to contain_keystone_config('ldap/group_additional_attribute_mapping').with_value('')
 
       # tls
-      should contain_keystone_config('ldap/use_tls').with_value('False')
-      should contain_keystone_config('ldap/tls_cacertdir').with_value('/etc/ssl/certs/')
-      should contain_keystone_config('ldap/tls_cacertfile').with_value('/etc/ssl/certs/ca-certificates.crt')
-      should contain_keystone_config('ldap/tls_req_cert').with_value('demand')
+      is_expected.to contain_keystone_config('ldap/use_tls').with_value('False')
+      is_expected.to contain_keystone_config('ldap/tls_cacertdir').with_value('/etc/ssl/certs/')
+      is_expected.to contain_keystone_config('ldap/tls_cacertfile').with_value('/etc/ssl/certs/ca-certificates.crt')
+      is_expected.to contain_keystone_config('ldap/tls_req_cert').with_value('demand')
 
       # ldap pooling
-      should contain_keystone_config('ldap/use_pool').with_value('True')
-      should contain_keystone_config('ldap/pool_size').with_value('20')
-      should contain_keystone_config('ldap/pool_retry_max').with_value('2')
-      should contain_keystone_config('ldap/pool_retry_delay').with_value('0.2')
-      should contain_keystone_config('ldap/pool_connection_timeout').with_value('222')
-      should contain_keystone_config('ldap/pool_connection_lifetime').with_value('222')
-      should contain_keystone_config('ldap/use_auth_pool').with_value('True')
-      should contain_keystone_config('ldap/auth_pool_size').with_value('20')
-      should contain_keystone_config('ldap/auth_pool_connection_lifetime').with_value('200')
+      is_expected.to contain_keystone_config('ldap/use_pool').with_value('True')
+      is_expected.to contain_keystone_config('ldap/pool_size').with_value('20')
+      is_expected.to contain_keystone_config('ldap/pool_retry_max').with_value('2')
+      is_expected.to contain_keystone_config('ldap/pool_retry_delay').with_value('0.2')
+      is_expected.to contain_keystone_config('ldap/pool_connection_timeout').with_value('222')
+      is_expected.to contain_keystone_config('ldap/pool_connection_lifetime').with_value('222')
+      is_expected.to contain_keystone_config('ldap/use_auth_pool').with_value('True')
+      is_expected.to contain_keystone_config('ldap/auth_pool_size').with_value('20')
+      is_expected.to contain_keystone_config('ldap/auth_pool_connection_lifetime').with_value('200')
 
       # drivers
-      should contain_keystone_config('identity/driver').with_value('keystone.identity.backends.ldap.Identity')
-      should contain_keystone_config('assignment/driver').with_value('keystone.assignment.backends.ldap.Assignment')
+      is_expected.to contain_keystone_config('identity/driver').with_value('keystone.identity.backends.ldap.Identity')
+      is_expected.to contain_keystone_config('assignment/driver').with_value('keystone.assignment.backends.ldap.Assignment')
     end
   end
 
@@ -208,22 +208,22 @@ describe 'keystone::ldap' do
       }
     end
     it 'should work with deprecated params' do
-      should contain_keystone_config('ldap/project_tree_dn').with_value('ou=projects,ou=openstack,dc=example,dc=com')
-      should contain_keystone_config('ldap/project_filter').with_value('')
-      should contain_keystone_config('ldap/project_objectclass').with_value('organizationalUnit')
-      should contain_keystone_config('ldap/project_id_attribute').with_value('ou')
-      should contain_keystone_config('ldap/project_member_attribute').with_value('member')
-      should contain_keystone_config('ldap/project_desc_attribute').with_value('description')
-      should contain_keystone_config('ldap/project_name_attribute').with_value('ou')
-      should contain_keystone_config('ldap/project_enabled_attribute').with_value('enabled')
-      should contain_keystone_config('ldap/project_domain_id_attribute').with_value('businessCategory')
-      should contain_keystone_config('ldap/project_attribute_ignore').with_value('')
-      should contain_keystone_config('ldap/project_allow_create').with_value('True')
-      should contain_keystone_config('ldap/project_allow_update').with_value('True')
-      should contain_keystone_config('ldap/project_allow_delete').with_value('True')
-      should contain_keystone_config('ldap/project_enabled_emulation').with_value('False')
-      should contain_keystone_config('ldap/project_enabled_emulation_dn').with_value('True')
-      should contain_keystone_config('ldap/project_additional_attribute_mapping').with_value('cn=enabled,ou=openstack,dc=example,dc=com')
+      is_expected.to contain_keystone_config('ldap/project_tree_dn').with_value('ou=projects,ou=openstack,dc=example,dc=com')
+      is_expected.to contain_keystone_config('ldap/project_filter').with_value(nil)
+      is_expected.to contain_keystone_config('ldap/project_objectclass').with_value('organizationalUnit')
+      is_expected.to contain_keystone_config('ldap/project_id_attribute').with_value('ou')
+      is_expected.to contain_keystone_config('ldap/project_member_attribute').with_value('member')
+      is_expected.to contain_keystone_config('ldap/project_desc_attribute').with_value('description')
+      is_expected.to contain_keystone_config('ldap/project_name_attribute').with_value('ou')
+      is_expected.to contain_keystone_config('ldap/project_enabled_attribute').with_value('enabled')
+      is_expected.to contain_keystone_config('ldap/project_domain_id_attribute').with_value('businessCategory')
+      is_expected.to contain_keystone_config('ldap/project_attribute_ignore').with_value(nil)
+      is_expected.to contain_keystone_config('ldap/project_allow_create').with_value('True')
+      is_expected.to contain_keystone_config('ldap/project_allow_update').with_value('True')
+      is_expected.to contain_keystone_config('ldap/project_allow_delete').with_value('True')
+      is_expected.to contain_keystone_config('ldap/project_enabled_emulation').with_value('False')
+      is_expected.to contain_keystone_config('ldap/project_enabled_emulation_dn').with_value('True')
+      is_expected.to contain_keystone_config('ldap/project_additional_attribute_mapping').with_value('cn=enabled,ou=openstack,dc=example,dc=com')
     end
   end
 
@@ -234,10 +234,7 @@ describe 'keystone::ldap' do
         :project_tree_dn => 'ou=projects,ou=new-openstack,dc=example,dc=com',
       }
     end
-    it 'should fail with deprecated and new params both set' do
-        expect {
-            should compile
-        }.to raise_error Puppet::Error, /tenant_tree_dn and project_tree_dn are both set. results may be unexpected/
-    end
+
+    it_raises 'a Puppet::Error', /tenant_tree_dn and project_tree_dn are both set. results may be unexpected/
   end
 end
diff --git a/spec/classes/keystone_logging_spec.rb b/spec/classes/keystone_logging_spec.rb
index 7ae935201..f0ac50d7c 100644
--- a/spec/classes/keystone_logging_spec.rb
+++ b/spec/classes/keystone_logging_spec.rb
@@ -42,36 +42,36 @@ describe 'keystone::logging' do
 
   shared_examples_for 'logging params set' do
     it 'enables logging params' do
-      should contain_keystone_config('DEFAULT/logging_context_format_string').with_value(
+      is_expected.to contain_keystone_config('DEFAULT/logging_context_format_string').with_value(
         '%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [%(request_id)s %(user_identity)s] %(instance)s%(message)s')
 
