diff --git a/etc/schemas/compute/flavors/flavor_details.json b/etc/schemas/compute/flavors/flavor_details.json
index d1c1077..c16075c 100644
--- a/etc/schemas/compute/flavors/flavor_details.json
+++ b/etc/schemas/compute/flavors/flavor_details.json
@@ -2,5 +2,7 @@
     "name": "get-flavor-details",
     "http-method": "GET",
     "url": "flavors/%s",
-    "resources": ["flavor"]
+    "resources": [
+        {"name": "flavor", "expected_result": 404}
+    ]
 }
diff --git a/etc/schemas/compute/servers/get_console_output.json b/etc/schemas/compute/servers/get_console_output.json
index 7c3860f..8d974ba 100644
--- a/etc/schemas/compute/servers/get_console_output.json
+++ b/etc/schemas/compute/servers/get_console_output.json
@@ -2,7 +2,9 @@
     "name": "get-console-output",
     "http-method": "POST",
     "url": "servers/%s/action",
-    "resources": ["server"],
+    "resources": [
+        {"name":"server", "expected_result": 404}
+    ],
     "json-schema": {
         "type": "object",
         "properties": {
diff --git a/etc/tempest.conf.sample b/etc/tempest.conf.sample
index 48ca905..fe4959b 100644
--- a/etc/tempest.conf.sample
+++ b/etc/tempest.conf.sample
@@ -397,6 +397,10 @@
 # (string value)
 #uri_v3=<None>
 
+# Identity API version to be used for authentication for API
+# tests. (string value)
+#auth_version=v2
+
 # The identity region name to use. Also used as the other
 # services' region name unless they are set explicitly. If no
 # such region is found in the service catalog, the first found
@@ -748,6 +752,11 @@
 # value)
 #default_thread_number_per_action=4
 
+# Prevent the cleaning (tearDownClass()) between each stress
+# test run if an exception occurs during this run. (boolean
+# value)
+#leave_dirty_stack=false
+
 
 [telemetry]
 
diff --git a/tempest/api/compute/base.py b/tempest/api/compute/base.py
index f8b0051..fd069e7 100644
--- a/tempest/api/compute/base.py
+++ b/tempest/api/compute/base.py
@@ -161,6 +161,18 @@
                 return
             time.sleep(self.build_interval)
 
+    @staticmethod
+    def _delete_volume(volumes_client, volume_id):
+        """Deletes the given volume and waits for it to be gone."""
+        try:
+            resp, _ = volumes_client.delete_volume(volume_id)
+            # TODO(mriedem): We should move the wait_for_resource_deletion
+            # into the delete_volume method as a convenience to the caller.
+            volumes_client.wait_for_resource_deletion(volume_id)
+        except exceptions.NotFound:
+            LOG.warn("Unable to delete volume '%s' since it was not found. "
+                     "Maybe it was already deleted?" % volume_id)
+
 
 class BaseV2ComputeTest(BaseComputeTest):
 
@@ -188,7 +200,6 @@
         cls.instance_usages_audit_log_client = \
             cls.os.instance_usages_audit_log_client
         cls.hypervisor_client = cls.os.hypervisor_client
-        cls.servers_client_v3_auth = cls.os.servers_client_v3_auth
         cls.certificates_client = cls.os.certificates_client
 
     @classmethod
@@ -232,14 +243,7 @@
     @classmethod
     def delete_volume(cls, volume_id):
         """Deletes the given volume and waits for it to be gone."""
-        try:
-            resp, _ = cls.volumes_extensions_client.delete_volume(volume_id)
-            # TODO(mriedem): We should move the wait_for_resource_deletion
-            # into the delete_volume method as a convenience to the caller.
-            cls.volumes_extensions_client.wait_for_resource_deletion(volume_id)
-        except exceptions.NotFound:
-            LOG.warn("Unable to delete volume '%s' since it was not found. "
-                     "Maybe it was already deleted?" % volume_id)
+        cls._delete_volume(cls.volumes_extensions_client, volume_id)
 
 
 class BaseV2ComputeAdminTest(BaseV2ComputeTest):
@@ -337,6 +341,11 @@
         cls.password = server['admin_password']
         return server['id']
 
+    @classmethod
+    def delete_volume(cls, volume_id):
+        """Deletes the given volume and waits for it to be gone."""
+        cls._delete_volume(cls.volumes_client, volume_id)
+
 
 class BaseV3ComputeAdminTest(BaseV3ComputeTest):
     """Base test case class for all Compute Admin API V3 tests."""
diff --git a/tempest/api/compute/servers/test_server_rescue.py b/tempest/api/compute/servers/test_server_rescue.py
index 20c5d7f..0bf604c 100644
--- a/tempest/api/compute/servers/test_server_rescue.py
+++ b/tempest/api/compute/servers/test_server_rescue.py
@@ -24,6 +24,7 @@
 
     @classmethod
     def setUpClass(cls):
+        cls.set_network_resources(network=True, subnet=True, router=True)
         super(ServerRescueTestJSON, cls).setUpClass()
         cls.device = 'vdf'
 
@@ -41,20 +42,10 @@
         cls.sg_id = cls.sg['id']
 
         # Create a volume and wait for it to become ready for attach
-        resp, cls.volume_to_attach = \
-            cls.volumes_extensions_client.create_volume(1,
-                                                        display_name=
-                                                        'test_attach')
+        resp, cls.volume = cls.volumes_extensions_client.create_volume(
+            1, display_name=data_utils.rand_name(cls.__name__ + '_volume'))
         cls.volumes_extensions_client.wait_for_volume_status(
-            cls.volume_to_attach['id'], 'available')
-
-        # Create a volume and wait for it to become ready for attach
-        resp, cls.volume_to_detach = \
-            cls.volumes_extensions_client.create_volume(1,
-                                                        display_name=
-                                                        'test_detach')
-        cls.volumes_extensions_client.wait_for_volume_status(
-            cls.volume_to_detach['id'], 'available')
+            cls.volume['id'], 'available')
 
         # Server for positive tests
         resp, server = cls.create_test_server(wait_until='BUILD')
@@ -78,9 +69,7 @@
     def tearDownClass(cls):
         # Deleting the floating IP which is created in this method
         cls.floating_ips_client.delete_floating_ip(cls.floating_ip_id)
-        client = cls.volumes_extensions_client
-        client.delete_volume(str(cls.volume_to_attach['id']).strip())
-        client.delete_volume(str(cls.volume_to_detach['id']).strip())
+        cls.delete_volume(cls.volume['id'])
         resp, cls.sg = cls.security_groups_client.delete_security_group(
             cls.sg_id)
         super(ServerRescueTestJSON, cls).tearDownClass()
@@ -93,9 +82,6 @@
         self.volumes_extensions_client.wait_for_volume_status(volume_id,
                                                               'available')
 
-    def _delete(self, volume_id):
-        self.volumes_extensions_client.delete_volume(volume_id)
-
     def _unrescue(self, server_id):
         resp, body = self.servers_client.unrescue_server(server_id)
         self.assertEqual(202, resp.status)
@@ -159,32 +145,31 @@
         self.assertRaises(exceptions.Conflict,
                           self.servers_client.attach_volume,
                           self.server_id,
-                          self.volume_to_attach['id'],
+                          self.volume['id'],
                           device='/dev/%s' % self.device)
 
     @attr(type=['negative', 'gate'])
     def test_rescued_vm_detach_volume(self):
         # Attach the volume to the server
         self.servers_client.attach_volume(self.server_id,
-                                          self.volume_to_detach['id'],
+                                          self.volume['id'],
                                           device='/dev/%s' % self.device)
         self.volumes_extensions_client.wait_for_volume_status(
-            self.volume_to_detach['id'], 'in-use')
+            self.volume['id'], 'in-use')
 
         # Rescue the server
         self.servers_client.rescue_server(self.server_id,
                                           adminPass=self.password)
         self.servers_client.wait_for_server_status(self.server_id, 'RESCUE')
         # addCleanup is a LIFO queue
-        self.addCleanup(self._detach, self.server_id,
-                        self.volume_to_detach['id'])
+        self.addCleanup(self._detach, self.server_id, self.volume['id'])
         self.addCleanup(self._unrescue, self.server_id)
 
         # Detach the volume from the server expecting failure
         self.assertRaises(exceptions.Conflict,
                           self.servers_client.detach_volume,
                           self.server_id,
-                          self.volume_to_detach['id'])
+                          self.volume['id'])
 
     @attr(type='gate')
     def test_rescued_vm_associate_dissociate_floating_ip(self):
diff --git a/tempest/api/compute/test_authorization.py b/tempest/api/compute/test_authorization.py
index 4774fec..ed72061 100644
--- a/tempest/api/compute/test_authorization.py
+++ b/tempest/api/compute/test_authorization.py
@@ -57,7 +57,6 @@
         cls.alt_keypairs_client = cls.alt_manager.keypairs_client
         cls.alt_security_client = cls.alt_manager.security_groups_client
 
-        cls.alt_security_client._set_auth()
         resp, server = cls.create_test_server(wait_until='ACTIVE')
         resp, cls.server = cls.client.get_server(server['id'])
 
@@ -174,16 +173,14 @@
     def test_create_server_fails_when_tenant_incorrect(self):
         # A create server request should fail if the tenant id does not match
         # the current user
-        saved_base_url = self.alt_client.base_url
-        try:
-            # Change the base URL to impersonate another user
-            self.alt_client.base_url = self.client.base_url
-            self.assertRaises(exceptions.BadRequest,
-                              self.alt_client.create_server, 'test',
-                              self.image['id'], self.flavor_ref)
-        finally:
-            # Reset the base_url...
-            self.alt_client.base_url = saved_base_url
+        # Change the base URL to impersonate another user
+        self.alt_client.auth_provider.set_alt_auth_data(
+            request_part='url',
+            auth_data=self.client.auth_provider.auth_data
+        )
+        self.assertRaises(exceptions.BadRequest,
+                          self.alt_client.create_server, 'test',
+                          self.image['id'], self.flavor_ref)
 
     @attr(type='gate')
     def test_create_keypair_in_analt_user_tenant(self):
@@ -191,18 +188,18 @@
         # the current user
         # POST keypair with other user tenant
         k_name = data_utils.rand_name('keypair-')
-        self.alt_keypairs_client._set_auth()
-        self.saved_base_url = self.alt_keypairs_client.base_url
         try:
             # Change the base URL to impersonate another user
-            self.alt_keypairs_client.base_url = self.keypairs_client.base_url
+            self.alt_keypairs_client.auth_provider.set_alt_auth_data(
+                request_part='url',
+                auth_data=self.keypairs_client.auth_provider.auth_data
+            )
             resp = {}
             resp['status'] = None
             self.assertRaises(exceptions.BadRequest,
                               self.alt_keypairs_client.create_keypair, k_name)
         finally:
-            # Reset the base_url...
-            self.alt_keypairs_client.base_url = self.saved_base_url
+            # Next request the base_url is back to normal
             if (resp['status'] is not None):
                 resp, _ = self.alt_keypairs_client.delete_keypair(k_name)
                 LOG.error("Create keypair request should not happen "
@@ -242,18 +239,19 @@
         # POST security group with other user tenant
         s_name = data_utils.rand_name('security-')
         s_description = data_utils.rand_name('security')
-        self.saved_base_url = self.alt_security_client.base_url
         try:
             # Change the base URL to impersonate another user
-            self.alt_security_client.base_url = self.security_client.base_url
+            self.alt_security_client.auth_provider.set_alt_auth_data(
+                request_part='url',
+                auth_data=self.security_client.auth_provider.auth_data
+            )
             resp = {}
             resp['status'] = None
             self.assertRaises(exceptions.BadRequest,
                               self.alt_security_client.create_security_group,
                               s_name, s_description)
         finally:
-            # Reset the base_url...
-            self.alt_security_client.base_url = self.saved_base_url
+            # Next request the base_url is back to normal
             if resp['status'] is not None:
                 self.alt_security_client.delete_security_group(resp['id'])
                 LOG.error("Create Security Group request should not happen if"
@@ -282,10 +280,12 @@
         ip_protocol = 'icmp'
         from_port = -1
         to_port = -1
-        self.saved_base_url = self.alt_security_client.base_url
         try:
             # Change the base URL to impersonate another user
-            self.alt_security_client.base_url = self.security_client.base_url
+            self.alt_security_client.auth_provider.set_alt_auth_data(
+                request_part='url',
+                auth_data=self.security_client.auth_provider.auth_data
+            )
             resp = {}
             resp['status'] = None
             self.assertRaises(exceptions.BadRequest,
@@ -294,8 +294,7 @@
                               parent_group_id, ip_protocol, from_port,
                               to_port)
         finally:
-            # Reset the base_url...
-            self.alt_security_client.base_url = self.saved_base_url
+            # Next request the base_url is back to normal
             if resp['status'] is not None:
                 self.alt_security_client.delete_security_group_rule(resp['id'])
                 LOG.error("Create security group rule request should not "
diff --git a/tempest/api/compute/v3/servers/test_server_metadata_negative.py b/tempest/api/compute/v3/servers/test_server_metadata_negative.py
index 2c413db..ce6c340 100644
--- a/tempest/api/compute/v3/servers/test_server_metadata_negative.py
+++ b/tempest/api/compute/v3/servers/test_server_metadata_negative.py
@@ -34,6 +34,7 @@
 
         cls.server_id = server['id']
 
+    @test.skip_because(bug="1273948")
     @test.attr(type=['gate', 'negative'])
     def test_server_create_metadata_key_too_long(self):
         # Attempt to start a server with a meta-data key that is > 255
@@ -43,7 +44,7 @@
         for sz in [256, 257, 511, 1023]:
             key = "k" * sz
             meta = {key: 'data1'}
-            self.assertRaises(exceptions.OverLimit,
+            self.assertRaises(exceptions.BadRequest,
                               self.create_test_server,
                               meta=meta)
 
diff --git a/tempest/api/compute/v3/servers/test_server_rescue.py b/tempest/api/compute/v3/servers/test_server_rescue.py
index f8be1c1..fa7def0 100644
--- a/tempest/api/compute/v3/servers/test_server_rescue.py
+++ b/tempest/api/compute/v3/servers/test_server_rescue.py
@@ -14,6 +14,7 @@
 #    under the License.
 
 from tempest.api.compute import base
+from tempest.common.utils import data_utils
 from tempest import exceptions
 from tempest.test import attr
 
@@ -27,20 +28,10 @@
         cls.device = 'vdf'
 
         # Create a volume and wait for it to become ready for attach
-        resp, cls.volume_to_attach = \
-            cls.volumes_client.create_volume(1,
-                                             display_name=
-                                             'test_attach')
+        resp, cls.volume = cls.volumes_client.create_volume(
+            1, display_name=data_utils.rand_name(cls.__name__ + '_volume'))
         cls.volumes_client.wait_for_volume_status(
-            cls.volume_to_attach['id'], 'available')
-
-        # Create a volume and wait for it to become ready for attach
-        resp, cls.volume_to_detach = \
-            cls.volumes_client.create_volume(1,
-                                             display_name=
-                                             'test_detach')
-        cls.volumes_client.wait_for_volume_status(
-            cls.volume_to_detach['id'], 'available')
+            cls.volume['id'], 'available')
 
         # Server for positive tests
         resp, server = cls.create_test_server(wait_until='BUILD')
@@ -62,9 +53,7 @@
 
     @classmethod
     def tearDownClass(cls):
-        client = cls.volumes_client
-        client.delete_volume(str(cls.volume_to_attach['id']).strip())
-        client.delete_volume(str(cls.volume_to_detach['id']).strip())
+        cls.delete_volume(cls.volume['id'])
         super(ServerRescueV3Test, cls).tearDownClass()
 
     def tearDown(self):
@@ -75,9 +64,6 @@
         self.volumes_client.wait_for_volume_status(volume_id,
                                                    'available')
 
-    def _delete(self, volume_id):
-        self.volumes_client.delete_volume(volume_id)
-
     def _unrescue(self, server_id):
         resp, body = self.servers_client.unrescue_server(server_id)
         self.assertEqual(202, resp.status)
@@ -141,29 +127,27 @@
         self.assertRaises(exceptions.Conflict,
                           self.servers_client.attach_volume,
                           self.server_id,
-                          self.volume_to_attach['id'],
+                          self.volume['id'],
                           device='/dev/%s' % self.device)
 
     @attr(type=['negative', 'gate'])
     def test_rescued_vm_detach_volume(self):
         # Attach the volume to the server
         self.servers_client.attach_volume(self.server_id,
-                                          self.volume_to_detach['id'],
+                                          self.volume['id'],
                                           device='/dev/%s' % self.device)
-        self.volumes_client.wait_for_volume_status(
-            self.volume_to_detach['id'], 'in-use')
+        self.volumes_client.wait_for_volume_status(self.volume['id'], 'in-use')
 
         # Rescue the server
         self.servers_client.rescue_server(self.server_id,
                                           admin_password=self.password)
         self.servers_client.wait_for_server_status(self.server_id, 'RESCUE')
         # addCleanup is a LIFO queue
-        self.addCleanup(self._detach, self.server_id,
-                        self.volume_to_detach['id'])
+        self.addCleanup(self._detach, self.server_id, self.volume['id'])
         self.addCleanup(self._unrescue, self.server_id)
 
         # Detach the volume from the server expecting failure
         self.assertRaises(exceptions.Conflict,
                           self.servers_client.detach_volume,
                           self.server_id,
-                          self.volume_to_detach['id'])
+                          self.volume['id'])
diff --git a/tempest/api/compute/v3/servers/test_servers_negative.py b/tempest/api/compute/v3/servers/test_servers_negative.py
index c153699..12e0ad8 100644
--- a/tempest/api/compute/v3/servers/test_servers_negative.py
+++ b/tempest/api/compute/v3/servers/test_servers_negative.py
@@ -191,12 +191,13 @@
                           self.create_test_server,
                           key_name=key_name)
 
+    @test.skip_because(bug="1273948")
     @test.attr(type=['negative', 'gate'])
     def test_create_server_metadata_exceeds_length_limit(self):
         # Pass really long metadata while creating a server
 
         metadata = {'a': 'b' * 260}
-        self.assertRaises(exceptions.OverLimit,
+        self.assertRaises(exceptions.BadRequest,
                           self.create_test_server,
                           meta=metadata)
 
diff --git a/tempest/api/data_processing/base.py b/tempest/api/data_processing/base.py
index ab882cd..5b272ef 100644
--- a/tempest/api/data_processing/base.py
+++ b/tempest/api/data_processing/base.py
@@ -63,7 +63,7 @@
             except Exception:
                 # ignore errors while auto removing created resource
                 pass
-
+        cls.clear_isolated_creds()
         super(BaseDataProcessingTest, cls).tearDownClass()
 
     @classmethod
diff --git a/tempest/api/data_processing/test_plugins.py b/tempest/api/data_processing/test_plugins.py
new file mode 100644
index 0000000..3b941d8
--- /dev/null
+++ b/tempest/api/data_processing/test_plugins.py
@@ -0,0 +1,58 @@
+# Copyright (c) 2013 Mirantis Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from tempest.api.data_processing import base as dp_base
+from tempest.test import attr
+
+
+class PluginsTest(dp_base.BaseDataProcessingTest):
+    def _list_all_plugin_names(self):
+        """Returns all enabled plugin names.
+
+        It ensures response status and main plugins availability.
+        """
+        resp, plugins = self.client.list_plugins()
+
+        self.assertEqual(200, resp.status)
+
+        plugins_names = list([plugin['name'] for plugin in plugins])
+        self.assertIn('vanilla', plugins_names)
+        self.assertIn('hdp', plugins_names)
+
+        return plugins_names
+
+    @attr(type='smoke')
+    def test_plugin_list(self):
+        self._list_all_plugin_names()
+
+    @attr(type='smoke')
+    def test_plugin_get(self):
+        for plugin_name in self._list_all_plugin_names():
+            resp, plugin = self.client.get_plugin(plugin_name)
+
+            self.assertEqual(200, resp.status)
+            self.assertEqual(plugin_name, plugin['name'])
+
+            for plugin_version in plugin['versions']:
+                resp, detailed_plugin = self.client.get_plugin(plugin_name,
+                                                               plugin_version)
+
+                self.assertEqual(200, resp.status)
+                self.assertEqual(plugin_name, detailed_plugin['name'])
+
+                # check that required image tags contains name and version
+                image_tags = detailed_plugin['required_image_tags']
+                self.assertIn(plugin_name, image_tags)
+                self.assertIn(plugin_version, image_tags)
diff --git a/tempest/api/identity/admin/test_roles_negative.py b/tempest/api/identity/admin/test_roles_negative.py
index e316dc7..e5c04de 100644
--- a/tempest/api/identity/admin/test_roles_negative.py
+++ b/tempest/api/identity/admin/test_roles_negative.py
@@ -41,10 +41,10 @@
     @attr(type=['negative', 'gate'])
     def test_list_roles_request_without_token(self):
         # Request to list roles without a valid token should fail
-        token = self.client.get_auth()
+        token = self.client.auth_provider.get_token()
         self.client.delete_token(token)
         self.assertRaises(exceptions.Unauthorized, self.client.list_roles)
-        self.client.clear_auth()
+        self.client.auth_provider.clear_auth()
 
     @attr(type=['negative', 'gate'])
     def test_role_create_blank_name(self):
@@ -61,12 +61,12 @@
     @attr(type=['negative', 'gate'])
     def test_create_role_request_without_token(self):
         # Request to create role without a valid token should fail
-        token = self.client.get_auth()
+        token = self.client.auth_provider.get_token()
         self.client.delete_token(token)
         role_name = data_utils.rand_name(name='role-')
         self.assertRaises(exceptions.Unauthorized,
                           self.client.create_role, role_name)
-        self.client.clear_auth()
+        self.client.auth_provider.clear_auth()
 
     @attr(type=['negative', 'gate'])
     def test_role_create_duplicate(self):
@@ -99,12 +99,12 @@
         self.assertEqual(200, resp.status)
         self.data.roles.append(body)
         role_id = body.get('id')
-        token = self.client.get_auth()
+        token = self.client.auth_provider.get_token()
         self.client.delete_token(token)
         self.assertRaises(exceptions.Unauthorized,
                           self.client.delete_role,
                           role_id)
-        self.client.clear_auth()
+        self.client.auth_provider.clear_auth()
 
     @attr(type=['negative', 'gate'])
     def test_delete_role_non_existent(self):
@@ -126,12 +126,12 @@
     def test_assign_user_role_request_without_token(self):
         # Request to assign a role to a user without a valid token
         (user, tenant, role) = self._get_role_params()
-        token = self.client.get_auth()
+        token = self.client.auth_provider.get_token()
         self.client.delete_token(token)
         self.assertRaises(exceptions.Unauthorized,
                           self.client.assign_user_role, tenant['id'],
                           user['id'], role['id'])
-        self.client.clear_auth()
+        self.client.auth_provider.clear_auth()
 
     @attr(type=['negative', 'gate'])
     def test_assign_user_role_for_non_existent_role(self):
@@ -176,12 +176,12 @@
         resp, user_role = self.client.assign_user_role(tenant['id'],
                                                        user['id'],
                                                        role['id'])
-        token = self.client.get_auth()
+        token = self.client.auth_provider.get_token()
         self.client.delete_token(token)
         self.assertRaises(exceptions.Unauthorized,
                           self.client.remove_user_role, tenant['id'],
                           user['id'], role['id'])
-        self.client.clear_auth()
+        self.client.auth_provider.clear_auth()
 
     @attr(type=['negative', 'gate'])
     def test_remove_user_role_non_existent_role(self):
@@ -219,14 +219,14 @@
     def test_list_user_roles_request_without_token(self):
         # Request to list user's roles without a valid token should fail
         (user, tenant, role) = self._get_role_params()
-        token = self.client.get_auth()
+        token = self.client.auth_provider.get_token()
         self.client.delete_token(token)
         try:
             self.assertRaises(exceptions.Unauthorized,
                               self.client.list_user_roles, tenant['id'],
                               user['id'])
         finally:
-            self.client.clear_auth()
+            self.client.auth_provider.clear_auth()
 
 
 class RolesTestXML(RolesNegativeTestJSON):
diff --git a/tempest/api/identity/admin/test_tenant_negative.py b/tempest/api/identity/admin/test_tenant_negative.py
index a4d9d97..e9eddc8 100644
--- a/tempest/api/identity/admin/test_tenant_negative.py
+++ b/tempest/api/identity/admin/test_tenant_negative.py
@@ -33,10 +33,10 @@
     @attr(type=['negative', 'gate'])
     def test_list_tenant_request_without_token(self):
         # Request to list tenants without a valid token should fail
-        token = self.client.get_auth()
+        token = self.client.auth_provider.get_token()
         self.client.delete_token(token)
         self.assertRaises(exceptions.Unauthorized, self.client.list_tenants)
-        self.client.clear_auth()
+        self.client.auth_provider.clear_auth()
 
     @attr(type=['negative', 'gate'])
     def test_tenant_delete_by_unauthorized_user(self):
@@ -55,11 +55,11 @@
         resp, tenant = self.client.create_tenant(tenant_name)
         self.assertEqual(200, resp.status)
         self.data.tenants.append(tenant)
-        token = self.client.get_auth()
+        token = self.client.auth_provider.get_token()
         self.client.delete_token(token)
         self.assertRaises(exceptions.Unauthorized, self.client.delete_tenant,
                           tenant['id'])
-        self.client.clear_auth()
+        self.client.auth_provider.clear_auth()
 