-      should contain_keystone_config('DEFAULT/logging_default_format_string').with_value(
+      is_expected.to contain_keystone_config('DEFAULT/logging_default_format_string').with_value(
         '%(asctime)s.%(msecs)03d %(process)d %(levelname)s %(name)s [-] %(instance)s%(message)s')
 
-      should contain_keystone_config('DEFAULT/logging_debug_format_suffix').with_value(
+      is_expected.to contain_keystone_config('DEFAULT/logging_debug_format_suffix').with_value(
         '%(funcName)s %(pathname)s:%(lineno)d')
 
-      should contain_keystone_config('DEFAULT/logging_exception_prefix').with_value(
+      is_expected.to contain_keystone_config('DEFAULT/logging_exception_prefix').with_value(
        '%(asctime)s.%(msecs)03d %(process)d TRACE %(name)s %(instance)s')
 
-      should contain_keystone_config('DEFAULT/log_config_append').with_value(
+      is_expected.to contain_keystone_config('DEFAULT/log_config_append').with_value(
         '/etc/keystone/logging.conf')
-      should contain_keystone_config('DEFAULT/publish_errors').with_value(
+      is_expected.to contain_keystone_config('DEFAULT/publish_errors').with_value(
         true)
 
-      should contain_keystone_config('DEFAULT/default_log_levels').with_value(
+      is_expected.to contain_keystone_config('DEFAULT/default_log_levels').with_value(
         'amqp=WARN,amqplib=WARN,boto=WARN,iso8601=WARN,qpid=WARN,requests.packages.urllib3.connectionpool=WARN,sqlalchemy=WARN,suds=INFO')
 
-      should contain_keystone_config('DEFAULT/fatal_deprecations').with_value(
+      is_expected.to contain_keystone_config('DEFAULT/fatal_deprecations').with_value(
         true)
 
-      should contain_keystone_config('DEFAULT/instance_format').with_value(
+      is_expected.to contain_keystone_config('DEFAULT/instance_format').with_value(
         '[instance: %(uuid)s] ')
 
-      should contain_keystone_config('DEFAULT/instance_uuid_format').with_value(
+      is_expected.to contain_keystone_config('DEFAULT/instance_uuid_format').with_value(
         '[instance: %(uuid)s] ')
 
-      should contain_keystone_config('DEFAULT/log_date_format').with_value(
+      is_expected.to contain_keystone_config('DEFAULT/log_date_format').with_value(
         '%Y-%m-%d %H:%M:%S')
     end
   end
@@ -84,7 +84,7 @@ describe 'keystone::logging' do
      :default_log_levels, :fatal_deprecations,
      :instance_format, :instance_uuid_format,
      :log_date_format, ].each { |param|
-        it { should contain_keystone_config("DEFAULT/#{param}").with_ensure('absent') }
+        it { is_expected.to contain_keystone_config("DEFAULT/#{param}").with_ensure('absent') }
       }
   end
 
diff --git a/spec/classes/keystone_policy_spec.rb b/spec/classes/keystone_policy_spec.rb
index 81f69da5f..56c8f8bc4 100644
--- a/spec/classes/keystone_policy_spec.rb
+++ b/spec/classes/keystone_policy_spec.rb
@@ -16,7 +16,7 @@ describe 'keystone::policy' do
     end
 
     it 'set up the policies' do
-      should contain_openstacklib__policy__base('context_is_admin').with({
+      is_expected.to contain_openstacklib__policy__base('context_is_admin').with({
         :key   => 'context_is_admin',
         :value => 'foo:bar'
       })
diff --git a/spec/classes/keystone_python_spec.rb b/spec/classes/keystone_python_spec.rb
index 1324fb2f6..500413e96 100644
--- a/spec/classes/keystone_python_spec.rb
+++ b/spec/classes/keystone_python_spec.rb
@@ -6,12 +6,12 @@ describe 'keystone::python' do
     { :osfamily => 'Debian' }
   end
 
-  it { should contain_package('python-keystone').with_ensure("present") }
+  it { is_expected.to contain_package('python-keystone').with_ensure("present") }
 
   describe 'override ensure' do
     let(:params) { { :ensure => "latest" } }
 
-    it { should contain_package('python-keystone').with_ensure("latest") }
+    it { is_expected.to contain_package('python-keystone').with_ensure("latest") }
   end
 
 end
diff --git a/spec/classes/keystone_roles_admin_spec.rb b/spec/classes/keystone_roles_admin_spec.rb
index ba7d53296..bbd6d953b 100644
--- a/spec/classes/keystone_roles_admin_spec.rb
+++ b/spec/classes/keystone_roles_admin_spec.rb
@@ -11,17 +11,17 @@ describe 'keystone::roles::admin' do
       }
     end
 
-    it { should contain_keystone_tenant('services').with(
+    it { is_expected.to contain_keystone_tenant('services').with(
       :ensure      => 'present',
       :enabled     => true,
       :description => 'Tenant for the openstack services'
     )}
-    it { should contain_keystone_tenant('openstack').with(
+    it { is_expected.to contain_keystone_tenant('openstack').with(
       :ensure      => 'present',
       :enabled     => true,
       :description => 'admin tenant'
     )}
-    it { should contain_keystone_user('admin').with(
+    it { is_expected.to contain_keystone_user('admin').with(
       :ensure                 => 'present',
       :enabled                => true,
       :tenant                 => 'openstack',
@@ -29,8 +29,8 @@ describe 'keystone::roles::admin' do
       :password               => 'ChangeMe',
       :ignore_default_tenant  => 'false'
     )}
-    it { should contain_keystone_role('admin').with_ensure('present') }
-    it { should contain_keystone_user_role('admin@openstack').with(
+    it { is_expected.to contain_keystone_role('admin').with_ensure('present') }
+    it { is_expected.to contain_keystone_user_role('admin@openstack').with(
       :roles  => ['admin'],
       :ensure => 'present'
     )}
@@ -53,17 +53,17 @@ describe 'keystone::roles::admin' do
       }
     end
 