     @attr(type=['negative', 'gate'])
     def test_delete_non_existent_tenant(self):
@@ -93,11 +93,11 @@
     def test_create_tenant_request_without_token(self):
         # Create tenant request without a token should not be authorized
         tenant_name = data_utils.rand_name(name='tenant-')
-        token = self.client.get_auth()
+        token = self.client.auth_provider.get_token()
         self.client.delete_token(token)
         self.assertRaises(exceptions.Unauthorized, self.client.create_tenant,
                           tenant_name)
-        self.client.clear_auth()
+        self.client.auth_provider.clear_auth()
 
     @attr(type=['negative', 'gate'])
     def test_create_tenant_with_empty_name(self):
@@ -135,11 +135,11 @@
         resp, tenant = self.client.create_tenant(tenant_name)
         self.assertEqual(200, resp.status)
         self.data.tenants.append(tenant)
-        token = self.client.get_auth()
+        token = self.client.auth_provider.get_token()
         self.client.delete_token(token)
         self.assertRaises(exceptions.Unauthorized, self.client.update_tenant,
                           tenant['id'])
-        self.client.clear_auth()
+        self.client.auth_provider.clear_auth()
 
 
 class TenantsNegativeTestXML(TenantsNegativeTestJSON):
diff --git a/tempest/api/identity/admin/test_tokens.py b/tempest/api/identity/admin/test_tokens.py
index cfe17fb..620e293 100644
--- a/tempest/api/identity/admin/test_tokens.py
+++ b/tempest/api/identity/admin/test_tokens.py
@@ -13,8 +13,6 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import json
-
 from tempest.api.identity import base
 from tempest.common.utils import data_utils
 from tempest.test import attr
@@ -42,12 +40,11 @@
         rsp, body = self.token_client.auth(user_name,
                                            user_password,
                                            tenant['name'])
-        access_data = json.loads(body)['access']
         self.assertEqual(rsp['status'], '200')
-        self.assertEqual(access_data['token']['tenant']['name'],
+        self.assertEqual(body['token']['tenant']['name'],
                          tenant['name'])
         # then delete the token
-        token_id = access_data['token']['id']
+        token_id = body['token']['id']
         resp, body = self.client.delete_token(token_id)
         self.assertEqual(resp['status'], '204')
 
diff --git a/tempest/api/identity/admin/test_users.py b/tempest/api/identity/admin/test_users.py
index 14222fb..39ef947 100644
--- a/tempest/api/identity/admin/test_users.py
+++ b/tempest/api/identity/admin/test_users.py
@@ -115,7 +115,7 @@
         self.token_client.auth(self.data.test_user, self.data.test_password,
                                self.data.test_tenant)
         # Get the token of the current client
-        token = self.client.get_auth()
+        token = self.client.auth_provider.get_token()
         # Delete the token from database
         self.client.delete_token(token)
         # Re-auth
@@ -123,7 +123,7 @@
                                             self.data.test_password,
                                             self.data.test_tenant)
         self.assertEqual('200', resp['status'])
-        self.client.clear_auth()
+        self.client.auth_provider.clear_auth()
 
     @attr(type='smoke')
     def test_get_users(self):
diff --git a/tempest/api/identity/admin/test_users_negative.py b/tempest/api/identity/admin/test_users_negative.py
index ba7af09..060f24a 100644
--- a/tempest/api/identity/admin/test_users_negative.py
+++ b/tempest/api/identity/admin/test_users_negative.py
@@ -75,7 +75,7 @@
         # Request to create a user without a valid token should fail
         self.data.setup_test_tenant()
         # Get the token of the current client
-        token = self.client.get_auth()
+        token = self.client.auth_provider.get_token()
         # Delete the token from database
         self.client.delete_token(token)
         self.assertRaises(exceptions.Unauthorized, self.client.create_user,
@@ -83,7 +83,7 @@
                           self.data.tenant['id'], self.alt_email)
 
         # Unset the token to allow further tests to generate a new token
-        self.client.clear_auth()
+        self.client.auth_provider.clear_auth()
 
     @attr(type=['negative', 'gate'])
     def test_create_user_with_enabled_non_bool(self):
@@ -108,14 +108,14 @@
         # Request to update a user without a valid token should fail
 
         # Get the token of the current client
-        token = self.client.get_auth()
+        token = self.client.auth_provider.get_token()
         # Delete the token from database
         self.client.delete_token(token)
         self.assertRaises(exceptions.Unauthorized, self.client.update_user,
                           self.alt_user)
 
         # Unset the token to allow further tests to generate a new token
-        self.client.clear_auth()
+        self.client.auth_provider.clear_auth()
 
     @attr(type=['negative', 'gate'])
     def test_update_user_by_unauthorized_user(self):
@@ -143,14 +143,14 @@
         # Request to delete a user without a valid token should fail
 
         # Get the token of the current client
-        token = self.client.get_auth()
+        token = self.client.auth_provider.get_token()
         # Delete the token from database
         self.client.delete_token(token)
         self.assertRaises(exceptions.Unauthorized, self.client.delete_user,
                           self.alt_user)
 
         # Unset the token to allow further tests to generate a new token
-        self.client.clear_auth()
+        self.client.auth_provider.clear_auth()
 
     @attr(type=['negative', 'gate'])
     def test_authentication_for_disabled_user(self):
@@ -207,10 +207,10 @@
     @attr(type=['negative', 'gate'])
     def test_get_users_request_without_token(self):
         # Request to get list of users without a valid token should fail
-        token = self.client.get_auth()
+        token = self.client.auth_provider.get_token()
         self.client.delete_token(token)
         self.assertRaises(exceptions.Unauthorized, self.client.get_users)
-        self.client.clear_auth()
+        self.client.auth_provider.clear_auth()
 
     @attr(type=['negative', 'gate'])
     def test_list_users_with_invalid_tenant(self):
diff --git a/tempest/api/image/base.py b/tempest/api/image/base.py
index 37b848c..e439238 100644
--- a/tempest/api/image/base.py
+++ b/tempest/api/image/base.py
@@ -106,7 +106,7 @@
             cls.os_alt = clients.AltManager()
             identity_client = cls._get_identity_admin_client()
             cls.alt_tenant_id = identity_client.get_tenant_by_name(
-                cls.os_alt.tenant_name)['id']
+                cls.os_alt.credentials['tenant_name'])['id']
 
         cls.alt_img_cli = cls.os_alt.image_client
 
@@ -147,7 +147,7 @@
             cls.alt_tenant_id = cls.isolated_creds.get_alt_tenant()['id']
         else:
             cls.os_alt = clients.AltManager()
-            alt_tenant_name = cls.os_alt.tenant_name
+            alt_tenant_name = cls.os_alt.credentials['tenant_name']
             identity_client = cls._get_identity_admin_client()
             cls.alt_tenant_id = identity_client.get_tenant_by_name(
                 alt_tenant_name)['id']
diff --git a/tempest/api/image/v1/test_images.py b/tempest/api/image/v1/test_images.py
index 8c62c05..d8b79ca 100644
--- a/tempest/api/image/v1/test_images.py
+++ b/tempest/api/image/v1/test_images.py
@@ -71,7 +71,7 @@
         resp, body = self.create_image(name='New Http Image',
                                        container_format='bare',
                                        disk_format='raw', is_public=True,
-                                       copy_from=CONF.images.http_image)
+                                       copy_from=CONF.image.http_image)
         self.assertIn('id', body)
         image_id = body.get('id')
         self.assertEqual('New Http Image', body.get('name'))
diff --git a/tempest/api/network/admin/test_l3_agent_scheduler.py b/tempest/api/network/admin/test_l3_agent_scheduler.py
index bfb7b48..7c02787 100644
--- a/tempest/api/network/admin/test_l3_agent_scheduler.py
+++ b/tempest/api/network/admin/test_l3_agent_scheduler.py
@@ -17,7 +17,7 @@
 from tempest import test
 
 
-class L3AgentSchedulerJSON(base.BaseAdminNetworkTest):
+class L3AgentSchedulerTestJSON(base.BaseAdminNetworkTest):
     _interface = 'json'
 
     """
@@ -33,7 +33,7 @@
 
     @classmethod
     def setUpClass(cls):
-        super(L3AgentSchedulerJSON, cls).setUpClass()
+        super(L3AgentSchedulerTestJSON, cls).setUpClass()
         if not test.is_extension_enabled('l3_agent_scheduler', 'network'):
             msg = "L3 Agent Scheduler Extension not enabled."
             raise cls.skipException(msg)
@@ -61,5 +61,5 @@
         self.assertEqual(204, resp.status)
 
 
-class L3AgentSchedulerXML(L3AgentSchedulerJSON):
+class L3AgentSchedulerTestXML(L3AgentSchedulerTestJSON):
     _interface = 'xml'
diff --git a/tempest/api/network/base.py b/tempest/api/network/base.py
index 1c2c4b0..b129786 100644
--- a/tempest/api/network/base.py
+++ b/tempest/api/network/base.py
@@ -49,6 +49,8 @@
         neutron as True
     """
 
+    force_tenant_isolation = False
+
     @classmethod
     def setUpClass(cls):
         # Create no network resources for these test.
@@ -57,6 +59,10 @@
         os = clients.Manager(interface=cls._interface)
         if not CONF.service_available.neutron:
             raise cls.skipException("Neutron support is required")
+
+        os = cls.get_client_manager()
+
+        cls.network_cfg = CONF.network
         cls.client = os.network_client
         cls.networks = []
         cls.subnets = []
@@ -110,6 +116,7 @@
         # Clean up networks
         for network in cls.networks:
             cls.client.delete_network(network['id'])
+        cls.clear_isolated_creds()
         super(BaseNetworkTest, cls).tearDownClass()
 
     @classmethod
@@ -269,5 +276,14 @@
             msg = ("Missing Administrative Network API credentials "
                    "in configuration.")
             raise cls.skipException(msg)
-        cls.admin_manager = clients.AdminManager(interface=cls._interface)
-        cls.admin_client = cls.admin_manager.network_client
+        if (CONF.compute.allow_tenant_isolation or
+            cls.force_tenant_isolation is True):
+            creds = cls.isolated_creds.get_admin_creds()
+            admin_username, admin_tenant_name, admin_password = creds
+            cls.os_adm = clients.Manager(username=admin_username,
+                                         password=admin_password,
+                                         tenant_name=admin_tenant_name,
+                                         interface=cls._interface)
+        else:
+            cls.os_adm = clients.ComputeAdminManager(interface=cls._interface)
+        cls.admin_client = cls.os_adm.network_client
diff --git a/tempest/api/network/common.py b/tempest/api/network/common.py
index 0ce1769..d68ff1a 100644
--- a/tempest/api/network/common.py
+++ b/tempest/api/network/common.py
@@ -126,3 +126,21 @@
 
     def delete(self):
         self.client.delete_security_group_rule(self.id)
+
+
+class DeletablePool(DeletableResource):
+
+    def delete(self):
+        self.client.delete_pool(self.id)
+
+
+class DeletableMember(DeletableResource):
+
+    def delete(self):
+        self.client.delete_member(self.id)
+
+
+class DeletableVip(DeletableResource):
+
+    def delete(self):
+        self.client.delete_vip(self.id)
diff --git a/tempest/api/network/test_load_balancer.py b/tempest/api/network/test_load_balancer.py
index 65eebf2..d5f2b5b 100644
--- a/tempest/api/network/test_load_balancer.py
+++ b/tempest/api/network/test_load_balancer.py
@@ -18,7 +18,7 @@
 from tempest import test
 
 
-class LoadBalancerJSON(base.BaseNetworkTest):
+class LoadBalancerTestJSON(base.BaseNetworkTest):
     _interface = 'json'
 
     """
@@ -39,7 +39,7 @@
 
     @classmethod
     def setUpClass(cls):
-        super(LoadBalancerJSON, cls).setUpClass()
+        super(LoadBalancerTestJSON, cls).setUpClass()
         if not test.is_extension_enabled('lbaas', 'network'):
             msg = "lbaas extension not enabled."
             raise cls.skipException(msg)
@@ -210,5 +210,5 @@
         self.assertEqual('204', resp['status'])
 
 
-class LoadBalancerXML(LoadBalancerJSON):
+class LoadBalancerTestXML(LoadBalancerTestJSON):
     _interface = 'xml'
diff --git a/tempest/api/network/test_networks.py b/tempest/api/network/test_networks.py
index 3aa765c..aee2a44 100644
--- a/tempest/api/network/test_networks.py
+++ b/tempest/api/network/test_networks.py
@@ -239,7 +239,7 @@
     _interface = 'xml'
 
 
-class BulkNetworkOpsJSON(base.BaseNetworkTest):
+class BulkNetworkOpsTestJSON(base.BaseNetworkTest):
     _interface = 'json'
 
     """
@@ -263,7 +263,7 @@
 
     @classmethod
     def setUpClass(cls):
-        super(BulkNetworkOpsJSON, cls).setUpClass()
+        super(BulkNetworkOpsTestJSON, cls).setUpClass()
         cls.network1 = cls.create_network()
         cls.network2 = cls.create_network()
 
@@ -390,5 +390,5 @@
             self.assertIn(n['id'], ports_list)
 
 
-class BulkNetworkOpsXML(BulkNetworkOpsJSON):
+class BulkNetworkOpsTestXML(BulkNetworkOpsTestJSON):
     _interface = 'xml'
diff --git a/tempest/api/network/test_vpnaas_extensions.py b/tempest/api/network/test_vpnaas_extensions.py
index 64b8a41..78bc80a 100644
--- a/tempest/api/network/test_vpnaas_extensions.py
+++ b/tempest/api/network/test_vpnaas_extensions.py
@@ -38,10 +38,10 @@
 
     @classmethod
     def setUpClass(cls):
-        super(VPNaaSJSON, cls).setUpClass()
         if not test.is_extension_enabled('vpnaas', 'network'):
             msg = "vpnaas extension not enabled."
             raise cls.skipException(msg)
+        super(VPNaaSJSON, cls).setUpClass()
         cls.network = cls.create_network()
         cls.subnet = cls.create_subnet(cls.network)
         cls.router = cls.create_router(
diff --git a/tempest/api/object_storage/base.py b/tempest/api/object_storage/base.py
index 0eedea1..ef36c3d 100644
--- a/tempest/api/object_storage/base.py
+++ b/tempest/api/object_storage/base.py
@@ -74,6 +74,15 @@
         cls.container_client_alt = cls.os_alt.container_client
         cls.identity_client_alt = cls.os_alt.identity_client
 
+        # Make sure we get fresh auth data after assigning swift role
+        cls.object_client.auth_provider.clear_auth()
+        cls.container_client.auth_provider.clear_auth()
+        cls.account_client.auth_provider.clear_auth()
+        cls.custom_object_client.auth_provider.clear_auth()
+        cls.custom_account_client.auth_provider.clear_auth()
+        cls.object_client_alt.auth_provider.clear_auth()
+        cls.container_client_alt.auth_provider.clear_auth()
+
         cls.data = DataGenerator(cls.identity_admin_client)
 
     @classmethod
diff --git a/tempest/api/object_storage/test_account_quotas.py b/tempest/api/object_storage/test_account_quotas.py
index cacc66e..788292d 100644
--- a/tempest/api/object_storage/test_account_quotas.py
+++ b/tempest/api/object_storage/test_account_quotas.py
@@ -62,26 +62,34 @@
             reseller_user_id,
             reseller_role_id)
 
-        # Retrieve a ResellerAdmin auth token and use it to set a quota
+        # Retrieve a ResellerAdmin auth data and use it to set a quota
         # on the client's account
-        cls.reselleradmin_token = cls.token_client.get_token(
-            cls.data.test_user,
-            cls.data.test_password,
-            cls.data.test_tenant)
+        cls.reselleradmin_auth_data = \
+            cls.os_reselleradmin.get_auth_provider().auth_data
 
     def setUp(self):
         super(AccountQuotasTest, self).setUp()
 
+        # Set the reselleradmin auth in headers for next custom_account_client
+        # request
+        self.custom_account_client.auth_provider.set_alt_auth_data(
+            request_part='headers',
+            auth_data=self.reselleradmin_auth_data
+        )
         # Set a quota of 20 bytes on the user's account before each test
-        headers = {"X-Auth-Token": self.reselleradmin_token,
-                   "X-Account-Meta-Quota-Bytes": "20"}
+        headers = {"X-Account-Meta-Quota-Bytes": "20"}
 
         self.os.custom_account_client.request("POST", "", headers, "")
 
     def tearDown(self):
+        # Set the reselleradmin auth in headers for next custom_account_client
+        # request
+        self.custom_account_client.auth_provider.set_alt_auth_data(
+            request_part='headers',
+            auth_data=self.reselleradmin_auth_data
+        )
         # remove the quota from the container
-        headers = {"X-Auth-Token": self.reselleradmin_token,
-                   "X-Remove-Account-Meta-Quota-Bytes": "x"}
+        headers = {"X-Remove-Account-Meta-Quota-Bytes": "x"}
 
         self.os.custom_account_client.request("POST", "", headers, "")
         super(AccountQuotasTest, self).tearDown()
@@ -118,8 +126,11 @@
         """
         for quota in ("25", "", "20"):
 
-            headers = {"X-Auth-Token": self.reselleradmin_token,
-                       "X-Account-Meta-Quota-Bytes": quota}
+            self.custom_account_client.auth_provider.set_alt_auth_data(
+                request_part='headers',
+                auth_data=self.reselleradmin_auth_data
+            )
+            headers = {"X-Account-Meta-Quota-Bytes": quota}
 
             resp, _ = self.os.custom_account_client.request("POST", "",
                                                             headers, "")
diff --git a/tempest/api/object_storage/test_account_quotas_negative.py b/tempest/api/object_storage/test_account_quotas_negative.py
index e35cd17..cab307d 100644
--- a/tempest/api/object_storage/test_account_quotas_negative.py
+++ b/tempest/api/object_storage/test_account_quotas_negative.py
@@ -62,26 +62,33 @@
             reseller_user_id,
             reseller_role_id)
 
-        # Retrieve a ResellerAdmin auth token and use it to set a quota
+        # Retrieve a ResellerAdmin auth data and use it to set a quota
         # on the client's account
-        cls.reselleradmin_token = cls.token_client.get_token(
-            cls.data.test_user,
-            cls.data.test_password,
-            cls.data.test_tenant)
+        cls.reselleradmin_auth_data = \
+            cls.os_reselleradmin.get_auth_provider().auth_data
 
     def setUp(self):
         super(AccountQuotasNegativeTest, self).setUp()
-
+        # Set the reselleradmin auth in headers for next custom_account_client
+        # request
+        self.custom_account_client.auth_provider.set_alt_auth_data(
+            request_part='headers',
+            auth_data=self.reselleradmin_auth_data
+        )
         # Set a quota of 20 bytes on the user's account before each test
-        headers = {"X-Auth-Token": self.reselleradmin_token,
-                   "X-Account-Meta-Quota-Bytes": "20"}
+        headers = {"X-Account-Meta-Quota-Bytes": "20"}
 
         self.os.custom_account_client.request("POST", "", headers, "")
 
     def tearDown(self):
+        # Set the reselleradmin auth in headers for next custom_account_client
+        # request
+        self.custom_account_client.auth_provider.set_alt_auth_data(
+            request_part='headers',
+            auth_data=self.reselleradmin_auth_data
+        )
         # remove the quota from the container
-        headers = {"X-Auth-Token": self.reselleradmin_token,
-                   "X-Remove-Account-Meta-Quota-Bytes": "x"}
+        headers = {"X-Remove-Account-Meta-Quota-Bytes": "x"}
 
         self.os.custom_account_client.request("POST", "", headers, "")
         super(AccountQuotasNegativeTest, self).tearDown()
diff --git a/tempest/api/object_storage/test_account_services_negative.py b/tempest/api/object_storage/test_account_services_negative.py
index c8f8096..ea93aa3 100644
--- a/tempest/api/object_storage/test_account_services_negative.py
+++ b/tempest/api/object_storage/test_account_services_negative.py
@@ -15,6 +15,7 @@
 #    under the License.
 
 from tempest.api.object_storage import base
+from tempest import clients
 from tempest import exceptions
 from tempest.test import attr
 
@@ -27,18 +28,26 @@
 
         # create user
         self.data.setup_test_user()
-        self.token_client.auth(self.data.test_user,
-                               self.data.test_password,
-                               self.data.test_tenant)
-        new_token = \
-            self.token_client.get_token(self.data.test_user,
-                                        self.data.test_password,
-                                        self.data.test_tenant)
-        custom_headers = {'X-Auth-Token': new_token}
+        test_os = clients.Manager(self.data.test_user,
+                                  self.data.test_password,
+                                  self.data.test_tenant)
+        test_auth_provider = test_os.get_auth_provider()
+        # Get auth for the test user
+        test_auth_provider.auth_data
+
+        # Get fresh auth for test user and set it to next auth request for
+        # custom_account_client
+        delattr(test_auth_provider, 'auth_data')
+        test_auth_new_data = test_auth_provider.auth_data
+        self.custom_account_client.auth_provider.set_alt_auth_data(
+            request_part='headers',
+            auth_data=test_auth_new_data
+        )
+
         params = {'format': 'json'}
         # list containers with non-authorized user token
         self.assertRaises(exceptions.Unauthorized,
                           self.custom_account_client.list_account_containers,
-                          params=params, metadata=custom_headers)
+                          params=params)
         # delete the user which was created
         self.data.teardown_all()
diff --git a/tempest/api/object_storage/test_container_acl.py b/tempest/api/object_storage/test_container_acl.py
index 0733524..aae6b4d 100644
--- a/tempest/api/object_storage/test_container_acl.py
+++ b/tempest/api/object_storage/test_container_acl.py
@@ -14,6 +14,7 @@
 #    under the License.
 
 from tempest.api.object_storage import base
+from tempest import clients
 from tempest.common.utils import data_utils
 from tempest.test import attr
 from tempest.test import HTTP_SUCCESS
@@ -24,10 +25,10 @@
     def setUpClass(cls):
         super(ObjectTestACLs, cls).setUpClass()
         cls.data.setup_test_user()
-        cls.new_token = cls.token_client.get_token(cls.data.test_user,
-                                                   cls.data.test_password,
-                                                   cls.data.test_tenant)
-        cls.custom_headers = {'X-Auth-Token': cls.new_token}
+        test_os = clients.Manager(cls.data.test_user,
+                                  cls.data.test_password,
+                                  cls.data.test_tenant)
+        cls.test_auth_data = test_os.get_auth_provider().auth_data
 
     @classmethod
     def tearDownClass(cls):
@@ -61,9 +62,12 @@
         self.assertEqual(resp['status'], '201')
         self.assertHeaders(resp, 'Object', 'PUT')
         # Trying to read the object with rights
+        self.custom_object_client.auth_provider.set_alt_auth_data(
+            request_part='headers',
+            auth_data=self.test_auth_data
+        )
         resp, _ = self.custom_object_client.get_object(
-            self.container_name, object_name,
-            metadata=self.custom_headers)
+            self.container_name, object_name)
         self.assertIn(int(resp['status']), HTTP_SUCCESS)
         self.assertHeaders(resp, 'Object', 'GET')
 
@@ -79,10 +83,13 @@
         self.assertIn(int(resp_meta['status']), HTTP_SUCCESS)
         self.assertHeaders(resp_meta, 'Container', 'POST')
         # Trying to write the object with rights
+        self.custom_object_client.auth_provider.set_alt_auth_data(
+            request_part='headers',
+            auth_data=self.test_auth_data
+        )
         object_name = data_utils.rand_name(name='Object')
         resp, _ = self.custom_object_client.create_object(
             self.container_name,
-            object_name, 'data',
-            metadata=self.custom_headers)
+            object_name, 'data')
         self.assertIn(int(resp['status']), HTTP_SUCCESS)
         self.assertHeaders(resp, 'Object', 'PUT')
diff --git a/tempest/api/object_storage/test_container_acl_negative.py b/tempest/api/object_storage/test_container_acl_negative.py
index f8f29de..1dc9bb5 100644
--- a/tempest/api/object_storage/test_container_acl_negative.py
+++ b/tempest/api/object_storage/test_container_acl_negative.py
@@ -15,6 +15,7 @@
 #    under the License.
 
 from tempest.api.object_storage import base
+from tempest import clients
 from tempest.common.utils import data_utils
 from tempest import exceptions
 from tempest.test import attr
@@ -26,10 +27,10 @@
     def setUpClass(cls):
         super(ObjectACLsNegativeTest, cls).setUpClass()
         cls.data.setup_test_user()
-        cls.new_token = cls.token_client.get_token(cls.data.test_user,
-                                                   cls.data.test_password,
-                                                   cls.data.test_tenant)
-        cls.custom_headers = {'X-Auth-Token': cls.new_token}
+        test_os = clients.Manager(cls.data.test_user,
+                                  cls.data.test_password,
+                                  cls.data.test_tenant)
+        cls.test_auth_data = test_os.get_auth_provider().auth_data
 
     @classmethod
     def tearDownClass(cls):
@@ -50,6 +51,10 @@
         # trying to create object with empty headers
         # X-Auth-Token is not provided
         object_name = data_utils.rand_name(name='Object')
+        self.custom_object_client.auth_provider.set_alt_auth_data(
+            request_part='headers',
+            auth_data=None
+        )
         self.assertRaises(exceptions.Unauthorized,
                           self.custom_object_client.create_object,
                           self.container_name, object_name, 'data')
@@ -62,6 +67,10 @@
                                                    object_name, 'data')
         # trying to delete object with empty headers
         # X-Auth-Token is not provided
+        self.custom_object_client.auth_provider.set_alt_auth_data(
+            request_part='headers',
+            auth_data=None
+        )
         self.assertRaises(exceptions.Unauthorized,
                           self.custom_object_client.delete_object,
                           self.container_name, object_name)
@@ -72,10 +81,13 @@
         # User provided token is forbidden. ACL are not set
         object_name = data_utils.rand_name(name='Object')
         # trying to create object with non-authorized user
+        self.custom_object_client.auth_provider.set_alt_auth_data(
+            request_part='headers',
+            auth_data=self.test_auth_data
+        )
         self.assertRaises(exceptions.Unauthorized,
                           self.custom_object_client.create_object,
-                          self.container_name, object_name, 'data',
-                          metadata=self.custom_headers)
+                          self.container_name, object_name, 'data')
 
     @attr(type=['negative', 'gate'])
     def test_read_object_with_non_authorized_user(self):
@@ -87,10 +99,13 @@
         self.assertEqual(resp['status'], '201')
         self.assertHeaders(resp, 'Object', 'PUT')
         # trying to get object with non authorized user token
+        self.custom_object_client.auth_provider.set_alt_auth_data(
+            request_part='headers',
+            auth_data=self.test_auth_data
+        )
         self.assertRaises(exceptions.Unauthorized,
                           self.custom_object_client.get_object,
-                          self.container_name, object_name,
-                          metadata=self.custom_headers)
+                          self.container_name, object_name)
 
     @attr(type=['negative', 'gate'])
     def test_delete_object_with_non_authorized_user(self):
@@ -102,10 +117,13 @@
         self.assertEqual(resp['status'], '201')
         self.assertHeaders(resp, 'Object', 'PUT')
         # trying to delete object with non-authorized user token
+        self.custom_object_client.auth_provider.set_alt_auth_data(
+            request_part='headers',
+            auth_data=self.test_auth_data
+        )
         self.assertRaises(exceptions.Unauthorized,
                           self.custom_object_client.delete_object,
-                          self.container_name, object_name,
-                          metadata=self.custom_headers)
+                          self.container_name, object_name)
 
     @attr(type=['negative', 'smoke'])
     def test_read_object_without_rights(self):
@@ -124,10 +142,13 @@
         self.assertEqual(resp['status'], '201')
         self.assertHeaders(resp, 'Object', 'PUT')
         # Trying to read the object without rights
+        self.custom_object_client.auth_provider.set_alt_auth_data(
+            request_part='headers',
+            auth_data=self.test_auth_data
+        )
         self.assertRaises(exceptions.Unauthorized,
                           self.custom_object_client.get_object,
-                          self.container_name, object_name,
-                          metadata=self.custom_headers)
+                          self.container_name, object_name)
 
     @attr(type=['negative', 'smoke'])
     def test_write_object_without_rights(self):
@@ -140,12 +161,15 @@
         self.assertIn(int(resp_meta['status']), HTTP_SUCCESS)
         self.assertHeaders(resp_meta, 'Container', 'POST')
         # Trying to write the object without rights
+        self.custom_object_client.auth_provider.set_alt_auth_data(
+            request_part='headers',
+            auth_data=self.test_auth_data
+        )
         object_name = data_utils.rand_name(name='Object')
         self.assertRaises(exceptions.Unauthorized,
                           self.custom_object_client.create_object,
                           self.container_name,
-                          object_name, 'data',
-                          metadata=self.custom_headers)
+                          object_name, 'data')
 
     @attr(type=['negative', 'smoke'])
     def test_write_object_without_write_rights(self):
@@ -160,12 +184,15 @@
         self.assertIn(int(resp_meta['status']), HTTP_SUCCESS)
         self.assertHeaders(resp_meta, 'Container', 'POST')
         # Trying to write the object without write rights
+        self.custom_object_client.auth_provider.set_alt_auth_data(
+            request_part='headers',
+            auth_data=self.test_auth_data
+        )
         object_name = data_utils.rand_name(name='Object')
         self.assertRaises(exceptions.Unauthorized,
                           self.custom_object_client.create_object,
                           self.container_name,
-                          object_name, 'data',
-                          metadata=self.custom_headers)
+                          object_name, 'data')
 
     @attr(type=['negative', 'smoke'])
     def test_delete_object_without_write_rights(self):
@@ -186,8 +213,11 @@
         self.assertEqual(resp['status'], '201')
         self.assertHeaders(resp, 'Object', 'PUT')
         # Trying to delete the object without write rights
+        self.custom_object_client.auth_provider.set_alt_auth_data(
+            request_part='headers',
+            auth_data=self.test_auth_data
+        )
         self.assertRaises(exceptions.Unauthorized,
                           self.custom_object_client.delete_object,
                           self.container_name,
-                          object_name,
-                          metadata=self.custom_headers)
+                          object_name)
diff --git a/tempest/api/object_storage/test_container_staticweb.py b/tempest/api/object_storage/test_container_staticweb.py
index 9f9abd8..197e7fa 100644
--- a/tempest/api/object_storage/test_container_staticweb.py
+++ b/tempest/api/object_storage/test_container_staticweb.py
@@ -56,6 +56,12 @@
         self.container_client.update_container_metadata(
             self.container_name, metadata=headers)
 
+        # Maintain original headers, no auth added
+        self.custom_account_client.auth_provider.set_alt_auth_data(
+            request_part='headers',
+            auth_data=None
+        )
+
         # test GET on http://account_url/container_name
         # we should retrieve the self.object_name file
         resp, body = self.custom_account_client.request("GET",
@@ -112,6 +118,12 @@
         self.container_client.update_container_metadata(
             self.container_name, metadata=headers)
 
+        # Maintain original headers, no auth added
+        self.custom_account_client.auth_provider.set_alt_auth_data(
+            request_part='headers',
+            auth_data=None
+        )
+
         # test GET on http://account_url/container_name
         # we should retrieve a listing of objects
         resp, body = self.custom_account_client.request("GET",
@@ -136,6 +148,12 @@
                                          object_name_404,
                                          object_data_404)
 
+        # Do not set auth in HTTP headers for next request
+        self.custom_object_client.auth_provider.set_alt_auth_data(
+            request_part='headers',
+            auth_data=None
+        )
+
         # Request non-existing object
         resp, body = self.custom_object_client.get_object(self.container_name,
                                                           "notexisting")
diff --git a/tempest/api/object_storage/test_crossdomain.py b/tempest/api/object_storage/test_crossdomain.py
index 71e123c..4f399b4 100644
--- a/tempest/api/object_storage/test_crossdomain.py
+++ b/tempest/api/object_storage/test_crossdomain.py
@@ -50,13 +50,12 @@
         super(CrossdomainTest, self).setUp()
 
         client = self.os_test_user.account_client
-        client._set_auth()
         # Turning http://.../v1/foobar into http://.../
-        client.base_url = "/".join(client.base_url.split("/")[:-2])
+        client.skip_path()
 
     def tearDown(self):
         # clear the base_url for subsequent requests
-        self.os_test_user.account_client.base_url = None
+        self.os_test_user.account_client.reset_path()
 
         super(CrossdomainTest, self).tearDown()
 
diff --git a/tempest/api/object_storage/test_healthcheck.py b/tempest/api/object_storage/test_healthcheck.py
index 78bff03..35aee2a 100644
--- a/tempest/api/object_storage/test_healthcheck.py
+++ b/tempest/api/object_storage/test_healthcheck.py
@@ -29,10 +29,8 @@
 
     def setUp(self):
         super(HealthcheckTest, self).setUp()
-        self.account_client._set_auth()
         # Turning http://.../v1/foobar into http://.../
-        self.account_client.base_url = "/".join(
-            self.account_client.base_url.split("/")[:-2])
+        self.account_client.skip_path()
 
     @attr('gate')
     def test_get_healthcheck(self):
diff --git a/tempest/api/object_storage/test_object_services.py b/tempest/api/object_storage/test_object_services.py
index bca9b93..6f349b6 100644
--- a/tempest/api/object_storage/test_object_services.py
+++ b/tempest/api/object_storage/test_object_services.py
@@ -357,8 +357,12 @@
         self.assertEqual(resp_meta['x-container-read'], '.r:*,.rlistings')
 
         # trying to get object with empty headers as it is public readable
+        self.custom_object_client.auth_provider.set_alt_auth_data(
+            request_part='headers',
+            auth_data=None
+        )
         resp, body = self.custom_object_client.get_object(
-            self.container_name, object_name, metadata={})
+            self.container_name, object_name)
         self.assertHeaders(resp, 'Object', 'GET')
 
         self.assertEqual(body, data)
@@ -393,12 +397,14 @@
         self.assertEqual(resp['x-container-read'], '.r:*,.rlistings')
 
         # get auth token of alternative user
-        token = self.identity_client_alt.get_auth()
-        headers = {'X-Auth-Token': token}
+        alt_auth_data = self.identity_client_alt.auth_provider.auth_data
+        self.custom_object_client.auth_provider.set_alt_auth_data(
+            request_part='headers',
+            auth_data=alt_auth_data
+        )
         # access object using alternate user creds
         resp, body = self.custom_object_client.get_object(
-            self.container_name, object_name,
-            metadata=headers)
+            self.container_name, object_name)
         self.assertHeaders(resp, 'Object', 'GET')
 
         self.assertEqual(body, data)
diff --git a/tempest/api/volume/admin/test_multi_backend.py b/tempest/api/volume/admin/test_multi_backend.py
index cb1a6cb..b0c878b 100644
--- a/tempest/api/volume/admin/test_multi_backend.py
+++ b/tempest/api/volume/admin/test_multi_backend.py
@@ -14,8 +14,6 @@
 from tempest.common.utils import data_utils
 from tempest import config
 from tempest.openstack.common import log as logging
-from tempest.services.volume.json.admin import volume_types_client
-from tempest.services.volume.json import volumes_client
 from tempest.test import attr
 
 CONF = config.CONF
@@ -36,20 +34,7 @@
         cls.backend1_name = CONF.volume.backend1_name
         cls.backend2_name = CONF.volume.backend2_name
 
-        adm_user = CONF.identity.admin_username
-        adm_pass = CONF.identity.admin_password
-        adm_tenant = CONF.identity.admin_tenant_name
-        auth_url = CONF.identity.uri
-
-        cls.volume_client = volumes_client.VolumesClientJSON(adm_user,
-                                                             adm_pass,
-                                                             auth_url,
-                                                             adm_tenant)
-        cls.type_client = volume_types_client.VolumeTypesClientJSON(adm_user,
-                                                                    adm_pass,
-                                                                    auth_url,
-                                                                    adm_tenant)
-
+        cls.volume_client = cls.os_adm.volumes_client
         cls.volume_type_id_list = []
         cls.volume_id_list = []
         try:
@@ -57,7 +42,7 @@
             type1_name = data_utils.rand_name('Type-')
             vol1_name = data_utils.rand_name('Volume-')
             extra_specs1 = {"volume_backend_name": cls.backend1_name}
-            resp, cls.type1 = cls.type_client.create_volume_type(
+            resp, cls.type1 = cls.client.create_volume_type(
                 type1_name, extra_specs=extra_specs1)
             cls.volume_type_id_list.append(cls.type1['id'])
 
@@ -72,7 +57,7 @@
                 type2_name = data_utils.rand_name('Type-')
                 vol2_name = data_utils.rand_name('Volume-')
                 extra_specs2 = {"volume_backend_name": cls.backend2_name}
-                resp, cls.type2 = cls.type_client.create_volume_type(
+                resp, cls.type2 = cls.client.create_volume_type(
                     type2_name, extra_specs=extra_specs2)
                 cls.volume_type_id_list.append(cls.type2['id'])
 
@@ -97,7 +82,7 @@
         # volume types deletion
         volume_type_id_list = getattr(cls, 'volume_type_id_list', [])
         for volume_type_id in volume_type_id_list:
-            cls.type_client.delete_volume_type(volume_type_id)
+            cls.client.delete_volume_type(volume_type_id)
 
         super(VolumeMultiBackendTest, cls).tearDownClass()
 
diff --git a/tempest/api/volume/test_volume_transfers.py b/tempest/api/volume/test_volume_transfers.py
index fc4f07d..cf4e052 100644
--- a/tempest/api/volume/test_volume_transfers.py
+++ b/tempest/api/volume/test_volume_transfers.py
@@ -13,6 +13,8 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+from testtools import matchers
+
 from tempest.api.volume import base
 from tempest import clients
 from tempest import config
@@ -87,7 +89,7 @@
         # or equal to 1
         resp, body = self.client.list_volume_transfers()
         self.assertEqual(200, resp.status)
-        self.assertGreaterEqual(len(body), 1)
+        self.assertThat(len(body), matchers.GreaterThan(0))
 
         # Accept a volume transfer by alt_tenant
         resp, body = self.alt_client.accept_volume_transfer(transfer_id,
@@ -107,10 +109,14 @@
         self.client.wait_for_volume_status(volume['id'],
                                            'awaiting-transfer')
 
-        # List all volume transfers, there's only one in this test
+        # List all volume transfers (looking for the one we created)
         resp, body = self.client.list_volume_transfers()
         self.assertEqual(200, resp.status)
-        self.assertEqual(volume['id'], body[0]['volume_id'])
+        for transfer in body:
+            if volume['id'] == transfer['volume_id']:
+                break
+        else:
+            self.fail('Transfer not found for volume %s' % volume['id'])
 
         # Delete a volume transfer
         resp, body = self.client.delete_volume_transfer(transfer_id)
diff --git a/tempest/api/volume/v2/__init__.py b/tempest/api/volume/v2/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tempest/api/volume/v2/__init__.py
diff --git a/tempest/api/volume/v2/test_volumes_list.py b/tempest/api/volume/v2/test_volumes_list.py
new file mode 100644
index 0000000..049544d
--- /dev/null
+++ b/tempest/api/volume/v2/test_volumes_list.py
@@ -0,0 +1,228 @@
+# Copyright 2012 OpenStack Foundation
+# Copyright 2013 IBM Corp.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+import operator
+
+from tempest.api.volume import base
+from tempest.common.utils import data_utils
+from tempest.openstack.common import log as logging
+from tempest.test import attr
+from testtools.matchers import ContainsAll
+
+LOG = logging.getLogger(__name__)
+
+VOLUME_FIELDS = ('id', 'display_name')
+
+
+class VolumesListTest(base.BaseVolumeV1Test):
+
+    """
+    This test creates a number of 1G volumes. To run successfully,
+    ensure that the backing file for the volume group that Nova uses
+    has space for at least 3 1G volumes!
+    If you are running a Devstack environment, ensure that the
+    VOLUME_BACKING_FILE_SIZE is at least 4G in your localrc
+    """
+
+    _interface = 'json'
+
+    def assertVolumesIn(self, fetched_list, expected_list, fields=None):
+        if fields:
+            expected_list = map(operator.itemgetter(*fields), expected_list)
+            fetched_list = map(operator.itemgetter(*fields), fetched_list)
+
+        missing_vols = [v for v in expected_list if v not in fetched_list]
+        if len(missing_vols) == 0:
+            return
+
+        def str_vol(vol):
+            return "%s:%s" % (vol['id'], vol['display_name'])
+
+        raw_msg = "Could not find volumes %s in expected list %s; fetched %s"
+        self.fail(raw_msg % ([str_vol(v) for v in missing_vols],
+                             [str_vol(v) for v in expected_list],
+                             [str_vol(v) for v in fetched_list]))
+
+    @classmethod
+    def setUpClass(cls):
+        super(VolumesListTest, cls).setUpClass()
+        cls.client = cls.volumes_client
+
+        # Create 3 test volumes
+        cls.volume_list = []
+        cls.volume_id_list = []
+        cls.metadata = {'Type': 'work'}
+        for i in range(3):
+            try:
+                volume = cls.create_volume(metadata=cls.metadata)
+
+                resp, volume = cls.client.get_volume(volume['id'])
+                cls.volume_list.append(volume)
+                cls.volume_id_list.append(volume['id'])
+            except Exception:
+                LOG.exception('Failed to create volume. %d volumes were '
+                              'created' % len(cls.volume_id_list))
+                if cls.volume_list:
+                    # We could not create all the volumes, though we were able
+                    # to create *some* of the volumes. This is typically
+                    # because the backing file size of the volume group is
+                    # too small.
+                    for volid in cls.volume_id_list:
+                        cls.client.delete_volume(volid)
+                        cls.client.wait_for_resource_deletion(volid)
+                raise
+
+    @classmethod
+    def tearDownClass(cls):
+        # Delete the created volumes
+        for volid in cls.volume_id_list:
+            resp, _ = cls.client.delete_volume(volid)
+            cls.client.wait_for_resource_deletion(volid)
+        super(VolumesListTest, cls).tearDownClass()
+
+    def _list_by_param_value_and_assert(self, params, with_detail=False):
+        """
+        Perform list or list_details action with given params
+        and validates result.
+        """
+        if with_detail:
+            resp, fetched_vol_list = \
+                self.client.list_volumes_with_detail(params=params)
+        else:
+            resp, fetched_vol_list = self.client.list_volumes(params=params)
+
+        self.assertEqual(200, resp.status)
+        # Validating params of fetched volumes
+        for volume in fetched_vol_list:
+            for key in params:
+                msg = "Failed to list volumes %s by %s" % \
+                      ('details' if with_detail else '', key)
+                if key == 'metadata':
+                    self.assertThat(volume[key].items(),
+                                    ContainsAll(params[key].items()),
+                                    msg)
+                else:
+                    self.assertEqual(params[key], volume[key], msg)
+
+    @attr(type='smoke')
+    def test_volume_list(self):
+        # Get a list of Volumes
+        # Fetch all volumes
+        resp, fetched_list = self.client.list_volumes()
+        self.assertEqual(200, resp.status)
+        self.assertVolumesIn(fetched_list, self.volume_list,
+                             fields=VOLUME_FIELDS)
+
+    @attr(type='gate')
+    def test_volume_list_with_details(self):
+        # Get a list of Volumes with details
+        # Fetch all Volumes
+        resp, fetched_list = self.client.list_volumes_with_detail()
+        self.assertEqual(200, resp.status)
+        self.assertVolumesIn(fetched_list, self.volume_list)
+
+    @attr(type='gate')
+    def test_volume_list_by_name(self):
+        volume = self.volume_list[data_utils.rand_int_id(0, 2)]
+        params = {'display_name': volume['display_name']}
+        resp, fetched_vol = self.client.list_volumes(params)
+        self.assertEqual(200, resp.status)
+        self.assertEqual(1, len(fetched_vol), str(fetched_vol))
+        self.assertEqual(fetched_vol[0]['display_name'],
+                         volume['display_name'])
+
+    @attr(type='gate')
+    def test_volume_list_details_by_name(self):
+        volume = self.volume_list[data_utils.rand_int_id(0, 2)]
+        params = {'display_name': volume['display_name']}
+        resp, fetched_vol = self.client.list_volumes_with_detail(params)
+        self.assertEqual(200, resp.status)
+        self.assertEqual(1, len(fetched_vol), str(fetched_vol))
+        self.assertEqual(fetched_vol[0]['display_name'],
+                         volume['display_name'])
+
+    @attr(type='gate')
+    def test_volumes_list_by_status(self):
+        params = {'status': 'available'}
+        resp, fetched_list = self.client.list_volumes(params)
+        self.assertEqual(200, resp.status)
+        for volume in fetched_list:
+            self.assertEqual('available', volume['status'])
+        self.assertVolumesIn(fetched_list, self.volume_list,
+                             fields=VOLUME_FIELDS)
+
+    @attr(type='gate')
+    def test_volumes_list_details_by_status(self):
+        params = {'status': 'available'}
+        resp, fetched_list = self.client.list_volumes_with_detail(params)
+        self.assertEqual(200, resp.status)
+        for volume in fetched_list:
+            self.assertEqual('available', volume['status'])
+        self.assertVolumesIn(fetched_list, self.volume_list)
+
+    @attr(type='gate')
+    def test_volumes_list_by_availability_zone(self):
+        volume = self.volume_list[data_utils.rand_int_id(0, 2)]
+        zone = volume['availability_zone']
+        params = {'availability_zone': zone}
+        resp, fetched_list = self.client.list_volumes(params)
+        self.assertEqual(200, resp.status)
+        for volume in fetched_list:
+            self.assertEqual(zone, volume['availability_zone'])
+        self.assertVolumesIn(fetched_list, self.volume_list,
+                             fields=VOLUME_FIELDS)
+
+    @attr(type='gate')
+    def test_volumes_list_details_by_availability_zone(self):
+        volume = self.volume_list[data_utils.rand_int_id(0, 2)]
+        zone = volume['availability_zone']
+        params = {'availability_zone': zone}
+        resp, fetched_list = self.client.list_volumes_with_detail(params)
+        self.assertEqual(200, resp.status)
+        for volume in fetched_list:
+            self.assertEqual(zone, volume['availability_zone'])
+        self.assertVolumesIn(fetched_list, self.volume_list)
+
+    @attr(type='gate')
+    def test_volume_list_with_param_metadata(self):
+        # Test to list volumes when metadata param is given
+        params = {'metadata': self.metadata}
+        self._list_by_param_value_and_assert(params)
+
+    @attr(type='gate')
+    def test_volume_list_with_detail_param_metadata(self):
+        # Test to list volumes details when metadata param is given
+        params = {'metadata': self.metadata}
+        self._list_by_param_value_and_assert(params, with_detail=True)
+
+    @attr(type='gate')
+    def test_volume_list_param_display_name_and_status(self):
+        # Test to list volume when display name and status param is given
+        volume = self.volume_list[data_utils.rand_int_id(0, 2)]
+        params = {'display_name': volume['display_name'],
+                  'status': 'available'}
+        self._list_by_param_value_and_assert(params)
+
+    @attr(type='gate')
+    def test_volume_list_with_detail_param_display_name_and_status(self):
+        # Test to list volume when name and status param is given
+        volume = self.volume_list[data_utils.rand_int_id(0, 2)]
+        params = {'display_name': volume['display_name'],
+                  'status': 'available'}
+        self._list_by_param_value_and_assert(params, with_detail=True)
+
+
+class VolumeListTestXML(VolumesListTest):
+    _interface = 'xml'
diff --git a/tempest/auth.py b/tempest/auth.py
new file mode 100644
index 0000000..582cfdd
--- /dev/null
+++ b/tempest/auth.py
@@ -0,0 +1,396 @@
+# Copyright 2014 Hewlett-Packard Development Company, L.P.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import copy
+import exceptions
+import re
+import urlparse
+
+from datetime import datetime
+from tempest import config
+from tempest.services.identity.json import identity_client as json_id
+from tempest.services.identity.v3.json import identity_client as json_v3id
+from tempest.services.identity.v3.xml import identity_client as xml_v3id
+from tempest.services.identity.xml import identity_client as xml_id
+
+from tempest.openstack.common import log as logging
+
+CONF = config.CONF
+LOG = logging.getLogger(__name__)
+
+
+class AuthProvider(object):
+    """
+    Provide authentication
+    """
+
+    def __init__(self, credentials, client_type='tempest',
+                 interface=None):
+        """
+        :param credentials: credentials for authentication
+        :param client_type: 'tempest' or 'official'
+        :param interface: 'json' or 'xml'. Applicable for tempest client only
+        """
+        if self.check_credentials(credentials):
+            self.credentials = credentials
+        else:
+            raise TypeError("Invalid credentials")
+        self.credentials = credentials
+        self.client_type = client_type
+        self.interface = interface
+        if self.client_type == 'tempest' and self.interface is None:
+            self.interface = 'json'
+        self.cache = None
+        self.alt_auth_data = None
+        self.alt_part = None
+
+    def __str__(self):
+        return "Creds :{creds}, client type: {client_type}, interface: " \
+               "{interface}, cached auth data: {cache}".format(
+                   creds=self.credentials, client_type=self.client_type,
+                   interface=self.interface, cache=self.cache
+               )
+
+    def _decorate_request(self, filters, method, url, headers=None, body=None,
+                          auth_data=None):
+        """
+        Decorate request with authentication data
+        """
+        raise NotImplementedError
+
+    def _get_auth(self):
+        raise NotImplementedError
+
+    @classmethod
+    def check_credentials(cls, credentials):
+        """
+        Verify credentials are valid. Subclasses can do a better check.
+        """
+        return isinstance(credentials, dict)
+
+    @property
+    def auth_data(self):
+        if self.cache is None or self.is_expired(self.cache):
+            self.cache = self._get_auth()
+        return self.cache
+
+    @auth_data.deleter
+    def auth_data(self):
+        self.clear_auth()
+
+    def clear_auth(self):
+        """
+        Can be called to clear the access cache so that next request
+        will fetch a new token and base_url.
+        """
+        self.cache = None
+
+    def is_expired(self, auth_data):
+        raise NotImplementedError
+
+    def auth_request(self, method, url, headers=None, body=None, filters=None):
+        """
+        Obtains auth data and decorates a request with that.
+        :param method: HTTP method of the request
+        :param url: relative URL of the request (path)
+        :param headers: HTTP headers of the request
+        :param body: HTTP body in case of POST / PUT
+        :param filters: select a base URL out of the catalog
+        :returns a Tuple (url, headers, body)
+        """
+        orig_req = dict(url=url, headers=headers, body=body)
+
+        auth_url, auth_headers, auth_body = self._decorate_request(
+            filters, method, url, headers, body)
+        auth_req = dict(url=auth_url, headers=auth_headers, body=auth_body)
+
+        # Overwrite part if the request if it has been requested
+        if self.alt_part is not None:
+            if self.alt_auth_data is not None:
+                alt_url, alt_headers, alt_body = self._decorate_request(
+                    filters, method, url, headers, body,
+                    auth_data=self.alt_auth_data)
+                alt_auth_req = dict(url=alt_url, headers=alt_headers,
+                                    body=alt_body)
+                auth_req[self.alt_part] = alt_auth_req[self.alt_part]
+
+            else:
+                # If alt auth data is None, skip auth in the requested part
+                auth_req[self.alt_part] = orig_req[self.alt_part]
+
+            # Next auth request will be normal, unless otherwise requested
+            self.reset_alt_auth_data()
+
+        return auth_req['url'], auth_req['headers'], auth_req['body']
+
+    def reset_alt_auth_data(self):
+        """
+        Configure auth provider to provide valid authentication data
+        """
+        self.alt_part = None
+        self.alt_auth_data = None
+
+    def set_alt_auth_data(self, request_part, auth_data):
+        """
+        Configure auth provider to provide alt authentication data
+        on a part of the *next* auth_request. If credentials are None,
+        set invalid data.
+        :param request_part: request part to contain invalid auth: url,
+                             headers, body
+        :param auth_data: alternative auth_data from which to get the
+                          invalid data to be injected
+        """
+        self.alt_part = request_part
+        self.alt_auth_data = auth_data
+
+    def base_url(self, filters, auth_data=None):
+        """
+        Extracts the base_url based on provided filters
+        """
+        raise NotImplementedError
+
+
+class KeystoneAuthProvider(AuthProvider):
+
+    def __init__(self, credentials, client_type='tempest', interface=None):
+        super(KeystoneAuthProvider, self).__init__(credentials, client_type,
+                                                   interface)
+        self.auth_client = self._auth_client()
+
+    def _decorate_request(self, filters, method, url, headers=None, body=None,
+                          auth_data=None):
+        if auth_data is None:
+            auth_data = self.auth_data
+        token, _ = auth_data
+        base_url = self.base_url(filters=filters, auth_data=auth_data)
+        # build authenticated request
+        # returns new request, it does not touch the original values
+        _headers = copy.deepcopy(headers)
+        _headers['X-Auth-Token'] = token
+        if url is None or url == "":
+            _url = base_url
+        else:
+            # Join base URL and url, and remove multiple contiguous slashes
+            _url = "/".join([base_url, url])
+            parts = [x for x in urlparse.urlparse(_url)]
+            parts[2] = re.sub("/{2,}", "/", parts[2])
+            _url = urlparse.urlunparse(parts)
+        # no change to method or body
+        return _url, _headers, body
+
+    def _auth_client(self):
+        raise NotImplementedError
+
+    def _auth_params(self):
+        raise NotImplementedError
+
+    def _get_auth(self):
+        # Bypasses the cache
+        if self.client_type == 'tempest':
+            auth_func = getattr(self.auth_client, 'get_token')
+            auth_params = self._auth_params()
+
+            # returns token, auth_data
+            token, auth_data = auth_func(**auth_params)
+            return token, auth_data
+        else:
+            raise NotImplementedError
+
+    def get_token(self):
+        return self.auth_data[0]
+
+
+class KeystoneV2AuthProvider(KeystoneAuthProvider):
+
+    EXPIRY_DATE_FORMAT = '%Y-%m-%dT%H:%M:%SZ'
+
+    @classmethod
+    def check_credentials(cls, credentials, scoped=True):
+        # tenant_name is optional if not scoped
+        valid = super(KeystoneV2AuthProvider, cls).check_credentials(
+            credentials) and 'username' in credentials and \
+            'password' in credentials
+        if scoped:
+            valid = valid and 'tenant_name' in credentials
+        return valid
+
+    def _auth_client(self):
+        if self.client_type == 'tempest':
+            if self.interface == 'json':
+                return json_id.TokenClientJSON()
+            else:
+                return xml_id.TokenClientXML()
+        else:
+            raise NotImplementedError
+
+    def _auth_params(self):
+        if self.client_type == 'tempest':
+            return dict(
+                user=self.credentials['username'],
+                password=self.credentials['password'],
+                tenant=self.credentials.get('tenant_name', None),
+                auth_data=True)
+        else:
+            raise NotImplementedError
+
+    def base_url(self, filters, auth_data=None):
+        """
+        Filters can be:
+        - service: compute, image, etc
+        - region: the service region
+        - endpoint_type: adminURL, publicURL, internalURL
+        - api_version: replace catalog version with this
+        - skip_path: take just the base URL
+        """
+        if auth_data is None:
+            auth_data = self.auth_data
+        token, _auth_data = auth_data
+        service = filters.get('service')
+        region = filters.get('region')
+        endpoint_type = filters.get('endpoint_type', 'publicURL')
+
+        if service is None:
+            raise exceptions.EndpointNotFound("No service provided")
+
+        _base_url = None
+        for ep in _auth_data['serviceCatalog']:
+            if ep["type"] == service:
+                for _ep in ep['endpoints']:
+                    if region is not None and _ep['region'] == region:
+                        _base_url = _ep.get(endpoint_type)
+                if not _base_url:
+                    # No region matching, use the first
+                    _base_url = ep['endpoints'][0].get(endpoint_type)
+                break
+        if _base_url is None:
+            raise exceptions.EndpointNotFound(service)
+
+        parts = urlparse.urlparse(_base_url)
+        if filters.get('api_version', None) is not None:
+            path = "/" + filters['api_version']
+            noversion_path = "/".join(parts.path.split("/")[2:])
+            if noversion_path != "":
+                path += "/" + noversion_path
+            _base_url = _base_url.replace(parts.path, path)
+        if filters.get('skip_path', None) is not None:
+            _base_url = _base_url.replace(parts.path, "/")
+
+        return _base_url
+
+    def is_expired(self, auth_data):
+        _, access = auth_data
+        expiry = datetime.strptime(access['token']['expires'],
+                                   self.EXPIRY_DATE_FORMAT)
+        return expiry <= datetime.now()
+
+
+class KeystoneV3AuthProvider(KeystoneAuthProvider):
+
+    EXPIRY_DATE_FORMAT = '%Y-%m-%dT%H:%M:%S.%fZ'
+
+    @classmethod
+    def check_credentials(cls, credentials, scoped=True):
+        # tenant_name is optional if not scoped
+        valid = super(KeystoneV3AuthProvider, cls).check_credentials(
+            credentials) and 'username' in credentials and \
+            'password' in credentials and 'domain_name' in credentials
+        if scoped:
+            valid = valid and 'tenant_name' in credentials
+        return valid
+
+    def _auth_client(self):
+        if self.client_type == 'tempest':
+            if self.interface == 'json':
+                return json_v3id.V3TokenClientJSON()
+            else:
+                return xml_v3id.V3TokenClientXML()
+        else:
+            raise NotImplementedError
+
+    def _auth_params(self):
+        if self.client_type == 'tempest':
+            return dict(
+                user=self.credentials['username'],
+                password=self.credentials['password'],
+                tenant=self.credentials.get('tenant_name', None),
+                domain=self.credentials['domain_name'],
+                auth_data=True)
+        else:
+            raise NotImplementedError
+
+    def base_url(self, filters, auth_data=None):
+        """
+        Filters can be:
+        - service: compute, image, etc
+        - region: the service region
+        - endpoint_type: adminURL, publicURL, internalURL
+        - api_version: replace catalog version with this
+        - skip_path: take just the base URL
+        """
+        if auth_data is None:
+            auth_data = self.auth_data
+        token, _auth_data = auth_data
+        service = filters.get('service')
+        region = filters.get('region')
+        endpoint_type = filters.get('endpoint_type', 'public')
+
+        if service is None:
+            raise exceptions.EndpointNotFound("No service provided")
+
+        if 'URL' in endpoint_type:
+            endpoint_type = endpoint_type.replace('URL', '')
+        _base_url = None
+        catalog = _auth_data['catalog']
+        # Select entries with matching service type
+        service_catalog = [ep for ep in catalog if ep['type'] == service]
+        if len(service_catalog) > 0:
+            service_catalog = service_catalog[0]['endpoints']
+        else:
+            # No matching service
+            raise exceptions.EndpointNotFound(service)
+        # Filter by endpoint type (interface)
+        filtered_catalog = [ep for ep in service_catalog if
+                            ep['interface'] == endpoint_type]
+        if len(filtered_catalog) == 0:
+            # No matching type, keep all and try matching by region at least
+            filtered_catalog = service_catalog
+        # Filter by region
+        filtered_catalog = [ep for ep in filtered_catalog if
+                            ep['region'] == region]
+        if len(filtered_catalog) == 0:
+            # No matching region, take the first endpoint
+            filtered_catalog = [filtered_catalog[0]]
+        # There should be only one match. If not take the first.
+        _base_url = filtered_catalog[0].get('url', None)
+        if _base_url is None:
+                raise exceptions.EndpointNotFound(service)
+
+        parts = urlparse.urlparse(_base_url)
+        if filters.get('api_version', None) is not None:
+            path = "/" + filters['api_version']
+            noversion_path = "/".join(parts.path.split("/")[2:])
+            if noversion_path != "":
+                path += noversion_path
+            _base_url = _base_url.replace(parts.path, path)
+        if filters.get('skip_path', None) is not None:
+            _base_url = _base_url.replace(parts.path, "/")
+
+        return _base_url
+
+    def is_expired(self, auth_data):
+        _, access = auth_data
+        expiry = datetime.strptime(access['expires_at'],
+                                   self.EXPIRY_DATE_FORMAT)
+        return expiry <= datetime.now()
diff --git a/tempest/clients.py b/tempest/clients.py
index f8361af..9c1a0f1 100644
--- a/tempest/clients.py
+++ b/tempest/clients.py
@@ -13,6 +13,7 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+from tempest import auth
 from tempest.common.rest_client import NegativeRestClient
 from tempest import config
 from tempest import exceptions
@@ -185,172 +186,208 @@
         :param password: Override of the password
         :param tenant_name: Override of the tenant name
         """
-        # If no creds are provided, we fall back on the defaults
-        # in the config file for the Compute API.
-        self.username = username or CONF.identity.username
-        self.password = password or CONF.identity.password
-        self.tenant_name = tenant_name or CONF.identity.tenant_name
-
-        if None in (self.username, self.password, self.tenant_name):
-            msg = ("Missing required credentials. "
-                   "username: %(u)s, password: %(p)s, "
-                   "tenant_name: %(t)s" %
-                   {'u': username, 'p': password, 't': tenant_name})
-            raise exceptions.InvalidConfiguration(msg)
-
-        self.auth_url = CONF.identity.uri
-        self.auth_url_v3 = CONF.identity.uri_v3
-
-        client_args = (self.username, self.password,
-                       self.auth_url, self.tenant_name)
-
-        if self.auth_url_v3:
-            auth_version = 'v3'
-            client_args_v3_auth = (self.username,
-                                   self.password, self.auth_url_v3,
-                                   self.tenant_name, auth_version)
+        self.interface = interface
+        self.auth_version = CONF.identity.auth_version
+        # FIXME(andreaf) Change Manager __init__ to accept a credentials dict
+        if username is None or password is None:
+            # Tenant None is a valid use case
+            self.credentials = self.get_default_credentials()
         else:
-            client_args_v3_auth = None
+            self.credentials = dict(username=username, password=password,
+                                    tenant_name=tenant_name)
+        if self.auth_version == 'v3':
+            self.credentials['domain_name'] = 'Default'
+        # Setup an auth provider
+        auth_provider = self.get_auth_provider(self.credentials)
 