-    it { should contain_keystone_tenant('foobar').with(
+    it { is_expected.to contain_keystone_tenant('foobar').with(
       :ensure  => 'present',
       :enabled => true,
       :description => 'foobar description'
     )}
-    it { should contain_keystone_tenant('admin').with(
+    it { is_expected.to contain_keystone_tenant('admin').with(
       :ensure      => 'present',
       :enabled     => true,
       :description => 'admin something else'
     )}
-    it { should contain_keystone_user('admin').with(
+    it { is_expected.to contain_keystone_user('admin').with(
       :ensure                 => 'present',
       :enabled                => true,
       :tenant                 => 'admin',
@@ -71,7 +71,7 @@ describe 'keystone::roles::admin' do
       :password               => 'foo',
       :ignore_default_tenant  => 'true'
     )}
-    it { should contain_keystone_user_role('admin@admin').with(
+    it { is_expected.to contain_keystone_user_role('admin@admin').with(
       :roles  => ['admin', 'heat_stack_owner'],
       :ensure => 'present'
     )}
@@ -86,8 +86,8 @@ describe 'keystone::roles::admin' do
         }
       end
 
-      it { should_not contain_keystone_user('keystone') }
-      it { should contain_keystone_user_role('keystone@openstack') }
+      it { is_expected.to_not contain_keystone_user('keystone') }
+      it { is_expected.to contain_keystone_user_role('keystone@openstack') }
     end
   end
 
@@ -100,8 +100,8 @@ describe 'keystone::roles::admin' do
         }
       end
 
-      it { should_not contain_keystone_user('keystone') }
-      it { should_not contain_keystone_user_role('keystone@openstack') }
+      it { is_expected.to_not contain_keystone_user('keystone') }
+      it { is_expected.to_not contain_keystone_user_role('keystone@openstack') }
     end
   end
 
diff --git a/spec/classes/keystone_service_spec.rb b/spec/classes/keystone_service_spec.rb
index 29d90b0d5..cd2d2057a 100644
--- a/spec/classes/keystone_service_spec.rb
+++ b/spec/classes/keystone_service_spec.rb
@@ -3,13 +3,13 @@ require 'spec_helper'
 describe 'keystone::service' do
 
   describe "with default parameters" do
-    it { should contain_service('keystone').with(
+    it { is_expected.to contain_service('keystone').with(
       :ensure     => 'running',
       :enable     => true,
       :hasstatus  => true,
       :hasrestart => true
     ) }
-    it { should_not contain_exec('validate_keystone_connection') }
+    it { is_expected.to_not contain_exec('validate_keystone_connection') }
   end
 
   describe "with validation on" do
@@ -20,12 +20,12 @@ describe 'keystone::service' do
       }
     end
 
-    it { should contain_service('keystone').with(
+    it { is_expected.to contain_service('keystone').with(
       :ensure     => 'running',
       :enable     => true,
       :hasstatus  => true,
       :hasrestart => true
     ) }
-    it { should contain_exec('validate_keystone_connection') }
+    it { is_expected.to contain_exec('validate_keystone_connection') }
   end
 end
diff --git a/spec/classes/keystone_spec.rb b/spec/classes/keystone_spec.rb
index b362817f6..752debad6 100644
--- a/spec/classes/keystone_spec.rb
+++ b/spec/classes/keystone_spec.rb
@@ -95,24 +95,24 @@ describe 'keystone' do
   httpd_params = {'service_name' => 'httpd'}.merge(default_params)
 
   shared_examples_for 'core keystone examples' do |param_hash|
-    it { should contain_class('keystone::params') }
+    it { is_expected.to contain_class('keystone::params') }
 
-    it { should contain_package('keystone').with(
+    it { is_expected.to contain_package('keystone').with(
       'ensure' => param_hash['package_ensure'],
       'tag'    => 'openstack'
     ) }
 
-    it { should contain_package('python-openstackclient').with(
+    it { is_expected.to contain_package('python-openstackclient').with(
       'ensure' => param_hash['client_package_ensure'],
       'tag'    => 'openstack'
     ) }
 
-    it { should contain_group('keystone').with(
+    it { is_expected.to contain_group('keystone').with(
       'ensure' => 'present',
       'system' => true
     ) }
 
-    it { should contain_user('keystone').with(
+    it { is_expected.to contain_user('keystone').with(
       'ensure' => 'present',
       'gid'    => 'keystone',
       'system' => true
@@ -120,7 +120,7 @@ describe 'keystone' do
 
     it 'should contain the expected directories' do
       ['/etc/keystone', '/var/log/keystone', '/var/lib/keystone'].each do |d|
-        should contain_file(d).with(
+        is_expected.to contain_file(d).with(
           'ensure'     => 'directory',
           'owner'      => 'keystone',
           'group'      => 'keystone',
@@ -132,7 +132,7 @@ describe 'keystone' do
 
     it 'should only synchronize the db if $enabled is true' do
       if param_hash['enabled']
-        should contain_exec('keystone-manage db_sync').with(
+        is_expected.to contain_exec('keystone-manage db_sync').with(
           :user        => 'keystone',
           :refreshonly => true,
           :subscribe   => ['Package[keystone]', 'Keystone_config[database/connection]'],
@@ -150,25 +150,25 @@ describe 'keystone' do
        'verbose',
        'debug'
       ].each do |config|
-        should contain_keystone_config("DEFAULT/#{config}").with_value(param_hash[config])
+        is_expected.to contain_keystone_config("DEFAULT/#{config}").with_value(param_hash[config])
       end
     end
 
     it 'should contain correct admin_token config' do
-      should contain_keystone_config('DEFAULT/admin_token').with_value(param_hash['admin_token']).with_secret(true)
+      is_expected.to contain_keystone_config('DEFAULT/admin_token').with_value(param_hash['admin_token']).with_secret(true)
     end
 
     it 'should contain correct mysql config' do
-      should contain_keystone_config('database/idle_timeout').with_value(param_hash['database_idle_timeout'])
-      should contain_keystone_config('database/connection').with_value(param_hash['database_connection']).with_secret(true)
+      is_expected.to contain_keystone_config('database/idle_timeout').with_value(param_hash['database_idle_timeout'])
+      is_expected.to contain_keystone_config('database/connection').with_value(param_hash['database_connection']).with_secret(true)
     end
 
-    it { should contain_keystone_config('token/provider').with_value(
+    it { is_expected.to contain_keystone_config('token/provider').with_value(
       param_hash['token_provider']
     ) }
 
     it 'should contain correct token driver' do
-      should contain_keystone_config('token/driver').with_value(param_hash['token_driver'])
+      is_expected.to contain_keystone_config('token/driver').with_value(param_hash['token_driver'])
     end
 
     it 'should contain correct revoke driver' do
@@ -177,35 +177,35 @@ describe 'keystone' do
 
     it 'should ensure proper setting of admin_endpoint and public_endpoint' do
       if param_hash['admin_endpoint']
-        should contain_keystone_config('DEFAULT/admin_endpoint').with_value(param_hash['admin_endpoint'])
+        is_expected.to contain_keystone_config('DEFAULT/admin_endpoint').with_value(param_hash['admin_endpoint'])
       else
-        should contain_keystone_config('DEFAULT/admin_endpoint').with_ensure('absent')
+        is_expected.to contain_keystone_config('DEFAULT/admin_endpoint').with_ensure('absent')
       end
       if param_hash['public_endpoint']
-        should contain_keystone_config('DEFAULT/public_endpoint').with_value(param_hash['public_endpoint'])
+        is_expected.to contain_keystone_config('DEFAULT/public_endpoint').with_value(param_hash['public_endpoint'])
       else
-        should contain_keystone_config('DEFAULT/public_endpoint').with_ensure('absent')
+        is_expected.to contain_keystone_config('DEFAULT/public_endpoint').with_ensure('absent')
       end
     end
 