-        self.servers_client_v3_auth = None
-
-        if interface == 'xml':
-            self.certificates_client = CertificatesClientXML(*client_args)
-            self.servers_client = ServersClientXML(*client_args)
-            self.limits_client = LimitsClientXML(*client_args)
-            self.images_client = ImagesClientXML(*client_args)
-            self.keypairs_client = KeyPairsClientXML(*client_args)
-            self.quotas_client = QuotasClientXML(*client_args)
-            self.flavors_client = FlavorsClientXML(*client_args)
-            self.extensions_client = ExtensionsClientXML(*client_args)
+        if self.interface == 'xml':
+            self.certificates_client = CertificatesClientXML(
+                auth_provider)
+            self.servers_client = ServersClientXML(auth_provider)
+            self.limits_client = LimitsClientXML(auth_provider)
+            self.images_client = ImagesClientXML(auth_provider)
+            self.keypairs_client = KeyPairsClientXML(auth_provider)
+            self.quotas_client = QuotasClientXML(auth_provider)
+            self.flavors_client = FlavorsClientXML(auth_provider)
+            self.extensions_client = ExtensionsClientXML(auth_provider)
             self.volumes_extensions_client = VolumesExtensionsClientXML(
-                *client_args)
-            self.floating_ips_client = FloatingIPsClientXML(*client_args)
-            self.snapshots_client = SnapshotsClientXML(*client_args)
-            self.volumes_client = VolumesClientXML(*client_args)
-            self.volume_types_client = VolumeTypesClientXML(*client_args)
-            self.identity_client = IdentityClientXML(*client_args)
-            self.identity_v3_client = IdentityV3ClientXML(*client_args)
-            self.token_client = TokenClientXML()
+                auth_provider)
+            self.floating_ips_client = FloatingIPsClientXML(
+                auth_provider)
+            self.snapshots_client = SnapshotsClientXML(auth_provider)
+            self.volumes_client = VolumesClientXML(auth_provider)
+            self.volume_types_client = VolumeTypesClientXML(
+                auth_provider)
+            self.identity_client = IdentityClientXML(auth_provider)
+            self.identity_v3_client = IdentityV3ClientXML(
+                auth_provider)
             self.security_groups_client = SecurityGroupsClientXML(
-                *client_args)
-            self.interfaces_client = InterfacesClientXML(*client_args)
-            self.endpoints_client = EndPointClientXML(*client_args)
-            self.fixed_ips_client = FixedIPsClientXML(*client_args)
+                auth_provider)
+            self.interfaces_client = InterfacesClientXML(auth_provider)
+            self.endpoints_client = EndPointClientXML(auth_provider)
+            self.fixed_ips_client = FixedIPsClientXML(auth_provider)
             self.availability_zone_client = AvailabilityZoneClientXML(
-                *client_args)
-            self.service_client = ServiceClientXML(*client_args)
-            self.aggregates_client = AggregatesClientXML(*client_args)
-            self.services_client = ServicesClientXML(*client_args)
-            self.tenant_usages_client = TenantUsagesClientXML(*client_args)
-            self.policy_client = PolicyClientXML(*client_args)
-            self.hosts_client = HostsClientXML(*client_args)
-            self.hypervisor_client = HypervisorClientXML(*client_args)
-            self.token_v3_client = V3TokenClientXML(*client_args)
-            self.network_client = NetworkClientXML(*client_args)
-            self.credentials_client = CredentialsClientXML(*client_args)
+                auth_provider)
+            self.service_client = ServiceClientXML(auth_provider)
+            self.aggregates_client = AggregatesClientXML(auth_provider)
+            self.services_client = ServicesClientXML(auth_provider)
+            self.tenant_usages_client = TenantUsagesClientXML(
+                auth_provider)
+            self.policy_client = PolicyClientXML(auth_provider)
+            self.hosts_client = HostsClientXML(auth_provider)
+            self.hypervisor_client = HypervisorClientXML(auth_provider)
+            self.network_client = NetworkClientXML(auth_provider)
+            self.credentials_client = CredentialsClientXML(
+                auth_provider)
             self.instance_usages_audit_log_client = \
-                InstanceUsagesAuditLogClientXML(*client_args)
-            self.volume_hosts_client = VolumeHostsClientXML(*client_args)
+                InstanceUsagesAuditLogClientXML(auth_provider)
+            self.volume_hosts_client = VolumeHostsClientXML(
+                auth_provider)
             self.volumes_extension_client = VolumeExtensionClientXML(
-                *client_args)
-
-            if client_args_v3_auth:
-                self.servers_client_v3_auth = ServersClientXML(
-                    *client_args_v3_auth)
+                auth_provider)
             if CONF.service_available.ceilometer:
-                self.telemetry_client = TelemetryClientXML(*client_args)
+                self.telemetry_client = TelemetryClientXML(
+                    auth_provider)
+            self.token_client = TokenClientXML()
+            self.token_v3_client = V3TokenClientXML()
 
-        elif interface == 'json':
-            self.certificates_client = CertificatesClientJSON(*client_args)
+        elif self.interface == 'json':
+            self.certificates_client = CertificatesClientJSON(
+                auth_provider)
             self.certificates_v3_client = CertificatesV3ClientJSON(
-                *client_args)
-            self.baremetal_client = BaremetalClientJSON(*client_args)
-            self.servers_client = ServersClientJSON(*client_args)
-            self.servers_v3_client = ServersV3ClientJSON(*client_args)
-            self.limits_client = LimitsClientJSON(*client_args)
-            self.images_client = ImagesClientJSON(*client_args)
-            self.keypairs_v3_client = KeyPairsV3ClientJSON(*client_args)
-            self.keypairs_client = KeyPairsClientJSON(*client_args)
-            self.keypairs_v3_client = KeyPairsV3ClientJSON(*client_args)
-            self.quotas_client = QuotasClientJSON(*client_args)
-            self.quotas_v3_client = QuotasV3ClientJSON(*client_args)
-            self.flavors_client = FlavorsClientJSON(*client_args)
-            self.flavors_v3_client = FlavorsV3ClientJSON(*client_args)
-            self.extensions_v3_client = ExtensionsV3ClientJSON(*client_args)
-            self.extensions_client = ExtensionsClientJSON(*client_args)
+                auth_provider)
+            self.baremetal_client = BaremetalClientJSON(auth_provider)
+            self.servers_client = ServersClientJSON(auth_provider)
+            self.servers_v3_client = ServersV3ClientJSON(auth_provider)
+            self.limits_client = LimitsClientJSON(auth_provider)
+            self.images_client = ImagesClientJSON(auth_provider)
+            self.keypairs_v3_client = KeyPairsV3ClientJSON(
+                auth_provider)
+            self.keypairs_client = KeyPairsClientJSON(auth_provider)
+            self.keypairs_v3_client = KeyPairsV3ClientJSON(
+                auth_provider)
+            self.quotas_client = QuotasClientJSON(auth_provider)
+            self.quotas_v3_client = QuotasV3ClientJSON(auth_provider)
+            self.flavors_client = FlavorsClientJSON(auth_provider)
+            self.flavors_v3_client = FlavorsV3ClientJSON(auth_provider)
+            self.extensions_v3_client = ExtensionsV3ClientJSON(
+                auth_provider)
+            self.extensions_client = ExtensionsClientJSON(
+                auth_provider)
             self.volumes_extensions_client = VolumesExtensionsClientJSON(
-                *client_args)
-            self.floating_ips_client = FloatingIPsClientJSON(*client_args)
-            self.snapshots_client = SnapshotsClientJSON(*client_args)
-            self.volumes_client = VolumesClientJSON(*client_args)
-            self.volume_types_client = VolumeTypesClientJSON(*client_args)
-            self.identity_client = IdentityClientJSON(*client_args)
-            self.identity_v3_client = IdentityV3ClientJSON(*client_args)
-            self.token_client = TokenClientJSON()
+                auth_provider)
+            self.floating_ips_client = FloatingIPsClientJSON(
+                auth_provider)
+            self.snapshots_client = SnapshotsClientJSON(auth_provider)
+            self.volumes_client = VolumesClientJSON(auth_provider)
+            self.volume_types_client = VolumeTypesClientJSON(
+                auth_provider)
+            self.identity_client = IdentityClientJSON(auth_provider)
+            self.identity_v3_client = IdentityV3ClientJSON(
+                auth_provider)
             self.security_groups_client = SecurityGroupsClientJSON(
-                *client_args)
-            self.interfaces_v3_client = InterfacesV3ClientJSON(*client_args)
-            self.interfaces_client = InterfacesClientJSON(*client_args)
-            self.endpoints_client = EndPointClientJSON(*client_args)
-            self.fixed_ips_client = FixedIPsClientJSON(*client_args)
+                auth_provider)
+            self.interfaces_v3_client = InterfacesV3ClientJSON(
+                auth_provider)
+            self.interfaces_client = InterfacesClientJSON(
+                auth_provider)
+            self.endpoints_client = EndPointClientJSON(auth_provider)
+            self.fixed_ips_client = FixedIPsClientJSON(auth_provider)
             self.availability_zone_v3_client = AvailabilityZoneV3ClientJSON(
-                *client_args)
+                auth_provider)
             self.availability_zone_client = AvailabilityZoneClientJSON(
-                *client_args)
-            self.services_v3_client = ServicesV3ClientJSON(*client_args)
-            self.service_client = ServiceClientJSON(*client_args)
-            self.aggregates_v3_client = AggregatesV3ClientJSON(*client_args)
-            self.aggregates_client = AggregatesClientJSON(*client_args)
-            self.services_client = ServicesClientJSON(*client_args)
+                auth_provider)
+            self.services_v3_client = ServicesV3ClientJSON(
+                auth_provider)
+            self.service_client = ServiceClientJSON(auth_provider)
+            self.aggregates_v3_client = AggregatesV3ClientJSON(
+                auth_provider)
+            self.aggregates_client = AggregatesClientJSON(
+                auth_provider)
+            self.services_client = ServicesClientJSON(auth_provider)
             self.tenant_usages_v3_client = TenantUsagesV3ClientJSON(
-                *client_args)
-            self.tenant_usages_client = TenantUsagesClientJSON(*client_args)
-            self.version_v3_client = VersionV3ClientJSON(*client_args)
-            self.policy_client = PolicyClientJSON(*client_args)
-            self.hosts_client = HostsClientJSON(*client_args)
-            self.hypervisor_v3_client = HypervisorV3ClientJSON(*client_args)
-            self.hypervisor_client = HypervisorClientJSON(*client_args)
-            self.token_v3_client = V3TokenClientJSON(*client_args)
-            self.network_client = NetworkClientJSON(*client_args)
-            self.credentials_client = CredentialsClientJSON(*client_args)
+                auth_provider)
+            self.tenant_usages_client = TenantUsagesClientJSON(
+                auth_provider)
+            self.version_v3_client = VersionV3ClientJSON(auth_provider)
+            self.policy_client = PolicyClientJSON(auth_provider)
+            self.hosts_client = HostsClientJSON(auth_provider)
+            self.hypervisor_v3_client = HypervisorV3ClientJSON(
+                auth_provider)
+            self.hypervisor_client = HypervisorClientJSON(
+                auth_provider)
+            self.network_client = NetworkClientJSON(auth_provider)
+            self.credentials_client = CredentialsClientJSON(
+                auth_provider)
             self.instance_usages_audit_log_client = \
-                InstanceUsagesAuditLogClientJSON(*client_args)
+                InstanceUsagesAuditLogClientJSON(auth_provider)
             self.instance_usages_audit_log_v3_client = \
-                InstanceUsagesAuditLogV3ClientJSON(*client_args)
-            self.volume_hosts_client = VolumeHostsClientJSON(*client_args)
+                InstanceUsagesAuditLogV3ClientJSON(auth_provider)
+            self.volume_hosts_client = VolumeHostsClientJSON(
+                auth_provider)
             self.volumes_extension_client = VolumeExtensionClientJSON(
-                *client_args)
-            self.hosts_v3_client = HostsV3ClientJSON(*client_args)
+                auth_provider)
+            self.hosts_v3_client = HostsV3ClientJSON(auth_provider)
             if CONF.service_available.ceilometer:
-                self.telemetry_client = TelemetryClientJSON(*client_args)
-            self.negative_client = NegativeRestClient(*client_args)
+                self.telemetry_client = TelemetryClientJSON(
+                    auth_provider)
+            self.token_client = TokenClientJSON()
+            self.token_v3_client = V3TokenClientJSON()
+            self.negative_client = NegativeRestClient(auth_provider)
             self.negative_client.service = service
 
-            if client_args_v3_auth:
-                self.servers_client_v3_auth = ServersClientJSON(
-                    *client_args_v3_auth)
-                self.negative_v3_client = NegativeRestClient(
-                    *client_args_v3_auth)
-                self.negative_v3_client.service = service
         else:
             msg = "Unsupported interface type `%s'" % interface
             raise exceptions.InvalidConfiguration(msg)
 
+        # TODO(andreaf) EC2 client still do their auth, v2 only
+        ec2_client_args = (self.credentials.get('username'),
+                           self.credentials.get('password'),
+                           CONF.identity.uri,
+                           self.credentials.get('tenant_name'))
+
         # common clients
-        self.account_client = AccountClient(*client_args)
+        self.account_client = AccountClient(auth_provider)
         if CONF.service_available.glance:
-            self.image_client = ImageClientJSON(*client_args)
-            self.image_client_v2 = ImageClientV2JSON(*client_args)
-        self.container_client = ContainerClient(*client_args)
-        self.object_client = ObjectClient(*client_args)
-        self.orchestration_client = OrchestrationClient(*client_args)
-        self.ec2api_client = botoclients.APIClientEC2(*client_args)
-        self.s3_client = botoclients.ObjectClientS3(*client_args)
-        self.custom_object_client = ObjectClientCustomizedHeader(*client_args)
+            self.image_client = ImageClientJSON(auth_provider)
+            self.image_client_v2 = ImageClientV2JSON(auth_provider)
+        self.container_client = ContainerClient(auth_provider)
+        self.object_client = ObjectClient(auth_provider)
+        self.orchestration_client = OrchestrationClient(
+            auth_provider)
+        self.ec2api_client = botoclients.APIClientEC2(*ec2_client_args)
+        self.s3_client = botoclients.ObjectClientS3(*ec2_client_args)
+        self.custom_object_client = ObjectClientCustomizedHeader(
+            auth_provider)
         self.custom_account_client = \
-            AccountClientCustomizedHeader(*client_args)
-        self.data_processing_client = DataProcessingClient(*client_args)
+            AccountClientCustomizedHeader(auth_provider)
+        self.data_processing_client = DataProcessingClient(
+            auth_provider)
+
+    @classmethod
+    def get_auth_provider_class(cls, auth_version):
+        if auth_version == 'v2':
+            return auth.KeystoneV2AuthProvider
+        else:
+            return auth.KeystoneV3AuthProvider
+
+    def get_default_credentials(self):
+        return dict(
+            username=CONF.identity.username,
+            password=CONF.identity.password,
+            tenant_name=CONF.identity.tenant_name
+        )
+
+    def get_auth_provider(self, credentials=None):
+        auth_params = dict(client_type='tempest',
+                           interface=self.interface)
+        auth_provider_class = self.get_auth_provider_class(self.auth_version)
+        # If invalid / incomplete credentials are provided, use default ones
+        if credentials is None or \
+                not auth_provider_class.check_credentials(credentials):
+            credentials = self.credentials
+        auth_params['credentials'] = credentials
+        return auth_provider_class(**auth_params)
 
 
 class AltManager(Manager):
@@ -408,6 +445,6 @@
         base = super(OrchestrationManager, self)
         base.__init__(CONF.identity.admin_username,
                       CONF.identity.admin_password,
-                      CONF.identity.tenant_name,
+                      CONF.identity.admin_tenant_name,
                       interface=interface,
                       service=service)
diff --git a/tempest/common/generate_json.py b/tempest/common/generate_json.py
index 0a0afe4..c8e86dc 100644
--- a/tempest/common/generate_json.py
+++ b/tempest/common/generate_json.py
@@ -203,36 +203,62 @@
     return invalids
 
 
-type_map_valid = {"string": generate_valid_string,
-                  "integer": generate_valid_integer,
-                  "object": generate_valid_object}
+type_map_valid = {
+    "string": generate_valid_string,
+    "integer": generate_valid_integer,
+    "object": generate_valid_object
+}
 
-type_map_invalid = {"string": [gen_int,
-                               gen_none,
-                               gen_str_min_length,
-                               gen_str_max_length],
-                    "integer": [gen_string,
-                                gen_none,
-                                gen_int_min,
-                                gen_int_max],
-                    "object": [gen_obj_remove_attr,
-                               gen_obj_add_attr,
-                               gen_inv_prop_obj]}
+type_map_invalid = {
+    "string": [
+        gen_int,
+        gen_none,
+        gen_str_min_length,
+        gen_str_max_length],
+    "integer": [
+        gen_string,
+        gen_none,
+        gen_int_min,
+        gen_int_max],
+    "object": [
+        gen_obj_remove_attr,
+        gen_obj_add_attr,
+        gen_inv_prop_obj]
+}
 
-schema = {"type": "object",
-          "properties":
-          {"name": {"type": "string"},
-           "http-method": {"enum": ["GET", "PUT", "HEAD",
-                                    "POST", "PATCH", "DELETE", 'COPY']},
-           "url": {"type": "string"},
-           "json-schema": jsonschema._utils.load_schema("draft4"),
-           "resources": {"type": "array", "items": {"type": "string"}},
-           "results": {"type": "object",
-                       "properties": {}}
-           },
-          "required": ["name", "http-method", "url"],
-          "additionalProperties": False,
-          }
+schema = {
+    "type": "object",
+    "properties": {
+        "name": {"type": "string"},
+        "http-method": {
+            "enum": ["GET", "PUT", "HEAD",
+                     "POST", "PATCH", "DELETE", 'COPY']
+        },
+        "url": {"type": "string"},
+        "json-schema": jsonschema._utils.load_schema("draft4"),
+        "resources": {
+            "type": "array",
+            "items": {
+                "oneOf": [
+                    {"type": "string"},
+                    {
+                        "type": "object",
+                        "properties": {
+                            "name": {"type": "string"},
+                            "expected_result": {"type": "integer"}
+                        }
+                    }
+                ]
+            }
+        },
+        "results": {
+            "type": "object",
+            "properties": {}
+        }
+    },
+    "required": ["name", "http-method", "url"],
+    "additionalProperties": False,
+}
 
 
 def validate_negative_test_schema(nts):
diff --git a/tempest/common/glance_http.py b/tempest/common/glance_http.py
index d8afab3..4503f13 100644
--- a/tempest/common/glance_http.py
+++ b/tempest/common/glance_http.py
@@ -45,8 +45,10 @@
 
 class HTTPClient(object):
 
-    def __init__(self, endpoint, **kwargs):
-        self.endpoint = endpoint
+    def __init__(self, auth_provider, filters, **kwargs):
+        self.auth_provider = auth_provider
+        self.filters = filters
+        self.endpoint = auth_provider.base_url(filters)
         endpoint_parts = self.parse_endpoint(self.endpoint)
         self.endpoint_scheme = endpoint_parts.scheme
         self.endpoint_hostname = endpoint_parts.hostname
@@ -57,8 +59,6 @@
         self.connection_kwargs = self.get_connection_kwargs(
             self.endpoint_scheme, **kwargs)
 
-        self.auth_token = kwargs.get('token')
-
     @staticmethod
     def parse_endpoint(endpoint):
         return urlparse.urlparse(endpoint)
@@ -100,15 +100,15 @@
         # Copy the kwargs so we can reuse the original in case of redirects
         kwargs['headers'] = copy.deepcopy(kwargs.get('headers', {}))
         kwargs['headers'].setdefault('User-Agent', USER_AGENT)
-        if self.auth_token:
-            kwargs['headers'].setdefault('X-Auth-Token', self.auth_token)
 
         self._log_request(method, url, kwargs['headers'])
 
         conn = self.get_connection()
 
         try:
-            conn_url = posixpath.normpath('%s/%s' % (self.endpoint_path, url))
+            url_parts = self.parse_endpoint(url)
+            conn_url = posixpath.normpath(url_parts.path)
+            LOG.debug('Actual Path: {path}'.format(path=conn_url))
             if kwargs['headers'].get('Transfer-Encoding') == 'chunked':
                 conn.putrequest(method, conn_url)
                 for header, value in kwargs['headers'].items():
@@ -198,7 +198,13 @@
                 # We use 'Transfer-Encoding: chunked' because
                 # body size may not always be known in advance.
                 kwargs['headers']['Transfer-Encoding'] = 'chunked'
-        return self._http_request(url, method, **kwargs)
+
+        # Decorate the request with auth
+        req_url, kwargs['headers'], kwargs['body'] = \
+            self.auth_provider.auth_request(
+                method=method, url=url, headers=kwargs['headers'],
+                body=kwargs.get('body', None), filters=self.filters)
+        return self._http_request(req_url, method, **kwargs)
 
 
 class OpenSSLConnectionDelegator(object):
diff --git a/tempest/common/isolated_creds.py b/tempest/common/isolated_creds.py
index 146fac9..ac8b14f 100644
--- a/tempest/common/isolated_creds.py
+++ b/tempest/common/isolated_creds.py
@@ -36,7 +36,6 @@
         self.isolated_net_resources = {}
         self.ports = []
         self.name = name
-        self.config = CONF
         self.tempest_client = tempest_client
         self.interface = interface
         self.password = password
diff --git a/tempest/common/rest_client.py b/tempest/common/rest_client.py
index d80d4c0..212d41d 100644
--- a/tempest/common/rest_client.py
+++ b/tempest/common/rest_client.py
@@ -38,32 +38,34 @@
 
 
 class RestClient(object):
+
     TYPE = "json"
+
+    # This is used by _parse_resp method
+    # Redefine it for purposes of your xml service client
+    # List should contain top-xml_tag-names of data, which is like list/array
+    # For example, in keystone it is users, roles, tenants and services
+    # All of it has children with same tag-names
+    list_tags = []
+
+    # This is used by _parse_resp method too
+    # Used for selection of dict-like xmls,
+    # like metadata for Vms in nova, and volumes in cinder
+    dict_tags = ["metadata", ]
+
     LOG = logging.getLogger(__name__)
 
-    def __init__(self, user, password, auth_url, tenant_name=None,
-                 auth_version='v2'):
-        self.user = user
-        self.password = password
-        self.auth_url = auth_url
-        self.tenant_name = tenant_name
-        self.auth_version = auth_version
+    def __init__(self, auth_provider):
+        self.auth_provider = auth_provider
 
-        self.service = None
-        self.token = None
-        self.base_url = None
-        self.region = {}
-        for cfgname in dir(CONF):
-            # Find all config.FOO.catalog_type and assume FOO is a service.
-            cfg = getattr(CONF, cfgname)
-            catalog_type = getattr(cfg, 'catalog_type', None)
-            if not catalog_type:
-                continue
-            service_region = getattr(cfg, 'region', None)
-            if not service_region:
-                service_region = CONF.identity.region
-            self.region[catalog_type] = service_region
         self.endpoint_url = 'publicURL'
+        self.service = None
+        # The version of the API this client implements
+        self.api_version = None
+        self._skip_path = False
+        # NOTE(vponomaryov): self.headers is deprecated now.
+        # should be removed after excluding it from all use places.
+        # Insted of this should be used 'get_headers' method
         self.headers = {'Content-Type': 'application/%s' % self.TYPE,
                         'Accept': 'application/%s' % self.TYPE}
         self.build_interval = CONF.compute.build_interval
@@ -80,196 +82,89 @@
         self.http_obj = http.ClosingHttp(
             disable_ssl_certificate_validation=dscv)
 
+    def _get_type(self):
+        return self.TYPE
+
+    def get_headers(self, accept_type=None, send_type=None):
+        # This method should be used instead of
+        # deprecated 'self.headers'
+        if accept_type is None:
+            accept_type = self._get_type()
+        if send_type is None:
+            send_type = self._get_type()
+        return {'Content-Type': 'application/%s' % send_type,
+                'Accept': 'application/%s' % accept_type}
+
     def __str__(self):
         STRING_LIMIT = 80
-        str_format = ("user:%s, password:%s, "
-                      "auth_url:%s, tenant_name:%s, auth_version:%s, "
-                      "service:%s, base_url:%s, region:%s, "
-                      "endpoint_url:%s, build_interval:%s, build_timeout:%s"
+        str_format = ("config:%s, service:%s, base_url:%s, "
+                      "filters: %s, build_interval:%s, build_timeout:%s"
                       "\ntoken:%s..., \nheaders:%s...")
-        return str_format % (self.user, self.password,
-                             self.auth_url, self.tenant_name,
-                             self.auth_version, self.service,
-                             self.base_url, self.region, self.endpoint_url,
-                             self.build_interval, self.build_timeout,
+        return str_format % (CONF, self.service, self.base_url,
+                             self.filters, self.build_interval,
+                             self.build_timeout,
                              str(self.token)[0:STRING_LIMIT],
-                             str(self.headers)[0:STRING_LIMIT])
+                             str(self.get_headers())[0:STRING_LIMIT])
 
-    def _set_auth(self):
+    def _get_region(self, service):
         """
-        Sets the token and base_url used in requests based on the strategy type
+        Returns the region for a specific service
         """
+        service_region = None
+        for cfgname in dir(CONF._config):
+            # Find all config.FOO.catalog_type and assume FOO is a service.
+            cfg = getattr(CONF, cfgname)
+            catalog_type = getattr(cfg, 'catalog_type', None)
+            if catalog_type == service:
+                service_region = getattr(cfg, 'region', None)
+        if not service_region:
+            service_region = CONF.identity.region
+        return service_region
 
-        if self.auth_version == 'v3':
-            auth_func = self.identity_auth_v3
-        else:
-            auth_func = self.keystone_auth
+    @property
+    def user(self):
+        return self.auth_provider.credentials.get('username', None)
 
-        self.token, self.base_url = (
-            auth_func(self.user, self.password, self.auth_url,
-                      self.service, self.tenant_name))
+    @property
+    def tenant_name(self):
+        return self.auth_provider.credentials.get('tenant_name', None)
 
-    def clear_auth(self):
+    @property
+    def password(self):
+        return self.auth_provider.credentials.get('password', None)
+
+    @property
+    def base_url(self):
+        return self.auth_provider.base_url(filters=self.filters)
+
+    @property
+    def token(self):
+        return self.auth_provider.get_token()
+
+    @property
+    def filters(self):
+        _filters = dict(
+            service=self.service,
+            endpoint_type=self.endpoint_url,
+            region=self._get_region(self.service)
+        )
+        if self.api_version is not None:
+            _filters['api_version'] = self.api_version
+        if self._skip_path:
+            _filters['skip_path'] = self._skip_path
+        return _filters
+
+    def skip_path(self):
         """
-        Can be called to clear the token and base_url so that the next request
-        will fetch a new token and base_url.
+        When set, ignore the path part of the base URL from the catalog
         """
+        self._skip_path = True
 
-        self.token = None
-        self.base_url = None
-
-    def get_auth(self):
-        """Returns the token of the current request or sets the token if
-        none.
+    def reset_path(self):
         """
-
-        if not self.token:
-            self._set_auth()
-
-        return self.token
-
-    def keystone_auth(self, user, password, auth_url, service, tenant_name):
+        When reset, use the base URL from the catalog as-is
         """
-        Provides authentication via Keystone using v2 identity API.
-        """
-
-        # Normalize URI to ensure /tokens is in it.
-        if 'tokens' not in auth_url:
-            auth_url = auth_url.rstrip('/') + '/tokens'
-
-        creds = {
-            'auth': {
-                'passwordCredentials': {
-                    'username': user,
-                    'password': password,
-                },
-                'tenantName': tenant_name,
-            }
-        }
-
-        headers = {'Content-Type': 'application/json'}
-        body = json.dumps(creds)
-        self._log_request('POST', auth_url, headers, body)
-        resp, resp_body = self.http_obj.request(auth_url, 'POST',
-                                                headers=headers, body=body)
-        self._log_response(resp, resp_body)
-
-        if resp.status == 200:
-            try:
-                auth_data = json.loads(resp_body)['access']
-                token = auth_data['token']['id']
-            except Exception as e:
-                print("Failed to obtain token for user: %s" % e)
-                raise
-
-            mgmt_url = None
-            for ep in auth_data['serviceCatalog']:
-                if ep["type"] == service:
-                    for _ep in ep['endpoints']:
-                        if service in self.region and \
-                                _ep['region'] == self.region[service]:
-                            mgmt_url = _ep[self.endpoint_url]
-                    if not mgmt_url:
-                        mgmt_url = ep['endpoints'][0][self.endpoint_url]
-                    break
-
-            if mgmt_url is None:
-                raise exceptions.EndpointNotFound(service)
-
-            return token, mgmt_url
-
-        elif resp.status == 401:
-            raise exceptions.AuthenticationFailure(user=user,
-                                                   password=password,
-                                                   tenant=tenant_name)
-        raise exceptions.IdentityError('Unexpected status code {0}'.format(
-            resp.status))
-
-    def identity_auth_v3(self, user, password, auth_url, service,
-                         project_name, domain_id='default'):
-        """Provides authentication using Identity API v3."""
-
-        req_url = auth_url.rstrip('/') + '/auth/tokens'
-
-        creds = {
-            "auth": {
-                "identity": {
-                    "methods": ["password"],
-                    "password": {
-                        "user": {
-                            "name": user, "password": password,
-                            "domain": {"id": domain_id}
-                        }
-                    }
-                },
-                "scope": {
-                    "project": {
-                        "domain": {"id": domain_id},
-                        "name": project_name
-                    }
-                }
-            }
-        }
-
-        headers = {'Content-Type': 'application/json'}
-        body = json.dumps(creds)
-        resp, body = self.http_obj.request(req_url, 'POST',
-                                           headers=headers, body=body)
-
-        if resp.status == 201:
-            try:
-                token = resp['x-subject-token']
-            except Exception:
-                self.LOG.exception("Failed to obtain token using V3"
-                                   " authentication (auth URL is '%s')" %
-                                   req_url)
-                raise
-
-            catalog = json.loads(body)['token']['catalog']
-
-            mgmt_url = None
-            for service_info in catalog:
-                if service_info['type'] != service:
-                    continue  # this isn't the entry for us.
-
-                endpoints = service_info['endpoints']
-
-                # Look for an endpoint in the region if configured.
-                if service in self.region:
-                    region = self.region[service]
-
-                    for ep in endpoints:
-                        if ep['region'] != region:
-                            continue
-
-                        mgmt_url = ep['url']
-                        # FIXME(blk-u): this isn't handling endpoint type
-                        # (public, internal, admin).
-                        break
-
-                if not mgmt_url:
-                    # Didn't find endpoint for region, use the first.
-
-                    ep = endpoints[0]
-                    mgmt_url = ep['url']
-                    # FIXME(blk-u): this isn't handling endpoint type
-                    # (public, internal, admin).
-
-                break
-
-            return token, mgmt_url
-
-        elif resp.status == 401:
-            raise exceptions.AuthenticationFailure(user=user,
-                                                   password=password,
-                                                   tenant=project_name)
-        else:
-            self.LOG.error("Failed to obtain token using V3 authentication"
-                           " (auth URL is '%s'), the response status is %s" %
-                           (req_url, resp.status))
-            raise exceptions.AuthenticationFailure(user=user,
-                                                   password=password,
-                                                   tenant=project_name)
+        self._skip_path = False
 
     def expected_success(self, expected_code, read_code):
         assert_msg = ("This function only allowed to use for HTTP status"
@@ -285,7 +180,7 @@
                 details = pattern.format(read_code, expected_code)
                 raise exceptions.InvalidHttpSuccessCode(details)
 
-    def post(self, url, body, headers):
+    def post(self, url, body, headers=None):
         return self.request('POST', url, headers, body)
 
     def get(self, url, headers=None):
@@ -294,10 +189,10 @@
     def delete(self, url, headers=None, body=None):
         return self.request('DELETE', url, headers, body)
 
-    def patch(self, url, body, headers):
+    def patch(self, url, body, headers=None):
         return self.request('PATCH', url, headers, body)
 
-    def put(self, url, body, headers):
+    def put(self, url, body, headers=None):
         return self.request('PUT', url, headers, body)
 
     def head(self, url, headers=None):
@@ -353,7 +248,48 @@
                                hashlib.md5(str_body).hexdigest())
 
     def _parse_resp(self, body):
-        return json.loads(body)
+        if self._get_type() is "json":
+            body = json.loads(body)
+
+            # We assume, that if the first value of the deserialized body's
+            # item set is a dict or a list, that we just return the first value
+            # of deserialized body.
+            # Essentially "cutting out" the first placeholder element in a body
+            # that looks like this:
+            #
+            #  {
+            #    "users": [
+            #      ...
+            #    ]
+            #  }
+            try:
+                # Ensure there are not more than one top-level keys
+                if len(body.keys()) > 1:
+                    return body
+                # Just return the "wrapped" element
+                first_key, first_item = body.items()[0]
+                if isinstance(first_item, (dict, list)):
+                    return first_item
+            except (ValueError, IndexError):
+                pass
+            return body
+        elif self._get_type() is "xml":
+            element = etree.fromstring(body)
+            if any(s in element.tag for s in self.dict_tags):
+                # Parse dictionary-like xmls (metadata, etc)
+                dictionary = {}
+                for el in element.getchildren():
+                    dictionary[u"%s" % el.get("key")] = u"%s" % el.text
+                return dictionary
+            if any(s in element.tag for s in self.list_tags):
+                # Parse list-like xmls (users, roles, etc)
+                array = []
+                for child in element.getchildren():
+                    array.append(xml_to_json(child))
+                return array
+
+            # Parse one-item-like xmls (user, role, etc)
+            return xml_to_json(element)
 
     def response_checker(self, method, url, headers, body, resp, resp_body):
         if (resp.status in set((204, 205, 304)) or resp.status < 200 or
@@ -383,28 +319,29 @@
         if not resp_body and resp.status >= 400:
             self.LOG.warning("status >= 400 response with empty body")
 
-    def _request(self, method, url,
-                 headers=None, body=None):
+    def _request(self, method, url, headers=None, body=None):
         """A simple HTTP request interface."""
-
-        req_url = "%s/%s" % (self.base_url, url)
-        self._log_request(method, req_url, headers, body)
-        resp, resp_body = self.http_obj.request(req_url, method,
-                                                headers=headers, body=body)
+        # Authenticate the request with the auth provider
+        req_url, req_headers, req_body = self.auth_provider.auth_request(
+            method, url, headers, body, self.filters)
+        self._log_request(method, req_url, req_headers, req_body)
+        # Do the actual request
+        resp, resp_body = self.http_obj.request(
+            req_url, method, headers=req_headers, body=req_body)
         self._log_response(resp, resp_body)
-        self.response_checker(method, url, headers, body, resp, resp_body)
+        # Verify HTTP response codes
+        self.response_checker(method, url, req_headers, req_body, resp,
+                              resp_body)
 
         return resp, resp_body
 
-    def request(self, method, url,
-                headers=None, body=None):
+    def request(self, method, url, headers=None, body=None):
         retry = 0
-        if (self.token is None) or (self.base_url is None):
-            self._set_auth()
 
         if headers is None:
-            headers = {}
-        headers['X-Auth-Token'] = self.token
+            # NOTE(vponomaryov): if some client do not need headers,
+            # it should explicitly pass empty dict
+            headers = self.get_headers()
 
         resp, resp_body = self._request(method, url,
                                         headers=headers, body=body)
@@ -524,10 +461,13 @@
         if (not isinstance(resp_body, collections.Mapping) or
                 'retry-after' not in resp):
             return True
-        over_limit = resp_body.get('overLimit', None)
-        if not over_limit:
-            return True
-        return 'exceed' in over_limit.get('message', 'blabla')
+        if self._get_type() is "json":
+            over_limit = resp_body.get('overLimit', None)
+            if not over_limit:
+                return True
+            return 'exceed' in over_limit.get('message', 'blabla')
+        elif self._get_type() is "xml":
+            return 'exceed' in resp_body.get('message', 'blabla')
 
     def wait_for_resource_deletion(self, id):
         """Waits for a resource to be deleted."""
@@ -549,6 +489,11 @@
 
 
 class RestClientXML(RestClient):
+
+    # NOTE(vponomaryov): This is deprecated class
+    # and should be removed after excluding it
+    # from all service clients
+
     TYPE = "xml"
 
     def _parse_resp(self, body):
@@ -574,11 +519,11 @@
         if method == "GET":
             resp, body = self.get(url)
         elif method == "POST":
-            resp, body = self.post(url, body, self.headers)
+            resp, body = self.post(url, body)
         elif method == "PUT":
-            resp, body = self.put(url, body, self.headers)
+            resp, body = self.put(url, body)
         elif method == "PATCH":
-            resp, body = self.patch(url, body, self.headers)
+            resp, body = self.patch(url, body)
         elif method == "HEAD":
             resp, body = self.head(url)
         elif method == "DELETE":
diff --git a/tempest/common/ssh.py b/tempest/common/ssh.py
index 0ed9b82..c772ce9 100644
--- a/tempest/common/ssh.py
+++ b/tempest/common/ssh.py
@@ -49,7 +49,7 @@
         self.channel_timeout = float(channel_timeout)
         self.buf_size = 1024
 
-    def _get_ssh_connection(self, sleep=1.5, backoff=1.01):
+    def _get_ssh_connection(self, sleep=1.5, backoff=1):
         """Returns an ssh connection to the specified host."""
         bsleep = sleep
         ssh = paramiko.SSHClient()
@@ -76,19 +76,21 @@
                          self.username, self.host)
                 return ssh
             except (socket.error,
-                    paramiko.SSHException):
-                attempts += 1
-                time.sleep(bsleep)
-                bsleep *= backoff
-                if not self._is_timed_out(_start_time):
-                    continue
-                else:
+                    paramiko.SSHException) as e:
+                if self._is_timed_out(_start_time):
                     LOG.exception("Failed to establish authenticated ssh"
                                   " connection to %s@%s after %d attempts",
                                   self.username, self.host, attempts)
                     raise exceptions.SSHTimeout(host=self.host,
                                                 user=self.username,
                                                 password=self.password)
+                bsleep += backoff
+                attempts += 1
+                LOG.warning("Failed to establish authenticated ssh"
+                            " connection to %s@%s (%s). Number attempts: %s."
+                            " Retry after %d seconds.",
+                            self.username, self.host, e, attempts, bsleep)
+                time.sleep(bsleep)
 
     def _is_timed_out(self, start_time):
         return (time.time() - self.timeout) > start_time
diff --git a/tempest/common/utils/__init__.py b/tempest/common/utils/__init__.py
index 38f3d38..04d898d 100644
--- a/tempest/common/utils/__init__.py
+++ b/tempest/common/utils/__init__.py
@@ -1,4 +1,3 @@
-LAST_REBOOT_TIME_FORMAT = '%Y-%m-%d %H:%M:%S'
 PING_IPV4_COMMAND = 'ping -c 3 '
 PING_IPV6_COMMAND = 'ping6 -c 3 '
 PING_PACKET_LOSS_REGEX = '(\d{1,3})\.?\d*\% packet loss'
diff --git a/tempest/config.py b/tempest/config.py
index ccb3125..d24ab34 100644
--- a/tempest/config.py
+++ b/tempest/config.py
@@ -43,6 +43,10 @@
                help="Full URI of the OpenStack Identity API (Keystone), v2"),
     cfg.StrOpt('uri_v3',
                help='Full URI of the OpenStack Identity API (Keystone), v3'),
+    cfg.StrOpt('auth_version',
+               default='v2',
+               help="Identity API version to be used for authentication "
+                    "for API tests."),
     cfg.StrOpt('region',
                default='RegionOne',
                help="The identity region name to use. Also used as the other "
@@ -582,7 +586,12 @@
                help='time (in seconds) between log file error checks.'),
     cfg.IntOpt('default_thread_number_per_action',
                default=4,
-               help='The number of threads created while stress test.')
+               help='The number of threads created while stress test.'),
+    cfg.BoolOpt('leave_dirty_stack',
+                default=False,
+                help='Prevent the cleaning (tearDownClass()) between'
+                     ' each stress test run if an exception occurs'
+                     ' during this run.')
 ]
 