     it 'should contain correct rabbit_password' do
-      should contain_keystone_config('DEFAULT/rabbit_password').with_value(param_hash['rabbit_password']).with_secret(true)
+      is_expected.to contain_keystone_config('DEFAULT/rabbit_password').with_value(param_hash['rabbit_password']).with_secret(true)
     end
 
     it 'should remove max_token_size param by default' do
-      should contain_keystone_config('DEFAULT/max_token_size').with_ensure('absent')
+      is_expected.to contain_keystone_config('DEFAULT/max_token_size').with_ensure('absent')
     end
 
     it 'should ensure proper setting of admin_workers and public_workers' do
       if param_hash['admin_workers']
-        should contain_keystone_config('DEFAULT/admin_workers').with_value(param_hash['admin_workers'])
+        is_expected.to contain_keystone_config('DEFAULT/admin_workers').with_value(param_hash['admin_workers'])
       else
-        should contain_keystone_config('DEFAULT/admin_workers').with_value('2')
+        is_expected.to contain_keystone_config('DEFAULT/admin_workers').with_value('2')
       end
       if param_hash['public_workers']
-        should contain_keystone_config('DEFAULT/public_workers').with_value(param_hash['public_workers'])
+        is_expected.to contain_keystone_config('DEFAULT/public_workers').with_value(param_hash['public_workers'])
       else
-        should contain_keystone_config('DEFAULT/public_workers').with_value('2')
+        is_expected.to contain_keystone_config('DEFAULT/public_workers').with_value('2')
       end
     end
   end
@@ -219,7 +219,7 @@ describe 'keystone' do
 
       it_configures 'core keystone examples', param_hash
 
-      it { should contain_service('keystone').with(
+      it { is_expected.to contain_service('keystone').with(
         'ensure'     => param_hash['enabled'] ? 'running' : 'stopped',
         'enable'     => param_hash['enabled'],
         'hasstatus'  => true,
@@ -242,7 +242,7 @@ describe 'keystone' do
 
     it do
       expect {
-        should contain_service('keystone')
+        is_expected.to contain_service('keystone')
       }.to raise_error(RSpec::Expectations::ExpectationNotMetError, /expected that the catalogue would contain Service\[keystone\]/)
     end
 
@@ -257,23 +257,23 @@ describe 'keystone' do
           'token_provider' => 'keystone.token.providers.uuid.Provider'
         }
       end
-      it { should contain_exec('keystone-manage pki_setup').with(
+      it { is_expected.to contain_exec('keystone-manage pki_setup').with(
         :creates => '/etc/keystone/ssl/private/signing_key.pem'
       ) }
-      it { should contain_file('/var/cache/keystone').with_ensure('directory') }
+      it { is_expected.to contain_file('/var/cache/keystone').with_ensure('directory') }
 
       describe 'when overriding the cache dir' do
         before do
           params.merge!(:cache_dir => '/var/lib/cache/keystone')
         end
-        it { should contain_file('/var/lib/cache/keystone') }
+        it { is_expected.to contain_file('/var/lib/cache/keystone') }
       end
 
       describe 'when disable pki_setup' do
         before do
           params.merge!(:enable_pki_setup => false)
         end
-        it { should_not contain_exec('keystone-manage pki_setup') }
+        it { is_expected.to_not contain_exec('keystone-manage pki_setup') }
       end
     end
 
@@ -284,23 +284,23 @@ describe 'keystone' do
           'token_provider' => 'keystone.token.providers.pki.Provider'
         }
       end
-      it { should contain_exec('keystone-manage pki_setup').with(
+      it { is_expected.to contain_exec('keystone-manage pki_setup').with(
         :creates => '/etc/keystone/ssl/private/signing_key.pem'
       ) }
-      it { should contain_file('/var/cache/keystone').with_ensure('directory') }
+      it { is_expected.to contain_file('/var/cache/keystone').with_ensure('directory') }
 
       describe 'when overriding the cache dir' do
         before do
           params.merge!(:cache_dir => '/var/lib/cache/keystone')
         end
-        it { should contain_file('/var/lib/cache/keystone') }
+        it { is_expected.to contain_file('/var/lib/cache/keystone') }
       end
 
       describe 'when disable pki_setup' do
         before do
           params.merge!(:enable_pki_setup => false)
         end
-        it { should_not contain_exec('keystone-manage pki_setup') }
+        it { is_expected.to_not contain_exec('keystone-manage pki_setup') }
       end
     end
 
@@ -319,30 +319,30 @@ describe 'keystone' do
         }
       end
 
-      it { should_not contain_exec('keystone-manage pki_setup') }
+      it { is_expected.to_not contain_exec('keystone-manage pki_setup') }
 
       it 'should contain correct PKI certfile config' do
-        should contain_keystone_config('signing/certfile').with_value('signing_certfile')
+        is_expected.to contain_keystone_config('signing/certfile').with_value('signing_certfile')
       end
 
       it 'should contain correct PKI keyfile config' do
-        should contain_keystone_config('signing/keyfile').with_value('signing_keyfile')
+        is_expected.to contain_keystone_config('signing/keyfile').with_value('signing_keyfile')
       end
 
       it 'should contain correct PKI ca_certs config' do
-        should contain_keystone_config('signing/ca_certs').with_value('signing_ca_certs')
+        is_expected.to contain_keystone_config('signing/ca_certs').with_value('signing_ca_certs')
       end
 
       it 'should contain correct PKI ca_key config' do
-        should contain_keystone_config('signing/ca_key').with_value('signing_ca_key')
+        is_expected.to contain_keystone_config('signing/ca_key').with_value('signing_ca_key')
       end
 
       it 'should contain correct PKI cert_subject config' do
-        should contain_keystone_config('signing/cert_subject').with_value('signing_cert_subject')
+        is_expected.to contain_keystone_config('signing/cert_subject').with_value('signing_cert_subject')
       end
 
       it 'should contain correct PKI key_size config' do
-        should contain_keystone_config('signing/key_size').with_value('2048')
+        is_expected.to contain_keystone_config('signing/key_size').with_value('2048')
       end
     end
 