 
@@ -776,7 +785,7 @@
         self.compute_feature_enabled = cfg.CONF['compute-feature-enabled']
         self.identity = cfg.CONF.identity
         self.identity_feature_enabled = cfg.CONF['identity-feature-enabled']
-        self.images = cfg.CONF.image
+        self.image = cfg.CONF.image
         self.image_feature_enabled = cfg.CONF['image-feature-enabled']
         self.network = cfg.CONF.network
         self.network_feature_enabled = cfg.CONF['network-feature-enabled']
diff --git a/tempest/scenario/manager.py b/tempest/scenario/manager.py
index 59a3aeb..0fc304a 100644
--- a/tempest/scenario/manager.py
+++ b/tempest/scenario/manager.py
@@ -22,7 +22,7 @@
 import cinderclient.client
 import glanceclient
 import heatclient.client
-import keystoneclient.apiclient.exceptions
+import keystoneclient.exceptions
 import keystoneclient.v2_0.client
 import netaddr
 from neutronclient.common import exceptions as exc
@@ -112,7 +112,7 @@
         region = CONF.identity.region
         endpoint = self.identity_client.service_catalog.url_for(
             attr='region', filter_value=region,
-            service_type='image', endpoint_type='publicURL')
+            service_type=CONF.image.catalog_type, endpoint_type='publicURL')
         dscv = CONF.identity.disable_ssl_certificate_validation
         return glanceclient.Client('1', endpoint=endpoint, token=token,
                                    insecure=dscv)
@@ -146,7 +146,7 @@
             keystone_admin.roles.add_user_role(self.identity_client.user_id,
                                                member_role.id,
                                                self.identity_client.tenant_id)
-        except keystoneclient.apiclient.exceptions.Conflict:
+        except keystoneclient.exceptions.Conflict:
             pass
 
         return swiftclient.Connection(auth_url, username, password,
@@ -167,11 +167,12 @@
         keystone = self._get_identity_client(username, password, tenant_name)
         region = CONF.identity.region
         token = keystone.auth_token
+        service_type = CONF.orchestration.catalog_type
         try:
             endpoint = keystone.service_catalog.url_for(
                 attr='region',
                 filter_value=region,
-                service_type='orchestration',
+                service_type=service_type,
                 endpoint_type='publicURL')
         except keystoneclient.exceptions.EndpointNotFound:
             return None
@@ -670,13 +671,17 @@
                          "Unable to determine which port to target.")
         return ports[0]['id']
 
-    def _create_floating_ip(self, server, external_network_id):
-        port_id = self._get_server_port_id(server)
+    def _create_floating_ip(self, thing, external_network_id,
+                            port_filters=None):
+        if port_filters is None:
+            port_id = self._get_server_port_id(thing)
+        else:
+            port_id = port_filters
         body = dict(
             floatingip=dict(
                 floating_network_id=external_network_id,
                 port_id=port_id,
-                tenant_id=server.tenant_id,
+                tenant_id=thing.tenant_id,
             )
         )
         result = self.network_client.create_floatingip(body=body)
@@ -713,6 +718,58 @@
         return tempest.test.call_until_true(
             ping, CONF.compute.ping_timeout, 1)
 
+    def _create_pool(self, lb_method, protocol, subnet_id):
+        """Wrapper utility that returns a test pool."""
+        name = data_utils.rand_name('pool-')
+        body = {
+            "pool": {
+                "protocol": protocol,
+                "name": name,
+                "subnet_id": subnet_id,
+                "lb_method": lb_method
+            }
+        }
+        resp = self.network_client.create_pool(body=body)
+        pool = net_common.DeletablePool(client=self.network_client,
+                                        **resp['pool'])
+        self.assertEqual(pool['name'], name)
+        self.set_resource(name, pool)
+        return pool
+
+    def _create_member(self, address, protocol_port, pool_id):
+        """Wrapper utility that returns a test member."""
+        body = {
+            "member": {
+                "protocol_port": protocol_port,
+                "pool_id": pool_id,
+                "address": address
+            }
+        }
+        resp = self.network_client.create_member(body)
+        member = net_common.DeletableMember(client=self.network_client,
+                                            **resp['member'])
+        self.set_resource(data_utils.rand_name('member-'), member)
+        return member
+
+    def _create_vip(self, protocol, protocol_port, subnet_id, pool_id):
+        """Wrapper utility that returns a test vip."""
+        name = data_utils.rand_name('vip-')
+        body = {
+            "vip": {
+                "protocol": protocol,
+                "name": name,
+                "subnet_id": subnet_id,
+                "pool_id": pool_id,
+                "protocol_port": protocol_port
+            }
+        }
+        resp = self.network_client.create_vip(body)
+        vip = net_common.DeletableVip(client=self.network_client,
+                                      **resp['vip'])
+        self.assertEqual(vip['name'], name)
+        self.set_resource(name, vip)
+        return vip
+
     def _check_vm_connectivity(self, ip_address,
                                username=None,
                                private_key=None,
diff --git a/tempest/scenario/test_load_balancer_basic.py b/tempest/scenario/test_load_balancer_basic.py
new file mode 100644
index 0000000..68f6e62
--- /dev/null
+++ b/tempest/scenario/test_load_balancer_basic.py
@@ -0,0 +1,240 @@
+# Copyright 2014 Mirantis.inc
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import time
+import urllib
+
+from tempest.api.network import common as net_common
+from tempest.common import ssh
+from tempest.common.utils import data_utils
+from tempest import config
+from tempest import exceptions
+from tempest.scenario import manager
+from tempest import test
+
+config = config.CONF
+
+
+class TestLoadBalancerBasic(manager.NetworkScenarioTest):
+
+    """
+    This test checks basic load balancing.
+
+    The following is the scenario outline:
+    1. Create an instance
+    2. SSH to the instance and start two servers
+    3. Create a load balancer with two members and with ROUND_ROBIN algorithm
+       associate the VIP with a floating ip
+    4. Send 10 requests to the floating ip and check that they are shared
+       between the two servers and that both of them get equal portions
+    of the requests
+    """
+
+    @classmethod
+    def check_preconditions(cls):
+        super(TestLoadBalancerBasic, cls).check_preconditions()
+        cfg = config.network
+        if not test.is_extension_enabled('lbaas', 'network'):
+            msg = 'LBaaS Extension is not enabled'
+            cls.enabled = False
+            raise cls.skipException(msg)
+        if not (cfg.tenant_networks_reachable or cfg.public_network_id):
+            msg = ('Either tenant_networks_reachable must be "true", or '
+                   'public_network_id must be defined.')
+            cls.enabled = False
+            raise cls.skipException(msg)
+
+    @classmethod
+    def setUpClass(cls):
+        super(TestLoadBalancerBasic, cls).setUpClass()
+        cls.check_preconditions()
+        cls.security_groups = {}
+        cls.networks = []
+        cls.subnets = []
+        cls.servers_keypairs = {}
+        cls.pools = []
+        cls.members = []
+        cls.vips = []
+        cls.floating_ips = {}
+        cls.port1 = 80
+        cls.port2 = 88
+
+    def _create_security_groups(self):
+        self.security_groups[self.tenant_id] =\
+            self._create_security_group_neutron(tenant_id=self.tenant_id)
+
+    def _create_server(self):
+        tenant_id = self.tenant_id
+        name = data_utils.rand_name("smoke_server-")
+        keypair = self.create_keypair(name='keypair-%s' % name)
+        security_groups = [self.security_groups[tenant_id].name]
+        nets = self.network_client.list_networks()
+        for net in nets['networks']:
+            if net['tenant_id'] == self.tenant_id:
+                self.networks.append(net)
+                create_kwargs = {
+                    'nics': [
+                        {'net-id': net['id']},
+                    ],
+                    'key_name': keypair.name,
+                    'security_groups': security_groups,
+                }
+                server = self.create_server(name=name,
+                                            create_kwargs=create_kwargs)
+                self.servers_keypairs[server] = keypair
+                break
+        self.assertTrue(self.servers_keypairs)
+
+    def _start_servers(self):
+        """
+        1. SSH to the instance
+        2. Start two servers listening on ports 80 and 88 respectively
+        """
+        for server in self.servers_keypairs.keys():
+            ssh_login = config.compute.image_ssh_user
+            private_key = self.servers_keypairs[server].private_key
+            network_name = self.networks[0]['name']
+
+            ip_address = server.networks[network_name][0]
+            ssh_client = ssh.Client(ip_address, ssh_login,
+                                    pkey=private_key,
+                                    timeout=100)
+            start_server = "while true; do echo -e 'HTTP/1.0 200 OK\r\n\r\n" \
+                           "%(server)s' | sudo nc -l -p %(port)s ; done &"
+            cmd = start_server % {'server': 'server1',
+                                  'port': self.port1}
+            ssh_client.exec_command(cmd)
+            cmd = start_server % {'server': 'server2',
+                                  'port': self.port2}
+            ssh_client.exec_command(cmd)
+
+    def _check_connection(self, check_ip):
+        def try_connect(ip):
+            try:
+                urllib.urlopen("http://{0}/".format(ip))
+                return True
+            except IOError:
+                return False
+        timeout = config.compute.ping_timeout
+        timer = 0
+        while not try_connect(check_ip):
+            time.sleep(1)
+            timer += 1
+            if timer >= timeout:
+                message = "Timed out trying to connect to %s" % check_ip
+                raise exceptions.TimeoutException(message)
+
+    def _create_pool(self):
+        """Create a pool with ROUND_ROBIN algorithm."""
+        subnets = self.network_client.list_subnets()
+        for subnet in subnets['subnets']:
+            if subnet['tenant_id'] == self.tenant_id:
+                self.subnets.append(subnet)
+                pool = super(TestLoadBalancerBasic, self)._create_pool(
+                    'ROUND_ROBIN',
+                    'HTTP',
+                    subnet['id'])
+                self.pools.append(pool)
+                break
+        self.assertTrue(self.pools)
+
+    def _create_members(self, network_name, server_ids):
+        """
+        Create two members.
+
+        In case there is only one server, create both members with the same ip
+        but with different ports to listen on.
+        """
+        servers = self.compute_client.servers.list()
+        for server in servers:
+            if server.id in server_ids:
+                ip = server.networks[network_name][0]
+                pool_id = self.pools[0]['id']
+                if len(set(server_ids)) == 1 or len(servers) == 1:
+                    member1 = self._create_member(ip, self.port1, pool_id)
+                    member2 = self._create_member(ip, self.port2, pool_id)
+                    self.members.extend([member1, member2])
+                else:
+                    member = self._create_member(ip, self.port1, pool_id)
+                    self.members.append(member)
+        self.assertTrue(self.members)
+
+    def _assign_floating_ip_to_vip(self, vip):
+        public_network_id = config.network.public_network_id
+        port_id = vip['port_id']
+        floating_ip = self._create_floating_ip(vip,
+                                               public_network_id,
+                                               port_filters=port_id)
+        self.floating_ips.setdefault(vip['id'], [])
+        self.floating_ips[vip['id']].append(floating_ip)
+
+    def _create_load_balancer(self):
+        self._create_pool()
+        self._create_members(self.networks[0]['name'],
+                             [self.servers_keypairs.keys()[0].id])
+        subnet_id = self.subnets[0]['id']
+        pool_id = self.pools[0]['id']
+        vip = super(TestLoadBalancerBasic, self)._create_vip('HTTP', 80,
+                                                             subnet_id,
+                                                             pool_id)
+        self.vips.append(vip)
+        self._status_timeout(NeutronRetriever(self.network_client,
+                                              self.network_client.vip_path,
+                                              net_common.DeletableVip),
+                             self.vips[0]['id'],
+                             expected_status='ACTIVE')
+        self._assign_floating_ip_to_vip(self.vips[0])
+
+    def _check_load_balancing(self):
+        """
+        1. Send 10 requests on the floating ip associated with the VIP
+        2. Check that the requests are shared between
+           the two servers and that both of them get equal portions
+           of the requests
+        """
+
+        vip = self.vips[0]
+        floating_ip_vip = self.floating_ips[
+            vip['id']][0]['floating_ip_address']
+        self._check_connection(floating_ip_vip)
+        resp = []
+        for count in range(10):
+            resp.append(
+                urllib.urlopen(
+                    "http://{0}/".format(floating_ip_vip)).read())
+        self.assertEqual(set(["server1\n", "server2\n"]), set(resp))
+        self.assertEqual(5, resp.count("server1\n"))
+        self.assertEqual(5, resp.count("server2\n"))
+
+    @test.skip_because(bug="1277381")
+    @test.attr(type='smoke')
+    @test.services('compute', 'network')
+    def test_load_balancer_basic(self):
+        self._create_security_groups()
+        self._create_server()
+        self._start_servers()
+        self._create_load_balancer()
+        self._check_load_balancing()
+
+
+class NeutronRetriever(object):
+    def __init__(self, network_client, path, resource):
+        self.network_client = network_client
+        self.path = path
+        self.resource = resource
+
+    def get(self, thing_id):
+        obj = self.network_client.get(self.path % thing_id)
+        return self.resource(client=self.network_client, **obj.values()[0])
diff --git a/tempest/services/baremetal/base.py b/tempest/services/baremetal/base.py
index 0b5426e..6e86466 100644
--- a/tempest/services/baremetal/base.py
+++ b/tempest/services/baremetal/base.py
@@ -47,9 +47,8 @@
 
     """
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(BaremetalClient, self).__init__(username, password,
-                                              auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(BaremetalClient, self).__init__(auth_provider)
         self.service = CONF.baremetal.catalog_type
         self.uri_prefix = ''
 
diff --git a/tempest/services/baremetal/v1/base_v1.py b/tempest/services/baremetal/v1/base_v1.py
index 13693e1..3f4c509 100644
--- a/tempest/services/baremetal/v1/base_v1.py
+++ b/tempest/services/baremetal/v1/base_v1.py
@@ -21,9 +21,8 @@
     methods in order to send requests to Ironic.
 
     """
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(BaremetalClientV1, self).__init__(username, password,
-                                                auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(BaremetalClientV1, self).__init__(auth_provider)
         self.version = '1'
         self.uri_prefix = 'v%s' % self.version
 
diff --git a/tempest/services/baremetal/v1/client_json.py b/tempest/services/baremetal/v1/client_json.py
index c98b20f..c9dc874 100644
--- a/tempest/services/baremetal/v1/client_json.py
+++ b/tempest/services/baremetal/v1/client_json.py
@@ -18,9 +18,8 @@
 class BaremetalClientJSON(base_v1.BaremetalClientV1):
     """Tempest REST client for Ironic JSON API v1."""
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(BaremetalClientJSON, self).__init__(username, password,
-                                                  auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(BaremetalClientJSON, self).__init__(auth_provider)
 
         self.serialize = lambda obj_type, obj_body: json.dumps(obj_body)
         self.deserialize = json.loads
diff --git a/tempest/services/compute/json/aggregates_client.py b/tempest/services/compute/json/aggregates_client.py
index dc8a316..aa52081 100644
--- a/tempest/services/compute/json/aggregates_client.py
+++ b/tempest/services/compute/json/aggregates_client.py
@@ -24,9 +24,8 @@
 
 class AggregatesClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(AggregatesClientJSON, self).__init__(username, password,
-                                                   auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(AggregatesClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def list_aggregates(self):
diff --git a/tempest/services/compute/json/availability_zone_client.py b/tempest/services/compute/json/availability_zone_client.py
index 2b7e23c..ea4e95e 100644
--- a/tempest/services/compute/json/availability_zone_client.py
+++ b/tempest/services/compute/json/availability_zone_client.py
@@ -23,10 +23,9 @@
 
 class AvailabilityZoneClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(AvailabilityZoneClientJSON, self).__init__(username,
-                                                         password, auth_url,
-                                                         tenant_name)
+    def __init__(self, auth_provider):
+        super(AvailabilityZoneClientJSON, self).__init__(
+            auth_provider)
         self.service = CONF.compute.catalog_type
 
     def get_availability_zone_list(self):
diff --git a/tempest/services/compute/json/certificates_client.py b/tempest/services/compute/json/certificates_client.py
index 06e2ae7..b7135f6 100644
--- a/tempest/services/compute/json/certificates_client.py
+++ b/tempest/services/compute/json/certificates_client.py
@@ -23,10 +23,8 @@
 
 class CertificatesClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(CertificatesClientJSON, self).__init__(username,
-                                                     password,
-                                                     auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(CertificatesClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def get_certificate(self, id):
diff --git a/tempest/services/compute/json/extensions_client.py b/tempest/services/compute/json/extensions_client.py
index 8505d93..f7e2737 100644
--- a/tempest/services/compute/json/extensions_client.py
+++ b/tempest/services/compute/json/extensions_client.py
@@ -23,9 +23,8 @@
 
 class ExtensionsClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(ExtensionsClientJSON, self).__init__(username, password,
-                                                   auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(ExtensionsClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def list_extensions(self):
diff --git a/tempest/services/compute/json/fixed_ips_client.py b/tempest/services/compute/json/fixed_ips_client.py
index 19bf4e2..144b7dc 100644
--- a/tempest/services/compute/json/fixed_ips_client.py
+++ b/tempest/services/compute/json/fixed_ips_client.py
@@ -23,9 +23,8 @@
 
 class FixedIPsClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(FixedIPsClientJSON, self).__init__(username, password,
-                                                 auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(FixedIPsClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def get_fixed_ip_details(self, fixed_ip):
diff --git a/tempest/services/compute/json/flavors_client.py b/tempest/services/compute/json/flavors_client.py
index 7fcf1b2..96ab6d7 100644
--- a/tempest/services/compute/json/flavors_client.py
+++ b/tempest/services/compute/json/flavors_client.py
@@ -24,9 +24,8 @@
 
 class FlavorsClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(FlavorsClientJSON, self).__init__(username, password,
-                                                auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(FlavorsClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def list_flavors(self, params=None):
diff --git a/tempest/services/compute/json/floating_ips_client.py b/tempest/services/compute/json/floating_ips_client.py
index 7c2139d..2bf5241 100644
--- a/tempest/services/compute/json/floating_ips_client.py
+++ b/tempest/services/compute/json/floating_ips_client.py
@@ -24,9 +24,8 @@
 
 
 class FloatingIPsClientJSON(RestClient):
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(FloatingIPsClientJSON, self).__init__(username, password,
-                                                    auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(FloatingIPsClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def list_floating_ips(self, params=None):
diff --git a/tempest/services/compute/json/hosts_client.py b/tempest/services/compute/json/hosts_client.py
index 33e5345..aa63927 100644
--- a/tempest/services/compute/json/hosts_client.py
+++ b/tempest/services/compute/json/hosts_client.py
@@ -23,9 +23,8 @@
 
 class HostsClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(HostsClientJSON, self).__init__(username, password,
-                                              auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(HostsClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def list_hosts(self, params=None):
diff --git a/tempest/services/compute/json/hypervisor_client.py b/tempest/services/compute/json/hypervisor_client.py
index a4d8660..74844dc 100644
--- a/tempest/services/compute/json/hypervisor_client.py
+++ b/tempest/services/compute/json/hypervisor_client.py
@@ -23,10 +23,8 @@
 
 class HypervisorClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(HypervisorClientJSON, self).__init__(username,
-                                                   password, auth_url,
-                                                   tenant_name)
+    def __init__(self, auth_provider):
+        super(HypervisorClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def get_hypervisor_list(self):
diff --git a/tempest/services/compute/json/images_client.py b/tempest/services/compute/json/images_client.py
index c9adc3f..7324d84 100644
--- a/tempest/services/compute/json/images_client.py
+++ b/tempest/services/compute/json/images_client.py
@@ -26,9 +26,8 @@
 
 class ImagesClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(ImagesClientJSON, self).__init__(username, password,
-                                               auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(ImagesClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
         self.build_interval = CONF.compute.build_interval
         self.build_timeout = CONF.compute.build_timeout
diff --git a/tempest/services/compute/json/instance_usage_audit_log_client.py b/tempest/services/compute/json/instance_usage_audit_log_client.py
index 2673bd7..27930f2 100644
--- a/tempest/services/compute/json/instance_usage_audit_log_client.py
+++ b/tempest/services/compute/json/instance_usage_audit_log_client.py
@@ -23,9 +23,9 @@
 
 class InstanceUsagesAuditLogClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
+    def __init__(self, auth_provider):
         super(InstanceUsagesAuditLogClientJSON, self).__init__(
-            username, password, auth_url, tenant_name)
+            auth_provider)
         self.service = CONF.compute.catalog_type
 
     def list_instance_usage_audit_logs(self):
diff --git a/tempest/services/compute/json/interfaces_client.py b/tempest/services/compute/json/interfaces_client.py
index c0a2db2..d9a2030 100644
--- a/tempest/services/compute/json/interfaces_client.py
+++ b/tempest/services/compute/json/interfaces_client.py
@@ -25,9 +25,8 @@
 
 class InterfacesClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(InterfacesClientJSON, self).__init__(username, password,
-                                                   auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(InterfacesClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def list_interfaces(self, server):
diff --git a/tempest/services/compute/json/keypairs_client.py b/tempest/services/compute/json/keypairs_client.py
index dd4e3e1..3e2d4a7 100644
--- a/tempest/services/compute/json/keypairs_client.py
+++ b/tempest/services/compute/json/keypairs_client.py
@@ -23,9 +23,8 @@
 
 class KeyPairsClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(KeyPairsClientJSON, self).__init__(username, password,
-                                                 auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(KeyPairsClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def list_keypairs(self):
diff --git a/tempest/services/compute/json/limits_client.py b/tempest/services/compute/json/limits_client.py
index c5cc988..765ba79 100644
--- a/tempest/services/compute/json/limits_client.py
+++ b/tempest/services/compute/json/limits_client.py
@@ -23,9 +23,8 @@
 
 class LimitsClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(LimitsClientJSON, self).__init__(username, password,
-                                               auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(LimitsClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def get_absolute_limits(self):
diff --git a/tempest/services/compute/json/quotas_client.py b/tempest/services/compute/json/quotas_client.py
index df12467..2007d4e 100644
--- a/tempest/services/compute/json/quotas_client.py
+++ b/tempest/services/compute/json/quotas_client.py
@@ -23,9 +23,8 @@
 
 class QuotasClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(QuotasClientJSON, self).__init__(username, password,
-                                               auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(QuotasClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def get_quota_set(self, tenant_id):
diff --git a/tempest/services/compute/json/security_groups_client.py b/tempest/services/compute/json/security_groups_client.py
index 299a6e6..edaf4a3 100644
--- a/tempest/services/compute/json/security_groups_client.py
+++ b/tempest/services/compute/json/security_groups_client.py
@@ -25,10 +25,8 @@
 
 class SecurityGroupsClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(SecurityGroupsClientJSON, self).__init__(username,
-                                                       password, auth_url,
-                                                       tenant_name)
+    def __init__(self, auth_provider):
+        super(SecurityGroupsClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def list_security_groups(self, params=None):
diff --git a/tempest/services/compute/json/servers_client.py b/tempest/services/compute/json/servers_client.py
index 0987f05..371a59c 100644
--- a/tempest/services/compute/json/servers_client.py
+++ b/tempest/services/compute/json/servers_client.py
@@ -28,11 +28,9 @@
 
 class ServersClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None,
-                 auth_version='v2'):
-        super(ServersClientJSON, self).__init__(username, password,
-                                                auth_url, tenant_name,
-                                                auth_version=auth_version)
+    def __init__(self, auth_provider):
+        super(ServersClientJSON, self).__init__(auth_provider)
+
         self.service = CONF.compute.catalog_type
 
     def create_server(self, name, image_ref, flavor_ref, **kwargs):
diff --git a/tempest/services/compute/json/services_client.py b/tempest/services/compute/json/services_client.py
index c209cf3..4abee47 100644
--- a/tempest/services/compute/json/services_client.py
+++ b/tempest/services/compute/json/services_client.py
@@ -25,9 +25,8 @@
 
 class ServicesClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(ServicesClientJSON, self).__init__(username, password,
-                                                 auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(ServicesClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def list_services(self, params=None):
diff --git a/tempest/services/compute/json/tenant_usages_client.py b/tempest/services/compute/json/tenant_usages_client.py
index c141fa7..b14fa9b 100644
--- a/tempest/services/compute/json/tenant_usages_client.py
+++ b/tempest/services/compute/json/tenant_usages_client.py
@@ -24,9 +24,8 @@
 
 class TenantUsagesClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(TenantUsagesClientJSON, self).__init__(
-            username, password, auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(TenantUsagesClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def list_tenant_usages(self, params=None):
diff --git a/tempest/services/compute/json/volumes_extensions_client.py b/tempest/services/compute/json/volumes_extensions_client.py
index d61b8a5..ba7b5df 100644
--- a/tempest/services/compute/json/volumes_extensions_client.py
+++ b/tempest/services/compute/json/volumes_extensions_client.py
@@ -26,10 +26,9 @@
 
 class VolumesExtensionsClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(VolumesExtensionsClientJSON, self).__init__(username,
-                                                          password, auth_url,
-                                                          tenant_name)
+    def __init__(self, auth_provider):
+        super(VolumesExtensionsClientJSON, self).__init__(
+            auth_provider)
         self.service = CONF.compute.catalog_type
         self.build_interval = CONF.volume.build_interval
         self.build_timeout = CONF.volume.build_timeout
diff --git a/tempest/services/compute/v3/json/aggregates_client.py b/tempest/services/compute/v3/json/aggregates_client.py
index f3824f8..6bc758c 100644
--- a/tempest/services/compute/v3/json/aggregates_client.py
+++ b/tempest/services/compute/v3/json/aggregates_client.py
@@ -24,10 +24,8 @@
 
 class AggregatesV3ClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(AggregatesV3ClientJSON, self).__init__(username,
-                                                     password, auth_url,
-                                                     tenant_name)
+    def __init__(self, auth_provider):
+        super(AggregatesV3ClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_v3_type
 
     def list_aggregates(self):
diff --git a/tempest/services/compute/v3/json/availability_zone_client.py b/tempest/services/compute/v3/json/availability_zone_client.py
index a3f4d94..4a6db55 100644
--- a/tempest/services/compute/v3/json/availability_zone_client.py
+++ b/tempest/services/compute/v3/json/availability_zone_client.py
@@ -23,10 +23,9 @@
 