@@ -361,30 +361,30 @@ describe 'keystone' do
         }
       end
 
-      it { should_not contain_exec('keystone-manage pki_setup') }
+      it { is_expected.to_not contain_exec('keystone-manage pki_setup') }
 
       it 'should contain correct PKI certfile config' do
-        should contain_keystone_config('signing/certfile').with_value('signing_certfile')
+        is_expected.to contain_keystone_config('signing/certfile').with_value('signing_certfile')
       end
 
       it 'should contain correct PKI keyfile config' do
-        should contain_keystone_config('signing/keyfile').with_value('signing_keyfile')
+        is_expected.to contain_keystone_config('signing/keyfile').with_value('signing_keyfile')
       end
 
       it 'should contain correct PKI ca_certs config' do
-        should contain_keystone_config('signing/ca_certs').with_value('signing_ca_certs')
+        is_expected.to contain_keystone_config('signing/ca_certs').with_value('signing_ca_certs')
       end
 
       it 'should contain correct PKI ca_key config' do
-        should contain_keystone_config('signing/ca_key').with_value('signing_ca_key')
+        is_expected.to contain_keystone_config('signing/ca_key').with_value('signing_ca_key')
       end
 
       it 'should contain correct PKI cert_subject config' do
-        should contain_keystone_config('signing/cert_subject').with_value('signing_cert_subject')
+        is_expected.to contain_keystone_config('signing/cert_subject').with_value('signing_cert_subject')
       end
 
       it 'should contain correct PKI key_size config' do
-        should contain_keystone_config('signing/key_size').with_value('2048')
+        is_expected.to contain_keystone_config('signing/key_size').with_value('2048')
       end
     end
 
@@ -403,7 +403,7 @@ describe 'keystone' do
           :catalog_driver => 'keystone.catalog.backends.alien.AlienCatalog' }
       end
 
-      it { should contain_keystone_config('catalog/driver').with_value(params[:catalog_driver]) }
+      it { is_expected.to contain_keystone_config('catalog/driver').with_value(params[:catalog_driver]) }
     end
   end
 
@@ -415,7 +415,7 @@ describe 'keystone' do
       }
     end
 
-    it { should contain_keystone_config("token/expiration").with_value('42') }
+    it { is_expected.to contain_keystone_config("token/expiration").with_value('42') }
   end
 
   describe 'when not configuring token expiration' do
@@ -425,7 +425,7 @@ describe 'keystone' do
       }
     end
 
-    it { should contain_keystone_config("token/expiration").with_value('3600') }
+    it { is_expected.to contain_keystone_config("token/expiration").with_value('3600') }
   end
 
   describe 'configure memcache servers if set' do
@@ -439,12 +439,12 @@ describe 'keystone' do
       }
     end
 
-    it { should contain_keystone_config("memcache/servers").with_value('SERVER1:11211,SERVER2:11211') }
-    it { should contain_keystone_config('cache/enabled').with_value(true) }
-    it { should contain_keystone_config('token/caching').with_value(true) }
-    it { should contain_keystone_config('cache/backend').with_value('dogpile.cache.memcached') }
-    it { should contain_keystone_config('cache/backend_argument').with_value('url:SERVER1:12211') }
-    it { should contain_package('python-memcache').with(
+    it { is_expected.to contain_keystone_config("memcache/servers").with_value('SERVER1:11211,SERVER2:11211') }
+    it { is_expected.to contain_keystone_config('cache/enabled').with_value(true) }
+    it { is_expected.to contain_keystone_config('token/caching').with_value(true) }
+    it { is_expected.to contain_keystone_config('cache/backend').with_value('dogpile.cache.memcached') }
+    it { is_expected.to contain_keystone_config('cache/backend_argument').with_value('url:SERVER1:12211') }
+    it { is_expected.to contain_package('python-memcache').with(
       :name   => 'python-memcache',
       :ensure => 'present'
     ) }
@@ -455,12 +455,12 @@ describe 'keystone' do
       default_params
     end
 
-    it { should contain_keystone_config("cache/enabled").with_ensure('absent') }
-    it { should contain_keystone_config("token/caching").with_ensure('absent') }
-    it { should contain_keystone_config("cache/backend").with_ensure('absent') }
-    it { should contain_keystone_config("cache/backend_argument").with_ensure('absent') }
-    it { should contain_keystone_config("cache/debug_cache_backend").with_ensure('absent') }
-    it { should contain_keystone_config("memcache/servers").with_ensure('absent') }
+    it { is_expected.to contain_keystone_config("cache/enabled").with_ensure('absent') }
+    it { is_expected.to contain_keystone_config("token/caching").with_ensure('absent') }
+    it { is_expected.to contain_keystone_config("cache/backend").with_ensure('absent') }
+    it { is_expected.to contain_keystone_config("cache/backend_argument").with_ensure('absent') }
+    it { is_expected.to contain_keystone_config("cache/debug_cache_backend").with_ensure('absent') }
+    it { is_expected.to contain_keystone_config("memcache/servers").with_ensure('absent') }
   end
 
   describe 'raise error if memcache_servers is not an array' do
@@ -471,7 +471,7 @@ describe 'keystone' do
       }
     end
 
-    it { expect { should contain_class('keystone::params') }.to \
+    it { expect { is_expected.to contain_class('keystone::params') }.to \
       raise_error(Puppet::Error, /is not an Array/) }
   end
 
@@ -480,8 +480,8 @@ describe 'keystone' do
       default_params
     end
 
-    it { should contain_keystone_config('DEFAULT/use_syslog').with_value(false) }
-    it { should_not contain_keystone_config('DEFAULT/syslog_log_facility') }
+    it { is_expected.to contain_keystone_config('DEFAULT/use_syslog').with_value(false) }
+    it { is_expected.to_not contain_keystone_config('DEFAULT/syslog_log_facility') }
   end
 
   describe 'with syslog enabled' do
@@ -491,8 +491,8 @@ describe 'keystone' do
       })
     end
 
-    it { should contain_keystone_config('DEFAULT/use_syslog').with_value(true) }
-    it { should contain_keystone_config('DEFAULT/syslog_log_facility').with_value('LOG_USER') }
+    it { is_expected.to contain_keystone_config('DEFAULT/use_syslog').with_value(true) }
+    it { is_expected.to contain_keystone_config('DEFAULT/syslog_log_facility').with_value('LOG_USER') }
   end
 
   describe 'with syslog enabled and custom settings' do
@@ -503,15 +503,15 @@ describe 'keystone' do
      })
     end
 