 class AvailabilityZoneV3ClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(AvailabilityZoneV3ClientJSON, self).__init__(username,
-                                                           password, auth_url,
-                                                           tenant_name)
+    def __init__(self, auth_provider):
+        super(AvailabilityZoneV3ClientJSON, self).__init__(
+            auth_provider)
         self.service = CONF.compute.catalog_v3_type
 
     def get_availability_zone_list(self):
diff --git a/tempest/services/compute/v3/json/certificates_client.py b/tempest/services/compute/v3/json/certificates_client.py
index 1833cb9..0c9f9ac 100644
--- a/tempest/services/compute/v3/json/certificates_client.py
+++ b/tempest/services/compute/v3/json/certificates_client.py
@@ -23,10 +23,8 @@
 
 class CertificatesV3ClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(CertificatesV3ClientJSON, self).__init__(username,
-                                                       password,
-                                                       auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(CertificatesV3ClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_v3_type
 
     def get_certificate(self, id):
diff --git a/tempest/services/compute/v3/json/extensions_client.py b/tempest/services/compute/v3/json/extensions_client.py
index f760093..54f0aba 100644
--- a/tempest/services/compute/v3/json/extensions_client.py
+++ b/tempest/services/compute/v3/json/extensions_client.py
@@ -23,10 +23,8 @@
 
 class ExtensionsV3ClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(ExtensionsV3ClientJSON, self).__init__(username,
-                                                     password, auth_url,
-                                                     tenant_name)
+    def __init__(self, auth_provider):
+        super(ExtensionsV3ClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_v3_type
 
     def list_extensions(self):
diff --git a/tempest/services/compute/v3/json/flavors_client.py b/tempest/services/compute/v3/json/flavors_client.py
index d8a54a6..df3d0c1 100644
--- a/tempest/services/compute/v3/json/flavors_client.py
+++ b/tempest/services/compute/v3/json/flavors_client.py
@@ -24,9 +24,8 @@
 
 class FlavorsV3ClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(FlavorsV3ClientJSON, self).__init__(username, password,
-                                                  auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(FlavorsV3ClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_v3_type
 
     def list_flavors(self, params=None):
diff --git a/tempest/services/compute/v3/json/hosts_client.py b/tempest/services/compute/v3/json/hosts_client.py
index d15b237..e33dd5f 100644
--- a/tempest/services/compute/v3/json/hosts_client.py
+++ b/tempest/services/compute/v3/json/hosts_client.py
@@ -23,9 +23,8 @@
 
 class HostsV3ClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(HostsV3ClientJSON, self).__init__(username, password,
-                                                auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(HostsV3ClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_v3_type
 
     def list_hosts(self, params=None):
diff --git a/tempest/services/compute/v3/json/hypervisor_client.py b/tempest/services/compute/v3/json/hypervisor_client.py
index a4ec606..e07a1fb 100644
--- a/tempest/services/compute/v3/json/hypervisor_client.py
+++ b/tempest/services/compute/v3/json/hypervisor_client.py
@@ -23,10 +23,8 @@
 
 class HypervisorV3ClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(HypervisorV3ClientJSON, self).__init__(username,
-                                                     password, auth_url,
-                                                     tenant_name)
+    def __init__(self, auth_provider):
+        super(HypervisorV3ClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_v3_type
 
     def get_hypervisor_list(self):
diff --git a/tempest/services/compute/v3/json/instance_usage_audit_log_client.py b/tempest/services/compute/v3/json/instance_usage_audit_log_client.py
index b51f490..3a6ac5f 100644
--- a/tempest/services/compute/v3/json/instance_usage_audit_log_client.py
+++ b/tempest/services/compute/v3/json/instance_usage_audit_log_client.py
@@ -23,9 +23,9 @@
 
 class InstanceUsagesAuditLogV3ClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
+    def __init__(self, auth_provider):
         super(InstanceUsagesAuditLogV3ClientJSON, self).__init__(
-            username, password, auth_url, tenant_name)
+            auth_provider)
         self.service = CONF.compute.catalog_v3_type
 
     def list_instance_usage_audit_logs(self, time_before=None):
diff --git a/tempest/services/compute/v3/json/interfaces_client.py b/tempest/services/compute/v3/json/interfaces_client.py
index dc06395..053b9af 100644
--- a/tempest/services/compute/v3/json/interfaces_client.py
+++ b/tempest/services/compute/v3/json/interfaces_client.py
@@ -25,10 +25,8 @@
 
 class InterfacesV3ClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(InterfacesV3ClientJSON, self).__init__(username,
-                                                     password, auth_url,
-                                                     tenant_name)
+    def __init__(self, auth_provider):
+        super(InterfacesV3ClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_v3_type
 
     def list_interfaces(self, server):
diff --git a/tempest/services/compute/v3/json/keypairs_client.py b/tempest/services/compute/v3/json/keypairs_client.py
index c2efb84..05dbe25 100644
--- a/tempest/services/compute/v3/json/keypairs_client.py
+++ b/tempest/services/compute/v3/json/keypairs_client.py
@@ -23,9 +23,8 @@
 
 class KeyPairsV3ClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(KeyPairsV3ClientJSON, self).__init__(username, password,
-                                                   auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(KeyPairsV3ClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_v3_type
 
     def list_keypairs(self):
diff --git a/tempest/services/compute/v3/json/quotas_client.py b/tempest/services/compute/v3/json/quotas_client.py
index ea0d3a2..1ec8651 100644
--- a/tempest/services/compute/v3/json/quotas_client.py
+++ b/tempest/services/compute/v3/json/quotas_client.py
@@ -23,9 +23,8 @@
 
 class QuotasV3ClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(QuotasV3ClientJSON, self).__init__(username, password,
-                                                 auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(QuotasV3ClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_v3_type
 
     def get_quota_set(self, tenant_id):
diff --git a/tempest/services/compute/v3/json/servers_client.py b/tempest/services/compute/v3/json/servers_client.py
index aa8c95a..11538f5 100644
--- a/tempest/services/compute/v3/json/servers_client.py
+++ b/tempest/services/compute/v3/json/servers_client.py
@@ -29,11 +29,8 @@
 
 class ServersV3ClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url,
-                 tenant_name=None, auth_version='v2'):
-        super(ServersV3ClientJSON, self).__init__(username, password,
-                                                  auth_url, tenant_name,
-                                                  auth_version=auth_version)
+    def __init__(self, auth_provider):
+        super(ServersV3ClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_v3_type
 
     def create_server(self, name, image_ref, flavor_ref, **kwargs):
diff --git a/tempest/services/compute/v3/json/services_client.py b/tempest/services/compute/v3/json/services_client.py
index 174a4f7..1082ea9 100644
--- a/tempest/services/compute/v3/json/services_client.py
+++ b/tempest/services/compute/v3/json/services_client.py
@@ -25,9 +25,8 @@
 
 class ServicesV3ClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(ServicesV3ClientJSON, self).__init__(username, password,
-                                                   auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(ServicesV3ClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_v3_type
 
     def list_services(self, params=None):
diff --git a/tempest/services/compute/v3/json/tenant_usages_client.py b/tempest/services/compute/v3/json/tenant_usages_client.py
index fbc41de..6d59e20 100644
--- a/tempest/services/compute/v3/json/tenant_usages_client.py
+++ b/tempest/services/compute/v3/json/tenant_usages_client.py
@@ -24,9 +24,8 @@
 
 class TenantUsagesV3ClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(TenantUsagesV3ClientJSON, self).__init__(
-            username, password, auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(TenantUsagesV3ClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_v3_type
 
     def list_tenant_usages(self, params=None):
diff --git a/tempest/services/compute/v3/json/version_client.py b/tempest/services/compute/v3/json/version_client.py
index 419bbb8..b560c58 100644
--- a/tempest/services/compute/v3/json/version_client.py
+++ b/tempest/services/compute/v3/json/version_client.py
@@ -23,10 +23,8 @@
 
 class VersionV3ClientJSON(rest_client.RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(VersionV3ClientJSON, self).__init__(username,
-                                                  password, auth_url,
-                                                  tenant_name)
+    def __init__(self, auth_provider):
+        super(VersionV3ClientJSON, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_v3_type
 
     def get_version(self):
diff --git a/tempest/services/compute/xml/aggregates_client.py b/tempest/services/compute/xml/aggregates_client.py
index ddef18b..ba08f58 100644
--- a/tempest/services/compute/xml/aggregates_client.py
+++ b/tempest/services/compute/xml/aggregates_client.py
@@ -28,9 +28,8 @@
 
 class AggregatesClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(AggregatesClientXML, self).__init__(username, password,
-                                                  auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(AggregatesClientXML, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def _format_aggregate(self, g):
diff --git a/tempest/services/compute/xml/availability_zone_client.py b/tempest/services/compute/xml/availability_zone_client.py
index ac1bb4b..38280b5 100644
--- a/tempest/services/compute/xml/availability_zone_client.py
+++ b/tempest/services/compute/xml/availability_zone_client.py
@@ -24,10 +24,9 @@
 
 class AvailabilityZoneClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(AvailabilityZoneClientXML, self).__init__(username,
-                                                        password, auth_url,
-                                                        tenant_name)
+    def __init__(self, auth_provider):
+        super(AvailabilityZoneClientXML, self).__init__(
+            auth_provider)
         self.service = CONF.compute.catalog_type
 
     def _parse_array(self, node):
diff --git a/tempest/services/compute/xml/certificates_client.py b/tempest/services/compute/xml/certificates_client.py
index 3f2438d..aad20a4 100644
--- a/tempest/services/compute/xml/certificates_client.py
+++ b/tempest/services/compute/xml/certificates_client.py
@@ -22,9 +22,8 @@
 
 class CertificatesClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(CertificatesClientXML, self).__init__(username, password,
-                                                    auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(CertificatesClientXML, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def get_certificate(self, id):
diff --git a/tempest/services/compute/xml/extensions_client.py b/tempest/services/compute/xml/extensions_client.py
index 98cd3e3..9753ca8 100644
--- a/tempest/services/compute/xml/extensions_client.py
+++ b/tempest/services/compute/xml/extensions_client.py
@@ -24,9 +24,8 @@
 
 class ExtensionsClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(ExtensionsClientXML, self).__init__(username, password,
-                                                  auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(ExtensionsClientXML, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def _parse_array(self, node):
diff --git a/tempest/services/compute/xml/fixed_ips_client.py b/tempest/services/compute/xml/fixed_ips_client.py
index f212e21..599e168 100644
--- a/tempest/services/compute/xml/fixed_ips_client.py
+++ b/tempest/services/compute/xml/fixed_ips_client.py
@@ -25,9 +25,8 @@
 
 class FixedIPsClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(FixedIPsClientXML, self).__init__(username, password,
-                                                auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(FixedIPsClientXML, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def get_fixed_ip_details(self, fixed_ip):
diff --git a/tempest/services/compute/xml/flavors_client.py b/tempest/services/compute/xml/flavors_client.py
index 74c0e47..fb16d20 100644
--- a/tempest/services/compute/xml/flavors_client.py
+++ b/tempest/services/compute/xml/flavors_client.py
@@ -35,9 +35,8 @@
 
 class FlavorsClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(FlavorsClientXML, self).__init__(username, password,
-                                               auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(FlavorsClientXML, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def _format_flavor(self, f):
diff --git a/tempest/services/compute/xml/floating_ips_client.py b/tempest/services/compute/xml/floating_ips_client.py
index bbfe86b..0119d8a 100644
--- a/tempest/services/compute/xml/floating_ips_client.py
+++ b/tempest/services/compute/xml/floating_ips_client.py
@@ -28,9 +28,8 @@
 
 
 class FloatingIPsClientXML(RestClientXML):
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(FloatingIPsClientXML, self).__init__(username, password,
-                                                   auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(FloatingIPsClientXML, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def _parse_array(self, node):
diff --git a/tempest/services/compute/xml/hosts_client.py b/tempest/services/compute/xml/hosts_client.py
index 441be0e..daa83c9 100644
--- a/tempest/services/compute/xml/hosts_client.py
+++ b/tempest/services/compute/xml/hosts_client.py
@@ -26,9 +26,8 @@
 
 class HostsClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(HostsClientXML, self).__init__(username, password,
-                                             auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(HostsClientXML, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def list_hosts(self, params=None):
diff --git a/tempest/services/compute/xml/hypervisor_client.py b/tempest/services/compute/xml/hypervisor_client.py
index bee2dfd..5abaad8 100644
--- a/tempest/services/compute/xml/hypervisor_client.py
+++ b/tempest/services/compute/xml/hypervisor_client.py
@@ -24,10 +24,8 @@
 
 class HypervisorClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(HypervisorClientXML, self).__init__(username,
-                                                  password, auth_url,
-                                                  tenant_name)
+    def __init__(self, auth_provider):
+        super(HypervisorClientXML, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def _parse_array(self, node):
diff --git a/tempest/services/compute/xml/images_client.py b/tempest/services/compute/xml/images_client.py
index 98de7df..d90a7d8 100644
--- a/tempest/services/compute/xml/images_client.py
+++ b/tempest/services/compute/xml/images_client.py
@@ -32,9 +32,8 @@
 
 class ImagesClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(ImagesClientXML, self).__init__(username, password,
-                                              auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(ImagesClientXML, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
         self.build_interval = CONF.compute.build_interval
         self.build_timeout = CONF.compute.build_timeout
diff --git a/tempest/services/compute/xml/instance_usage_audit_log_client.py b/tempest/services/compute/xml/instance_usage_audit_log_client.py
index 2e1d6c8..562774b 100644
--- a/tempest/services/compute/xml/instance_usage_audit_log_client.py
+++ b/tempest/services/compute/xml/instance_usage_audit_log_client.py
@@ -24,9 +24,9 @@
 
 class InstanceUsagesAuditLogClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
+    def __init__(self, auth_provider):
         super(InstanceUsagesAuditLogClientXML, self).__init__(
-            username, password, auth_url, tenant_name)
+            auth_provider)
         self.service = CONF.compute.catalog_type
 
     def list_instance_usage_audit_logs(self):
diff --git a/tempest/services/compute/xml/interfaces_client.py b/tempest/services/compute/xml/interfaces_client.py
index c90f507..4194d7d 100644
--- a/tempest/services/compute/xml/interfaces_client.py
+++ b/tempest/services/compute/xml/interfaces_client.py
@@ -30,9 +30,8 @@
 
 class InterfacesClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(InterfacesClientXML, self).__init__(username, password,
-                                                  auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(InterfacesClientXML, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def _process_xml_interface(self, node):
diff --git a/tempest/services/compute/xml/keypairs_client.py b/tempest/services/compute/xml/keypairs_client.py
index da3303e..92fade4 100644
--- a/tempest/services/compute/xml/keypairs_client.py
+++ b/tempest/services/compute/xml/keypairs_client.py
@@ -28,9 +28,8 @@
 
 class KeyPairsClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(KeyPairsClientXML, self).__init__(username, password,
-                                                auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(KeyPairsClientXML, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def list_keypairs(self):
diff --git a/tempest/services/compute/xml/limits_client.py b/tempest/services/compute/xml/limits_client.py
index 9233697..2a8fbec 100644
--- a/tempest/services/compute/xml/limits_client.py
+++ b/tempest/services/compute/xml/limits_client.py
@@ -25,9 +25,8 @@
 
 class LimitsClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(LimitsClientXML, self).__init__(username, password,
-                                              auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(LimitsClientXML, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def get_absolute_limits(self):
diff --git a/tempest/services/compute/xml/quotas_client.py b/tempest/services/compute/xml/quotas_client.py
index 74aad1b..f1041f0 100644
--- a/tempest/services/compute/xml/quotas_client.py
+++ b/tempest/services/compute/xml/quotas_client.py
@@ -27,9 +27,8 @@
 
 class QuotasClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(QuotasClientXML, self).__init__(username, password,
-                                              auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(QuotasClientXML, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def _format_quota(self, q):
diff --git a/tempest/services/compute/xml/security_groups_client.py b/tempest/services/compute/xml/security_groups_client.py
index c32a81e..83072be 100644
--- a/tempest/services/compute/xml/security_groups_client.py
+++ b/tempest/services/compute/xml/security_groups_client.py
@@ -30,10 +30,8 @@
 
 class SecurityGroupsClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(SecurityGroupsClientXML, self).__init__(
-            username, password,
-            auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(SecurityGroupsClientXML, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def _parse_array(self, node):
diff --git a/tempest/services/compute/xml/servers_client.py b/tempest/services/compute/xml/servers_client.py
index c16d4a3..37980c9 100644
--- a/tempest/services/compute/xml/servers_client.py
+++ b/tempest/services/compute/xml/servers_client.py
@@ -141,11 +141,8 @@
 
 class ServersClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None,
-                 auth_version='v2'):
-        super(ServersClientXML, self).__init__(username, password,
-                                               auth_url, tenant_name,
-                                               auth_version=auth_version)
+    def __init__(self, auth_provider):
+        super(ServersClientXML, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def _parse_key_value(self, node):
diff --git a/tempest/services/compute/xml/services_client.py b/tempest/services/compute/xml/services_client.py
index bfc824d..c28dc12 100644
--- a/tempest/services/compute/xml/services_client.py
+++ b/tempest/services/compute/xml/services_client.py
@@ -29,9 +29,8 @@
 
 class ServicesClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(ServicesClientXML, self).__init__(username, password,
-                                                auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(ServicesClientXML, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def list_services(self, params=None):
diff --git a/tempest/services/compute/xml/tenant_usages_client.py b/tempest/services/compute/xml/tenant_usages_client.py
index ae813a6..93eeb00 100644
--- a/tempest/services/compute/xml/tenant_usages_client.py
+++ b/tempest/services/compute/xml/tenant_usages_client.py
@@ -26,10 +26,8 @@
 
 class TenantUsagesClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(TenantUsagesClientXML, self).__init__(username,
-                                                    password, auth_url,
-                                                    tenant_name)
+    def __init__(self, auth_provider):
+        super(TenantUsagesClientXML, self).__init__(auth_provider)
         self.service = CONF.compute.catalog_type
 
     def _parse_array(self, node):
diff --git a/tempest/services/compute/xml/volumes_extensions_client.py b/tempest/services/compute/xml/volumes_extensions_client.py
index d6723e1..941cd69 100644
--- a/tempest/services/compute/xml/volumes_extensions_client.py
+++ b/tempest/services/compute/xml/volumes_extensions_client.py
@@ -32,9 +32,9 @@
 
 class VolumesExtensionsClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(VolumesExtensionsClientXML, self).__init__(username, password,
-                                                         auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(VolumesExtensionsClientXML, self).__init__(
+            auth_provider)
         self.service = CONF.compute.catalog_type
         self.build_interval = CONF.compute.build_interval
         self.build_timeout = CONF.compute.build_timeout
diff --git a/tempest/services/data_processing/v1_1/client.py b/tempest/services/data_processing/v1_1/client.py
index a1d558a..e96b44b 100644
--- a/tempest/services/data_processing/v1_1/client.py
+++ b/tempest/services/data_processing/v1_1/client.py
@@ -22,9 +22,8 @@
 
 
 class DataProcessingClient(rest_client.RestClient):
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(DataProcessingClient, self).__init__(username, password,
-                                                   auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(DataProcessingClient, self).__init__(auth_provider)
         self.service = CONF.data_processing.catalog_type
 
     @classmethod
@@ -78,3 +77,17 @@
 
         uri = "node-group-templates/%s" % tmpl_id
         return self.delete(uri)
+
+    def list_plugins(self):
+        """List all enabled plugins."""
+
+        uri = 'plugins'
+        return self._request_and_parse(self.get, uri, 'plugins')
+
+    def get_plugin(self, plugin_name, plugin_version=None):
+        """Returns the details of a single plugin."""
+
+        uri = "plugins/%s" % plugin_name
+        if plugin_version:
+            uri += '/%s' % plugin_version
+        return self._request_and_parse(self.get, uri, 'plugin')
diff --git a/tempest/services/identity/json/identity_client.py b/tempest/services/identity/json/identity_client.py
index 1ed7044..349a9e9 100644
--- a/tempest/services/identity/json/identity_client.py
+++ b/tempest/services/identity/json/identity_client.py
@@ -12,22 +12,23 @@
 
 import json
 
-from tempest.common import http
-from tempest.common.rest_client import RestClient
+from tempest.common import rest_client
 from tempest import config
 from tempest import exceptions
 
 CONF = config.CONF
 
 
-class IdentityClientJSON(RestClient):
+class IdentityClientJSON(rest_client.RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(IdentityClientJSON, self).__init__(username, password,
-                                                 auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(IdentityClientJSON, self).__init__(auth_provider)
         self.service = CONF.identity.catalog_type
         self.endpoint_url = 'adminURL'
 
+        # Needed for xml service client
+        self.list_tags = ["roles", "tenants", "users", "services"]
+
     def has_admin_extensions(self):
         """
         Returns True if the KSADM Admin Extensions are supported
@@ -45,9 +46,8 @@
             'name': name,
         }
         post_body = json.dumps({'role': post_body})
-        resp, body = self.post('OS-KSADM/roles', post_body, self.headers)
-        body = json.loads(body)
-        return resp, body['role']
+        resp, body = self.post('OS-KSADM/roles', post_body)
+        return resp, self._parse_resp(body)
 
     def create_tenant(self, name, **kwargs):
         """
@@ -62,30 +62,24 @@
             'enabled': kwargs.get('enabled', True),
         }
         post_body = json.dumps({'tenant': post_body})
-        resp, body = self.post('tenants', post_body, self.headers)
-        body = json.loads(body)
-        return resp, body['tenant']
+        resp, body = self.post('tenants', post_body)
+        return resp, self._parse_resp(body)
 
     def delete_role(self, role_id):
         """Delete a role."""
-        resp, body = self.delete('OS-KSADM/roles/%s' % str(role_id))
-        return resp, body
+        return self.delete('OS-KSADM/roles/%s' % str(role_id))
 
     def list_user_roles(self, tenant_id, user_id):
         """Returns a list of roles assigned to a user for a tenant."""
         url = '/tenants/%s/users/%s/roles' % (tenant_id, user_id)
         resp, body = self.get(url)
-        body = json.loads(body)
-        return resp, body['roles']
+        return resp, self._parse_resp(body)
 
     def assign_user_role(self, tenant_id, user_id, role_id):
         """Add roles to a user on a tenant."""
-        post_body = json.dumps({})
         resp, body = self.put('/tenants/%s/users/%s/roles/OS-KSADM/%s' %
-                              (tenant_id, user_id, role_id), post_body,
-                              self.headers)
-        body = json.loads(body)
-        return resp, body['role']
+                              (tenant_id, user_id, role_id), "")
+        return resp, self._parse_resp(body)
 
     def remove_user_role(self, tenant_id, user_id, role_id):
         """Removes a role assignment for a user on a tenant."""
@@ -94,20 +88,17 @@
 
     def delete_tenant(self, tenant_id):
         """Delete a tenant."""
-        resp, body = self.delete('tenants/%s' % str(tenant_id))
-        return resp, body
+        return self.delete('tenants/%s' % str(tenant_id))
 
     def get_tenant(self, tenant_id):
         """Get tenant details."""
         resp, body = self.get('tenants/%s' % str(tenant_id))
-        body = json.loads(body)
-        return resp, body['tenant']
+        return resp, self._parse_resp(body)
 
     def list_roles(self):
         """Returns roles."""
         resp, body = self.get('OS-KSADM/roles')
-        body = json.loads(body)
-        return resp, body['roles']
+        return resp, self._parse_resp(body)
 
     def list_tenants(self):
         """Returns tenants."""
@@ -135,10 +126,8 @@
             'enabled': en,
         }
         post_body = json.dumps({'tenant': post_body})
-        resp, body = self.post('tenants/%s' % tenant_id, post_body,
-                               self.headers)
-        body = json.loads(body)
-        return resp, body['tenant']
+        resp, body = self.post('tenants/%s' % tenant_id, post_body)
+        return resp, self._parse_resp(body)
 
     def create_user(self, name, password, tenant_id, email, **kwargs):
         """Create a user."""
@@ -151,34 +140,28 @@
         if kwargs.get('enabled') is not None:
             post_body['enabled'] = kwargs.get('enabled')
         post_body = json.dumps({'user': post_body})
-        resp, body = self.post('users', post_body, self.headers)
-        body = json.loads(body)
-        return resp, body['user']
+        resp, body = self.post('users', post_body)
+        return resp, self._parse_resp(body)
 
     def update_user(self, user_id, **kwargs):
         """Updates a user."""
         put_body = json.dumps({'user': kwargs})
-        resp, body = self.put('users/%s' % user_id, put_body,
-                              self.headers)
-        body = json.loads(body)
-        return resp, body['user']
+        resp, body = self.put('users/%s' % user_id, put_body)
+        return resp, self._parse_resp(body)
 
     def get_user(self, user_id):
         """GET a user."""
         resp, body = self.get("users/%s" % user_id)
-        body = json.loads(body)
-        return resp, body['user']
+        return resp, self._parse_resp(body)
 
     def delete_user(self, user_id):
         """Delete a user."""
-        resp, body = self.delete("users/%s" % user_id)
-        return resp, body
+        return self.delete("users/%s" % user_id)
 
     def get_users(self):
         """Get the list of users."""
         resp, body = self.get("users")
-        body = json.loads(body)
-        return resp, body['users']
+        return resp, self._parse_resp(body)
 
     def enable_disable_user(self, user_id, enabled):
         """Enables or disables a user."""
@@ -186,21 +169,17 @@
             'enabled': enabled
         }
         put_body = json.dumps({'user': put_body})
-        resp, body = self.put('users/%s/enabled' % user_id,
-                              put_body, self.headers)
-        body = json.loads(body)
-        return resp, body
+        resp, body = self.put('users/%s/enabled' % user_id, put_body)
+        return resp, self._parse_resp(body)
 
     def delete_token(self, token_id):
         """Delete a token."""
-        resp, body = self.delete("tokens/%s" % token_id)
-        return resp, body
+        return self.delete("tokens/%s" % token_id)
 
     def list_users_for_tenant(self, tenant_id):
         """List users for a Tenant."""
         resp, body = self.get('/tenants/%s/users' % tenant_id)
-        body = json.loads(body)
-        return resp, body['users']
+        return resp, self._parse_resp(body)
 
     def get_user_by_username(self, tenant_id, username):
         resp, users = self.list_users_for_tenant(tenant_id)
@@ -217,22 +196,19 @@
             'description': kwargs.get('description')
         }
         post_body = json.dumps({'OS-KSADM:service': post_body})
-        resp, body = self.post('/OS-KSADM/services', post_body, self.headers)
-        body = json.loads(body)
-        return resp, body['OS-KSADM:service']
+        resp, body = self.post('/OS-KSADM/services', post_body)
+        return resp, self._parse_resp(body)
 
     def get_service(self, service_id):
         """Get Service."""
         url = '/OS-KSADM/services/%s' % service_id
         resp, body = self.get(url)
-        body = json.loads(body)
-        return resp, body['OS-KSADM:service']
+        return resp, self._parse_resp(body)
 
     def list_services(self):
         """List Service - Returns Services."""
         resp, body = self.get('/OS-KSADM/services/')
-        body = json.loads(body)
-        return resp, body['OS-KSADM:services']
+        return resp, self._parse_resp(body)
 
     def delete_service(self, service_id):
         """Delete Service."""
@@ -240,12 +216,12 @@
         return self.delete(url)
 