-    it { should contain_keystone_config('DEFAULT/use_syslog').with_value(true) }
-    it { should contain_keystone_config('DEFAULT/syslog_log_facility').with_value('LOG_LOCAL0') }
+    it { is_expected.to contain_keystone_config('DEFAULT/use_syslog').with_value(true) }
+    it { is_expected.to contain_keystone_config('DEFAULT/syslog_log_facility').with_value('LOG_LOCAL0') }
   end
 
   describe 'with log_file disabled by default' do
     let :params do
       default_params
     end
-    it { should contain_keystone_config('DEFAULT/log_file').with_ensure('absent') }
+    it { is_expected.to contain_keystone_config('DEFAULT/log_file').with_ensure('absent') }
   end
 
   describe 'with log_file and log_dir enabled' do
@@ -521,8 +521,8 @@ describe 'keystone' do
         :log_dir    => '/var/lib/keystone'
      })
     end
-    it { should contain_keystone_config('DEFAULT/log_file').with_value('keystone.log') }
-    it { should contain_keystone_config('DEFAULT/log_dir').with_value('/var/lib/keystone') }
+    it { is_expected.to contain_keystone_config('DEFAULT/log_file').with_value('keystone.log') }
+    it { is_expected.to contain_keystone_config('DEFAULT/log_dir').with_value('/var/lib/keystone') }
   end
 
     describe 'with log_file and log_dir disabled' do
@@ -532,8 +532,8 @@ describe 'keystone' do
         :log_dir    => false
      })
     end
-    it { should contain_keystone_config('DEFAULT/log_file').with_ensure('absent') }
-    it { should contain_keystone_config('DEFAULT/log_dir').with_ensure('absent') }
+    it { is_expected.to contain_keystone_config('DEFAULT/log_file').with_ensure('absent') }
+    it { is_expected.to contain_keystone_config('DEFAULT/log_dir').with_ensure('absent') }
   end
 
   describe 'when enabling SSL' do
@@ -545,14 +545,14 @@ describe 'keystone' do
         'admin_endpoint'   => 'https://localhost:35357/v2.0/',
       }
     end
-    it {should contain_keystone_config('ssl/enable').with_value(true)}
-    it {should contain_keystone_config('ssl/certfile').with_value('/etc/keystone/ssl/certs/keystone.pem')}
-    it {should contain_keystone_config('ssl/keyfile').with_value('/etc/keystone/ssl/private/keystonekey.pem')}
-    it {should contain_keystone_config('ssl/ca_certs').with_value('/etc/keystone/ssl/certs/ca.pem')}
-    it {should contain_keystone_config('ssl/ca_key').with_value('/etc/keystone/ssl/private/cakey.pem')}
-    it {should contain_keystone_config('ssl/cert_subject').with_value('/C=US/ST=Unset/L=Unset/O=Unset/CN=localhost')}
-    it {should contain_keystone_config('DEFAULT/public_endpoint').with_value('https://localhost:5000/v2.0/')}
-    it {should contain_keystone_config('DEFAULT/admin_endpoint').with_value('https://localhost:35357/v2.0/')}
+    it {is_expected.to contain_keystone_config('ssl/enable').with_value(true)}
+    it {is_expected.to contain_keystone_config('ssl/certfile').with_value('/etc/keystone/ssl/certs/keystone.pem')}
+    it {is_expected.to contain_keystone_config('ssl/keyfile').with_value('/etc/keystone/ssl/private/keystonekey.pem')}
+    it {is_expected.to contain_keystone_config('ssl/ca_certs').with_value('/etc/keystone/ssl/certs/ca.pem')}
+    it {is_expected.to contain_keystone_config('ssl/ca_key').with_value('/etc/keystone/ssl/private/cakey.pem')}
+    it {is_expected.to contain_keystone_config('ssl/cert_subject').with_value('/C=US/ST=Unset/L=Unset/O=Unset/CN=localhost')}
+    it {is_expected.to contain_keystone_config('DEFAULT/public_endpoint').with_value('https://localhost:5000/v2.0/')}
+    it {is_expected.to contain_keystone_config('DEFAULT/admin_endpoint').with_value('https://localhost:35357/v2.0/')}
   end
   describe 'when disabling SSL' do
     let :params do
@@ -561,18 +561,18 @@ describe 'keystone' do
         'enable_ssl'  => false,
       }
     end
-    it {should contain_keystone_config('ssl/enable').with_value(false)}
-    it {should contain_keystone_config('DEFAULT/public_endpoint').with_ensure('absent')}
-    it {should contain_keystone_config('DEFAULT/admin_endpoint').with_ensure('absent')}
+    it {is_expected.to contain_keystone_config('ssl/enable').with_value(false)}
+    it {is_expected.to contain_keystone_config('DEFAULT/public_endpoint').with_ensure('absent')}
+    it {is_expected.to contain_keystone_config('DEFAULT/admin_endpoint').with_ensure('absent')}
   end
   describe 'not setting notification settings by default' do
     let :params do
       default_params
     end
 
-    it { should contain_keystone_config('DEFAULT/notification_driver').with_value(nil) }
-    it { should contain_keystone_config('DEFAULT/notification_topics').with_vaule(nil) }
-    it { should contain_keystone_config('DEFAULT/control_exchange').with_vaule(nil) }
+    it { is_expected.to contain_keystone_config('DEFAULT/notification_driver').with_value(nil) }
+    it { is_expected.to contain_keystone_config('DEFAULT/notification_topics').with_vaule(nil) }
+    it { is_expected.to contain_keystone_config('DEFAULT/control_exchange').with_vaule(nil) }
   end
 
   describe 'with RabbitMQ communication SSLed' do
@@ -587,11 +587,11 @@ describe 'keystone' do
     end
 
     it do
-      should contain_keystone_config('DEFAULT/rabbit_use_ssl').with_value('true')
-      should contain_keystone_config('DEFAULT/kombu_ssl_ca_certs').with_value('/path/to/ssl/ca/certs')
-      should contain_keystone_config('DEFAULT/kombu_ssl_certfile').with_value('/path/to/ssl/cert/file')
-      should contain_keystone_config('DEFAULT/kombu_ssl_keyfile').with_value('/path/to/ssl/keyfile')
-      should contain_keystone_config('DEFAULT/kombu_ssl_version').with_value('TLSv1')
+      is_expected.to contain_keystone_config('DEFAULT/rabbit_use_ssl').with_value('true')
+      is_expected.to contain_keystone_config('DEFAULT/kombu_ssl_ca_certs').with_value('/path/to/ssl/ca/certs')
+      is_expected.to contain_keystone_config('DEFAULT/kombu_ssl_certfile').with_value('/path/to/ssl/cert/file')
+      is_expected.to contain_keystone_config('DEFAULT/kombu_ssl_keyfile').with_value('/path/to/ssl/keyfile')
+      is_expected.to contain_keystone_config('DEFAULT/kombu_ssl_version').with_value('TLSv1')
     end
   end
 
@@ -607,11 +607,11 @@ describe 'keystone' do
     end
 
     it do
-      should contain_keystone_config('DEFAULT/rabbit_use_ssl').with_value('false')
-      should contain_keystone_config('DEFAULT/kombu_ssl_ca_certs').with_ensure('absent')
-      should contain_keystone_config('DEFAULT/kombu_ssl_certfile').with_ensure('absent')
-      should contain_keystone_config('DEFAULT/kombu_ssl_keyfile').with_ensure('absent')
-      should contain_keystone_config('DEFAULT/kombu_ssl_version').with_ensure('absent')
+      is_expected.to contain_keystone_config('DEFAULT/rabbit_use_ssl').with_value('false')
+      is_expected.to contain_keystone_config('DEFAULT/kombu_ssl_ca_certs').with_ensure('absent')
+      is_expected.to contain_keystone_config('DEFAULT/kombu_ssl_certfile').with_ensure('absent')
+      is_expected.to contain_keystone_config('DEFAULT/kombu_ssl_keyfile').with_ensure('absent')
+      is_expected.to contain_keystone_config('DEFAULT/kombu_ssl_version').with_ensure('absent')
     end
   end
 
@@ -620,7 +620,7 @@ describe 'keystone' do
       default_params.merge({:max_token_size => '16384' })
     end
 
-    it { should contain_keystone_config('DEFAULT/max_token_size').with_value(params[:max_token_size]) }
+    it { is_expected.to contain_keystone_config('DEFAULT/max_token_size').with_value(params[:max_token_size]) }
   end
 
   describe 'setting notification settings' do
@@ -632,9 +632,9 @@ describe 'keystone' do
       })
     end
 
-    it { should contain_keystone_config('DEFAULT/notification_driver').with_value('keystone.openstack.common.notifier.rpc_notifier') }
-    it { should contain_keystone_config('DEFAULT/notification_topics').with_value('notifications') }
-    it { should contain_keystone_config('DEFAULT/control_exchange').with_value('keystone') }
+    it { is_expected.to contain_keystone_config('DEFAULT/notification_driver').with_value('keystone.openstack.common.notifier.rpc_notifier') }
+    it { is_expected.to contain_keystone_config('DEFAULT/notification_topics').with_value('notifications') }
+    it { is_expected.to contain_keystone_config('DEFAULT/control_exchange').with_value('keystone') }
   end
 
   describe 'setting sql (default) catalog' do
@@ -642,7 +642,7 @@ describe 'keystone' do
       default_params
     end
 
-    it { should contain_keystone_config('catalog/driver').with_value('keystone.catalog.backends.sql.Catalog') }
+    it { is_expected.to contain_keystone_config('catalog/driver').with_value('keystone.catalog.backends.sql.Catalog') }
   end
 
   describe 'setting default template catalog' do
@@ -653,8 +653,8 @@ describe 'keystone' do
       }
     end
 
-    it { should contain_keystone_config('catalog/driver').with_value('keystone.catalog.backends.templated.Catalog') }
-    it { should contain_keystone_config('catalog/template_file').with_value('/etc/keystone/default_catalog.templates') }
+    it { is_expected.to contain_keystone_config('catalog/driver').with_value('keystone.catalog.backends.templated.Catalog') }
+    it { is_expected.to contain_keystone_config('catalog/template_file').with_value('/etc/keystone/default_catalog.templates') }
   end
 
   describe 'with overridden validation_auth_url' do
@@ -667,8 +667,8 @@ describe 'keystone' do
       }
     end
 
-    it { should contain_keystone_config('DEFAULT/admin_endpoint').with_value('http://some.host:35357') }
-    it { should contain_class('keystone::service').with(
+    it { is_expected.to contain_keystone_config('DEFAULT/admin_endpoint').with_value('http://some.host:35357') }
+    it { is_expected.to contain_class('keystone::service').with(
       'validate'       => true,
       'admin_endpoint' => 'http://some.host:35357/v2.0'
     )}
@@ -683,7 +683,7 @@ describe 'keystone' do
       }
     end
 
-    it { should contain_class('keystone::service').with(
+    it { is_expected.to contain_class('keystone::service').with(
       'validate'       => true,
       'admin_endpoint' => 'http://some.host:35357'
     )}
@@ -698,8 +698,8 @@ describe 'keystone' do
       }
     end
 
-    it { should contain_keystone_config('catalog/driver').with_value('keystone.catalog.backends.templated.Catalog') }
-    it { should contain_keystone_config('catalog/template_file').with_value('/some/template_file') }
+    it { is_expected.to contain_keystone_config('catalog/driver').with_value('keystone.catalog.backends.templated.Catalog') }
+    it { is_expected.to contain_keystone_config('catalog/template_file').with_value('/some/template_file') }
   end
 
   describe 'setting service_provider' do
@@ -715,7 +715,7 @@ describe 'keystone' do
         { 'admin_token'    => 'service_token' }
       end
 
-      it { should contain_service('keystone').with(
+      it { is_expected.to contain_service('keystone').with(
         :provider => nil
       )}
     end
@@ -728,7 +728,7 @@ describe 'keystone' do
         }
       end
 
-      it { should contain_service('keystone').with(
+      it { is_expected.to contain_service('keystone').with(
         :provider => 'pacemaker'
       )}
     end
@@ -740,7 +740,7 @@ describe 'keystone' do
         default_params
       end
 
-      it { should contain_keystone_config('paste_deploy/config_file').with_ensure('absent')}
+      it { is_expected.to contain_keystone_config('paste_deploy/config_file').with_ensure('absent')}
     end
 
     describe 'with default paste config on RedHat' do
@@ -754,7 +754,7 @@ describe 'keystone' do
         default_params
       end
 
-      it { should contain_keystone_config('paste_deploy/config_file').with_value(
+      it { is_expected.to contain_keystone_config('paste_deploy/config_file').with_value(
           '/usr/share/keystone/keystone-dist-paste.ini'
       )}
     end
@@ -766,7 +766,7 @@ describe 'keystone' do
         })
       end
 
-      it { should contain_keystone_config('paste_deploy/config_file').with_value(
+      it { is_expected.to contain_keystone_config('paste_deploy/config_file').with_value(
           '/usr/share/keystone/keystone-paste.ini'
       )}
     end
diff --git a/spec/classes/keystone_wsgi_apache_spec.rb b/spec/classes/keystone_wsgi_apache_spec.rb
index 295c2bc1f..7b8da08d6 100644
--- a/spec/classes/keystone_wsgi_apache_spec.rb
+++ b/spec/classes/keystone_wsgi_apache_spec.rb
@@ -17,22 +17,22 @@ describe 'keystone::wsgi::apache' do
   end
 
   shared_examples_for 'apache serving keystone with mod_wsgi' do
-    it { should contain_service('httpd').with_name(platform_parameters[:httpd_service_name]) }
-    it { should contain_class('keystone::params') }
-    it { should contain_class('apache') }
-    it { should contain_class('apache::mod::wsgi') }
-    it { should contain_class('keystone::db::sync') }
+    it { is_expected.to contain_service('httpd').with_name(platform_parameters[:httpd_service_name]) }
+    it { is_expected.to contain_class('keystone::params') }
+    it { is_expected.to contain_class('apache') }
+    it { is_expected.to contain_class('apache::mod::wsgi') }
+    it { is_expected.to contain_class('keystone::db::sync') }
 
     describe 'with default parameters' do
 
-      it { should contain_file("#{platform_parameters[:wsgi_script_path]}").with(
+      it { is_expected.to contain_file("#{platform_parameters[:wsgi_script_path]}").with(
         'ensure'  => 'directory',
         'owner'   => 'keystone',
         'group'   => 'keystone',
         'require' => 'Package[httpd]'
       )}
 
-      it { should contain_file('keystone_wsgi_admin').with(
+      it { is_expected.to contain_file('keystone_wsgi_admin').with(
         'ensure'  => 'file',
         'path'    => "#{platform_parameters[:wsgi_script_path]}/admin",
         'source'  => platform_parameters[:wsgi_script_source],
@@ -42,7 +42,7 @@ describe 'keystone::wsgi::apache' do
         'require' => ["File[#{platform_parameters[:wsgi_script_path]}]", "Package[keystone]"]
       )}
 
-      it { should contain_file('keystone_wsgi_main').with(
+      it { is_expected.to contain_file('keystone_wsgi_main').with(
         'ensure'  => 'file',
         'path'    => "#{platform_parameters[:wsgi_script_path]}/main",
         'source'  => platform_parameters[:wsgi_script_source],
@@ -52,7 +52,7 @@ describe 'keystone::wsgi::apache' do
         'require' => ["File[#{platform_parameters[:wsgi_script_path]}]", "Package[keystone]"]
       )}
 
-      it { should contain_apache__vhost('keystone_wsgi_admin').with(
+      it { is_expected.to contain_apache__vhost('keystone_wsgi_admin').with(
         'servername'                  => 'some.host.tld',
         'ip'                          => nil,
         'port'                        => '35357',
@@ -66,7 +66,7 @@ describe 'keystone::wsgi::apache' do
         'require'                     => 'File[keystone_wsgi_admin]'
       )}
 
-      it { should contain_apache__vhost('keystone_wsgi_main').with(
+      it { is_expected.to contain_apache__vhost('keystone_wsgi_main').with(
         'servername'                  => 'some.host.tld',
         'ip'                          => nil,
         'port'                        => '5000',
@@ -79,7 +79,7 @@ describe 'keystone::wsgi::apache' do
         'wsgi_script_aliases'         => { '/' => "#{platform_parameters[:wsgi_script_path]}/main" },
         'require'                     => 'File[keystone_wsgi_main]'
       )}
-      it { should contain_file("#{platform_parameters[:httpd_ports_file]}") }
+      it { is_expected.to contain_file("#{platform_parameters[:httpd_ports_file]}") }
     end
 
     describe 'when overriding parameters using different ports' do
@@ -94,7 +94,7 @@ describe 'keystone::wsgi::apache' do
         }
       end
 
-      it { should contain_apache__vhost('keystone_wsgi_admin').with(
+      it { is_expected.to contain_apache__vhost('keystone_wsgi_admin').with(
         'servername'                  => 'dummy.host',
         'ip'                          => '10.42.51.1',
         'port'                        => '4142',
@@ -108,7 +108,7 @@ describe 'keystone::wsgi::apache' do
         'require'                     => 'File[keystone_wsgi_admin]'
       )}
 
-      it { should contain_apache__vhost('keystone_wsgi_main').with(
+      it { is_expected.to contain_apache__vhost('keystone_wsgi_main').with(
         'servername'                  => 'dummy.host',
         'ip'                          => '10.42.51.1',
         'port'                        => '12345',
@@ -122,7 +122,7 @@ describe 'keystone::wsgi::apache' do
         'require'                     => 'File[keystone_wsgi_main]'
       )}
 
-      it { should contain_file("#{platform_parameters[:httpd_ports_file]}") }
+      it { is_expected.to contain_file("#{platform_parameters[:httpd_ports_file]}") }
     end
 
     describe 'when overriding parameters using same port' do
@@ -138,9 +138,9 @@ describe 'keystone::wsgi::apache' do
         }
       end
 
-      it { should_not contain_apache__vhost('keystone_wsgi_admin') }
+      it { is_expected.to_not contain_apache__vhost('keystone_wsgi_admin') }
 
-      it { should contain_apache__vhost('keystone_wsgi_main').with(
+      it { is_expected.to contain_apache__vhost('keystone_wsgi_main').with(
         'servername'                  => 'dummy.host',
         'ip'                          => nil,
         'port'                        => '4242',
diff --git a/spec/defines/keystone_resource_service_identity_spec.rb b/spec/defines/keystone_resource_service_identity_spec.rb
index d7d0a62c5..a906ddc90 100644
--- a/spec/defines/keystone_resource_service_identity_spec.rb
+++ b/spec/defines/keystone_resource_service_identity_spec.rb
@@ -36,25 +36,25 @@ describe 'keystone::resource::service_identity' do
         required_params
       end
 
-      it { should contain_keystone_user(title).with(
+      it { is_expected.to contain_keystone_user(title).with(
         :ensure   => 'present',
         :password => 'secrete',
         :email    => 'neutron@localhost',
         :tenant   => 'services',
       )}
 
-      it { should contain_keystone_user_role("#{title}@services").with(
+      it { is_expected.to contain_keystone_user_role("#{title}@services").with(
         :ensure => 'present',
         :roles  => 'admin',
       )}
 
-      it { should contain_keystone_service(title).with(
+      it { is_expected.to contain_keystone_service(title).with(
         :ensure      => 'present',
         :type        => 'network',
         :description => 'neutron service',
       )}
 
-      it { should contain_keystone_endpoint("RegionOne/#{title}").with(
+      it { is_expected.to contain_keystone_endpoint("RegionOne/#{title}").with(
         :ensure       => 'present',
         :public_url   => 'http://7.7.7.7:9696',
         :internal_url => 'http://10.0.0.1:9696',
@@ -66,7 +66,7 @@ describe 'keystone::resource::service_identity' do
       let :params do
         required_params.delete(:password)
       end
-      it { expect { should raise_error(Puppet::Error) } }
+      it { expect { is_expected.to raise_error(Puppet::Error) } }
     end
 
   end
diff --git a/spec/shared_examples.rb b/spec/shared_examples.rb
index d92156a36..fec0eacc9 100644
--- a/spec/shared_examples.rb
+++ b/spec/shared_examples.rb
@@ -1,5 +1,5 @@
 shared_examples_for "a Puppet::Error" do |description|
   it "with message matching #{description.inspect}" do
-    expect { should have_class_count(1) }.to raise_error(Puppet::Error, description)
+    expect { is_expected.to have_class_count(1) }.to raise_error(Puppet::Error, description)
   end
 end
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index a6c4788bd..78594f8ae 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -4,7 +4,6 @@ require 'puppetlabs_spec_helper/module_spec_helper'
 require 'shared_examples'
 
 RSpec.configure do |c|
-    c.alias_it_should_behave_like_to :it_configures, 'configures'
-      c.alias_it_should_behave_like_to :it_raises, 'raises'
+  c.alias_it_should_behave_like_to :it_configures, 'configures'
+  c.alias_it_should_behave_like_to :it_raises, 'raises'
 end
-