 
-class TokenClientJSON(RestClient):
+class TokenClientJSON(IdentityClientJSON):
 
     def __init__(self):
+        super(TokenClientJSON, self).__init__(None)
         auth_url = CONF.identity.uri
 
-        # TODO(jaypipes) Why is this all repeated code in here?
         # Normalize URI to ensure /tokens is in it.
         if 'tokens' not in auth_url:
             auth_url = auth_url.rstrip('/') + '/tokens'
@@ -262,34 +238,41 @@
                 'tenantName': tenant,
             }
         }
-        headers = {'Content-Type': 'application/json'}
         body = json.dumps(creds)
-        resp, body = self.post(self.auth_url, headers=headers, body=body)
-        return resp, body
+        resp, body = self.post(self.auth_url, body=body)
+
+        return resp, body['access']
 
     def request(self, method, url, headers=None, body=None):
         """A simple HTTP request interface."""
-        dscv = CONF.identity.disable_ssl_certificate_validation
-        self.http_obj = http.ClosingHttp(
-            disable_ssl_certificate_validation=dscv)
         if headers is None:
-            headers = {}
-
+            # Always accept 'json', for TokenClientXML too.
+            # Because XML response is not easily
+            # converted to the corresponding JSON one
+            headers = self.get_headers(accept_type="json")
         self._log_request(method, url, headers, body)
         resp, resp_body = self.http_obj.request(url, method,
                                                 headers=headers, body=body)
         self._log_response(resp, resp_body)
 
-        if resp.status in (401, 403):
+        if resp.status in [401, 403]:
             resp_body = json.loads(resp_body)
             raise exceptions.Unauthorized(resp_body['error']['message'])
+        elif resp.status not in [200, 201]:
+            raise exceptions.IdentityError(
+                'Unexpected status code {0}'.format(resp.status))
 
+        if isinstance(resp_body, str):
+            resp_body = json.loads(resp_body)
         return resp, resp_body
 
-    def get_token(self, user, password, tenant):
+    def get_token(self, user, password, tenant, auth_data=False):
+        """
+        Returns (token id, token data) for supplied credentials
+        """
         resp, body = self.auth(user, password, tenant)
-        if resp['status'] != '202':
-            body = json.loads(body)
-            access = body['access']
-            token = access['token']
-            return token['id']
+
+        if auth_data:
+            return body['token']['id'], body
+        else:
+            return body['token']['id']
diff --git a/tempest/services/identity/v3/json/credentials_client.py b/tempest/services/identity/v3/json/credentials_client.py
index 1250d79..a0fbb76 100644
--- a/tempest/services/identity/v3/json/credentials_client.py
+++ b/tempest/services/identity/v3/json/credentials_client.py
@@ -14,7 +14,6 @@
 #    under the License.
 
 import json
-from urlparse import urlparse
 
 from tempest.common.rest_client import RestClient
 from tempest import config
@@ -24,20 +23,11 @@
 
 class CredentialsClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(CredentialsClientJSON, self).__init__(username, password,
-                                                    auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(CredentialsClientJSON, self).__init__(auth_provider)
         self.service = CONF.identity.catalog_type
         self.endpoint_url = 'adminURL'
-
-    def request(self, method, url, headers=None, body=None, wait=None):
-        """Overriding the existing HTTP request in super class rest_client."""
-        self._set_auth()
-        self.base_url = self.base_url.replace(urlparse(self.base_url).path,
-                                              "/v3")
-        return super(CredentialsClientJSON, self).request(method, url,
-                                                          headers=headers,
-                                                          body=body)
+        self.api_version = "v3"
 
     def create_credential(self, access_key, secret_key, user_id, project_id):
         """Creates a credential."""
diff --git a/tempest/services/identity/v3/json/endpoints_client.py b/tempest/services/identity/v3/json/endpoints_client.py
index bb2230b..1b78115 100644
--- a/tempest/services/identity/v3/json/endpoints_client.py
+++ b/tempest/services/identity/v3/json/endpoints_client.py
@@ -14,7 +14,6 @@
 #    under the License.
 
 import json
-import urlparse
 
 from tempest.common.rest_client import RestClient
 from tempest import config
@@ -24,20 +23,11 @@
 
 class EndPointClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(EndPointClientJSON, self).__init__(username, password,
-                                                 auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(EndPointClientJSON, self).__init__(auth_provider)
         self.service = CONF.identity.catalog_type
         self.endpoint_url = 'adminURL'
-
-    def request(self, method, url, headers=None, body=None, wait=None):
-        """Overriding the existing HTTP request in super class rest_client."""
-        self._set_auth()
-        self.base_url = self.base_url.replace(
-            urlparse.urlparse(self.base_url).path, "/v3")
-        return super(EndPointClientJSON, self).request(method, url,
-                                                       headers=headers,
-                                                       body=body)
+        self.api_version = "v3"
 
     def list_endpoints(self):
         """GET endpoints."""
diff --git a/tempest/services/identity/v3/json/identity_client.py b/tempest/services/identity/v3/json/identity_client.py
index 7dd5c6e..ab1dc94 100644
--- a/tempest/services/identity/v3/json/identity_client.py
+++ b/tempest/services/identity/v3/json/identity_client.py
@@ -14,30 +14,22 @@
 #    under the License.
 
 import json
-from urlparse import urlparse
+import urlparse
 
 from tempest.common.rest_client import RestClient
 from tempest import config
+from tempest import exceptions
 
 CONF = config.CONF
 
 
 class IdentityV3ClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(IdentityV3ClientJSON, self).__init__(username, password,
-                                                   auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(IdentityV3ClientJSON, self).__init__(auth_provider)
         self.service = CONF.identity.catalog_type
         self.endpoint_url = 'adminURL'
-
-    def request(self, method, url, headers=None, body=None, wait=None):
-        """Overriding the existing HTTP request in super class rest_client."""
-        self._set_auth()
-        self.base_url = self.base_url.replace(urlparse(self.base_url).path,
-                                              "/v3")
-        return super(IdentityV3ClientJSON, self).request(method, url,
-                                                         headers=headers,
-                                                         body=body)
+        self.api_version = "v3"
 
     def create_user(self, user_name, **kwargs):
         """Creates a user."""
@@ -462,43 +454,89 @@
 
 class V3TokenClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(V3TokenClientJSON, self).__init__(username, password,
-                                                auth_url, tenant_name)
-        self.service = CONF.identity.catalog_type
-        self.endpoint_url = 'adminURL'
+    def __init__(self):
+        super(V3TokenClientJSON, self).__init__(None)
+        auth_url = CONF.identity.uri_v3
+        # If the v3 url is not set, get it from the v2 one
+        if auth_url is None:
+            auth_url = CONF.identity.uri.replace(urlparse.urlparse(
+                CONF.identity.uri).path, "/v3")
 
-        auth_url = CONF.identity.uri
-
-        if 'tokens' not in auth_url:
-            auth_url = auth_url.rstrip('/') + '/tokens'
+        if 'auth/tokens' not in auth_url:
+            auth_url = auth_url.rstrip('/') + '/auth/tokens'
 
         self.auth_url = auth_url
 
-    def auth(self, user_id, password):
+    def auth(self, user, password, tenant=None, user_type='id', domain=None):
+        """
+        :param user: user id or name, as specified in user_type
+        :param domain: the user and tenant domain
+
+        Accepts different combinations of credentials. Restrictions:
+        - tenant and domain are only name (no id)
+        - user domain and tenant domain are assumed identical
+        - domain scope is not supported here
+        Sample sample valid combinations:
+        - user_id, password
+        - username, password, domain
+        - username, password, tenant, domain
+        Validation is left to the server side.
+        """
         creds = {
             'auth': {
                 'identity': {
                     'methods': ['password'],
                     'password': {
                         'user': {
-                            'id': user_id,
-                            'password': password
+                            'password': password,
                         }
                     }
                 }
             }
         }
-        headers = {'Content-Type': 'application/json'}
+        if user_type == 'id':
+            creds['auth']['identity']['password']['user']['id'] = user
+        else:
+            creds['auth']['identity']['password']['user']['name'] = user
+        if domain is not None:
+            _domain = dict(name=domain)
+            creds['auth']['identity']['password']['user']['domain'] = _domain
+        if tenant is not None:
+            project = dict(name=tenant, domain=_domain)
+            scope = dict(project=project)
+            creds['auth']['scope'] = scope
+
         body = json.dumps(creds)
-        resp, body = self.post("auth/tokens", headers=headers, body=body)
+        resp, body = self.post(self.auth_url, headers=self.headers, body=body)
         return resp, body
 
-    def request(self, method, url, headers=None, body=None, wait=None):
-        """Overriding the existing HTTP request in super class rest_client."""
-        self._set_auth()
-        self.base_url = self.base_url.replace(urlparse(self.base_url).path,
-                                              "/v3")
-        return super(V3TokenClientJSON, self).request(method, url,
-                                                      headers=headers,
-                                                      body=body)
+    def request(self, method, url, headers=None, body=None):
+        """A simple HTTP request interface."""
+        self._log_request(method, url, headers, body)
+        resp, resp_body = self.http_obj.request(url, method,
+                                                headers=headers, body=body)
+        self._log_response(resp, resp_body)
+
+        if resp.status in [401, 403]:
+            resp_body = json.loads(resp_body)
+            raise exceptions.Unauthorized(resp_body['error']['message'])
+        elif resp.status not in [200, 201, 204]:
+            raise exceptions.IdentityError(
+                'Unexpected status code {0}'.format(resp.status))
+
+        return resp, json.loads(resp_body)
+
+    def get_token(self, user, password, tenant, domain='Default',
+                  auth_data=False):
+        """
+        :param user: username
+        Returns (token id, token data) for supplied credentials
+        """
+        resp, body = self.auth(user, password, tenant, user_type='name',
+                               domain=domain)
+
+        token = resp.get('x-subject-token')
+        if auth_data:
+            return token, body['token']
+        else:
+            return token
diff --git a/tempest/services/identity/v3/json/policy_client.py b/tempest/services/identity/v3/json/policy_client.py
index 3d98d99..c376979 100644
--- a/tempest/services/identity/v3/json/policy_client.py
+++ b/tempest/services/identity/v3/json/policy_client.py
@@ -14,7 +14,6 @@
 #    under the License.
 
 import json
-from urlparse import urlparse
 
 from tempest.common.rest_client import RestClient
 from tempest import config
@@ -24,20 +23,11 @@
 
 class PolicyClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(PolicyClientJSON, self).__init__(username, password,
-                                               auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(PolicyClientJSON, self).__init__(auth_provider)
         self.service = CONF.identity.catalog_type
         self.endpoint_url = 'adminURL'
-
-    def request(self, method, url, headers=None, body=None, wait=None):
-        """Overriding the existing HTTP request in super class rest_client."""
-        self._set_auth()
-        self.base_url = self.base_url.replace(urlparse(self.base_url).path,
-                                              "/v3")
-        return super(PolicyClientJSON, self).request(method, url,
-                                                     headers=headers,
-                                                     body=body)
+        self.api_version = "v3"
 
     def create_policy(self, blob, type):
         """Creates a Policy."""
diff --git a/tempest/services/identity/v3/json/service_client.py b/tempest/services/identity/v3/json/service_client.py
index 57b6e9e..92f7629 100644
--- a/tempest/services/identity/v3/json/service_client.py
+++ b/tempest/services/identity/v3/json/service_client.py
@@ -14,7 +14,6 @@
 #    under the License.
 
 import json
-from urlparse import urlparse
 
 from tempest.common.rest_client import RestClient
 from tempest import config
@@ -24,20 +23,11 @@
 
 class ServiceClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(ServiceClientJSON, self).__init__(username, password,
-                                                auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(ServiceClientJSON, self).__init__(auth_provider)
         self.service = CONF.identity.catalog_type
         self.endpoint_url = 'adminURL'
-
-    def request(self, method, url, headers=None, body=None, wait=None):
-        """Overriding the existing HTTP request in super class rest_client."""
-        self._set_auth()
-        self.base_url = self.base_url.replace(urlparse(self.base_url).path,
-                                              "/v3")
-        return super(ServiceClientJSON, self).request(method, url,
-                                                      headers=headers,
-                                                      body=body)
+        self.api_version = "v3"
 
     def update_service(self, service_id, **kwargs):
         """Updates a service."""
diff --git a/tempest/services/identity/v3/xml/credentials_client.py b/tempest/services/identity/v3/xml/credentials_client.py
index c8cdce7..eca86ab 100644
--- a/tempest/services/identity/v3/xml/credentials_client.py
+++ b/tempest/services/identity/v3/xml/credentials_client.py
@@ -14,7 +14,6 @@
 #    under the License.
 
 import json
-from urlparse import urlparse
 
 from lxml import etree
 
@@ -32,20 +31,11 @@
 
 class CredentialsClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(CredentialsClientXML, self).__init__(username, password,
-                                                   auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(CredentialsClientXML, self).__init__(auth_provider)
         self.service = CONF.identity.catalog_type
         self.endpoint_url = 'adminURL'
-
-    def request(self, method, url, headers=None, body=None, wait=None):
-        """Overriding the existing HTTP request in super class rest_client."""
-        self._set_auth()
-        self.base_url = self.base_url.replace(urlparse(self.base_url).path,
-                                              "/v3")
-        return super(CredentialsClientXML, self).request(method, url,
-                                                         headers=headers,
-                                                         body=body)
+        self.api_version = "v3"
 
     def _parse_body(self, body):
         data = xml_to_json(body)
diff --git a/tempest/services/identity/v3/xml/endpoints_client.py b/tempest/services/identity/v3/xml/endpoints_client.py
index e1df3a9..a20a9f5 100644
--- a/tempest/services/identity/v3/xml/endpoints_client.py
+++ b/tempest/services/identity/v3/xml/endpoints_client.py
@@ -12,7 +12,6 @@
 #    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 #    License for the specific language governing permissions and limitations
 #    under the License.
-import urlparse
 
 from lxml import etree
 
@@ -30,11 +29,11 @@
 
 class EndPointClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(EndPointClientXML, self).__init__(username, password,
-                                                auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(EndPointClientXML, self).__init__(auth_provider)
         self.service = CONF.identity.catalog_type
         self.endpoint_url = 'adminURL'
+        self.api_version = "v3"
 
     def _parse_array(self, node):
         array = []
@@ -53,9 +52,6 @@
         dscv = CONF.identity.disable_ssl_certificate_validation
         self.http_obj = http.ClosingHttp(
             disable_ssl_certificate_validation=dscv)
-        self._set_auth()
-        self.base_url = self.base_url.replace(
-            urlparse.urlparse(self.base_url).path, "/v3")
         return super(EndPointClientXML, self).request(method, url,
                                                       headers=headers,
                                                       body=body)
diff --git a/tempest/services/identity/v3/xml/identity_client.py b/tempest/services/identity/v3/xml/identity_client.py
index de75fe5..e7b85c1 100644
--- a/tempest/services/identity/v3/xml/identity_client.py
+++ b/tempest/services/identity/v3/xml/identity_client.py
@@ -13,12 +13,14 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-from urlparse import urlparse
+import json
+import urlparse
 
 from lxml import etree
 
 from tempest.common.rest_client import RestClientXML
 from tempest import config
+from tempest import exceptions
 from tempest.services.compute.xml.common import Document
 from tempest.services.compute.xml.common import Element
 from tempest.services.compute.xml.common import Text
@@ -31,11 +33,11 @@
 
 class IdentityV3ClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(IdentityV3ClientXML, self).__init__(username, password,
-                                                  auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(IdentityV3ClientXML, self).__init__(auth_provider)
         self.service = CONF.identity.catalog_type
         self.endpoint_url = 'adminURL'
+        self.api_version = "v3"
 
     def _parse_projects(self, node):
         array = []
@@ -76,17 +78,8 @@
         return array
 
     def _parse_body(self, body):
-        json = xml_to_json(body)
-        return json
-
-    def request(self, method, url, headers=None, body=None, wait=None):
-        """Overriding the existing HTTP request in super class RestClient."""
-        self._set_auth()
-        self.base_url = self.base_url.replace(urlparse(self.base_url).path,
-                                              "/v3")
-        return super(IdentityV3ClientXML, self).request(method, url,
-                                                        headers=headers,
-                                                        body=body)
+        _json = xml_to_json(body)
+        return _json
 
     def create_user(self, user_name, **kwargs):
         """Creates a user."""
@@ -454,25 +447,41 @@
 
 class V3TokenClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(V3TokenClientXML, self).__init__(username, password,
-                                               auth_url, tenant_name)
-        self.service = CONF.identity.catalog_type
-        self.endpoint_url = 'adminURL'
-
-        auth_url = CONF.identity.uri
-
-        if 'tokens' not in auth_url:
-            auth_url = auth_url.rstrip('/') + '/tokens'
+    def __init__(self):
+        super(V3TokenClientXML, self).__init__(None)
+        auth_url = CONF.identity.uri_v3
+        # If the v3 url is not set, get it from the v2 one
+        if auth_url is None:
+            auth_url = CONF.identity.uri.replace(urlparse.urlparse(
+                CONF.identity.uri).path, "/v3")
+        if 'auth/tokens' not in auth_url:
+            auth_url = auth_url.rstrip('/') + '/auth/tokens'
 
         self.auth_url = auth_url
 
-    def auth(self, user_id, password):
-        user = Element('user',
-                       id=user_id,
-                       password=password)
+    def auth(self, user, password, tenant=None, user_type='id', domain=None):
+        """
+        :param user: user id or name, as specified in user_type
+
+        Accepts different combinations of credentials. Restrictions:
+        - tenant and domain are only name (no id)
+        - user domain and tenant domain are assumed identical
+        Sample sample valid combinations:
+        - user_id, password
+        - username, password, domain
+        - username, password, tenant, domain
+        Validation is left to the server side.
+        """
+        if user_type == 'id':
+            _user = Element('user', id=user, password=password)
+        else:
+            _user = Element('user', name=user, password=password)
+        if domain is not None:
+            _domain = Element('domain', name=domain)
+            _user.append(_domain)
+
         password = Element('password')
-        password.append(user)
+        password.append(_user)
 
         method = Element('method')
         method.append(Text('password'))
@@ -481,18 +490,51 @@
         identity = Element('identity')
         identity.append(methods)
         identity.append(password)
+
         auth = Element('auth')
         auth.append(identity)
-        headers = {'Content-Type': 'application/xml'}
-        resp, body = self.post("auth/tokens", headers=headers,
+
+        if tenant is not None:
+            project = Element('project', name=tenant)
+            project.append(_domain)
+            scope = Element('scope')
+            scope.append(project)
+            auth.append(scope)
+
+        resp, body = self.post(self.auth_url, headers=self.headers,
                                body=str(Document(auth)))
         return resp, body
 
-    def request(self, method, url, headers=None, body=None, wait=None):
-        """Overriding the existing HTTP request in super class rest_client."""
-        self._set_auth()
-        self.base_url = self.base_url.replace(urlparse(self.base_url).path,
-                                              "/v3")
-        return super(V3TokenClientXML, self).request(method, url,
-                                                     headers=headers,
-                                                     body=body)
+    def request(self, method, url, headers=None, body=None):
+        """A simple HTTP request interface."""
+        # Send XML, accept JSON. XML response is not easily
+        # converted to the corresponding JSON one
+        headers['Accept'] = 'application/json'
+        self._log_request(method, url, headers, body)
+        resp, resp_body = self.http_obj.request(url, method,
+                                                headers=headers, body=body)
+        self._log_response(resp, resp_body)
+
+        if resp.status in [401, 403]:
+            resp_body = json.loads(resp_body)
+            raise exceptions.Unauthorized(resp_body['error']['message'])
+        elif resp.status not in [200, 201, 204]:
+            raise exceptions.IdentityError(
+                'Unexpected status code {0}'.format(resp.status))
+
+        return resp, json.loads(resp_body)
+
+    def get_token(self, user, password, tenant, domain='Default',
+                  auth_data=False):
+        """
+        :param user: username
+        Returns (token id, token data) for supplied credentials
+        """
+        resp, body = self.auth(user, password, tenant, user_type='name',
+                               domain=domain)
+
+        token = resp.get('x-subject-token')
+        if auth_data:
+            return token, body['token']
+        else:
+            return token
diff --git a/tempest/services/identity/v3/xml/policy_client.py b/tempest/services/identity/v3/xml/policy_client.py
index 54b4ad8..429c6a4 100644
--- a/tempest/services/identity/v3/xml/policy_client.py
+++ b/tempest/services/identity/v3/xml/policy_client.py
@@ -13,8 +13,6 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-from urlparse import urlparse
-
 from lxml import etree
 
 from tempest.common import http
@@ -31,11 +29,11 @@
 
 class PolicyClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(PolicyClientXML, self).__init__(username, password,
-                                              auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(PolicyClientXML, self).__init__(auth_provider)
         self.service = CONF.identity.catalog_type
         self.endpoint_url = 'adminURL'
+        self.api_version = "v3"
 
     def _parse_array(self, node):
         array = []
@@ -54,9 +52,6 @@
         dscv = CONF.identity.disable_ssl_certificate_validation
         self.http_obj = http.ClosingHttp(
             disable_ssl_certificate_validation=dscv)
-        self._set_auth()
-        self.base_url = self.base_url.replace(urlparse(self.base_url).path,
-                                              "/v3")
         return super(PolicyClientXML, self).request(method, url,
                                                     headers=headers,
                                                     body=body)
diff --git a/tempest/services/identity/v3/xml/service_client.py b/tempest/services/identity/v3/xml/service_client.py
index 2997775..df9b234 100644
--- a/tempest/services/identity/v3/xml/service_client.py
+++ b/tempest/services/identity/v3/xml/service_client.py
@@ -13,8 +13,6 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-from urlparse import urlparse
-
 from lxml import etree
 
 from tempest.common.rest_client import RestClientXML
@@ -30,11 +28,11 @@
 
 class ServiceClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(ServiceClientXML, self).__init__(username, password,
-                                               auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(ServiceClientXML, self).__init__(auth_provider)
         self.service = CONF.identity.catalog_type
         self.endpoint_url = 'adminURL'
+        self.api_version = "v3"
 
     def _parse_array(self, node):
         array = []
@@ -46,15 +44,6 @@
         data = xml_to_json(body)
         return data
 
-    def request(self, method, url, headers=None, body=None, wait=None):
-        """Overriding the existing HTTP request in super class rest_client."""
-        self._set_auth()
-        self.base_url = self.base_url.replace(urlparse(self.base_url).path,
-                                              "/v3")
-        return super(ServiceClientXML, self).request(method, url,
-                                                     headers=headers,
-                                                     body=body)
-
     def update_service(self, service_id, **kwargs):
         """Updates a service_id."""
         resp, body = self.get_service(service_id)
diff --git a/tempest/services/identity/xml/identity_client.py b/tempest/services/identity/xml/identity_client.py
index e6a7188..81846da 100644
--- a/tempest/services/identity/xml/identity_client.py
+++ b/tempest/services/identity/xml/identity_client.py
@@ -12,60 +12,24 @@
 #    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
 #    License for the specific language governing permissions and limitations
 #    under the License.
-
-import json
-
-from lxml import etree
-
-from tempest.common import http
-from tempest.common.rest_client import RestClientXML
 from tempest import config
-from tempest import exceptions
-from tempest.services.compute.xml.common import Document
-from tempest.services.compute.xml.common import Element
-from tempest.services.compute.xml.common import xml_to_json
+from tempest.services.compute.xml import common as xml
+from tempest.services.identity.json import identity_client
 
 CONF = config.CONF
 
 XMLNS = "http://docs.openstack.org/identity/api/v2.0"
 
 
-class IdentityClientXML(RestClientXML):
-
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(IdentityClientXML, self).__init__(username, password,
-                                                auth_url, tenant_name)
-        self.service = CONF.identity.catalog_type
-        self.endpoint_url = 'adminURL'
-
-    def _parse_array(self, node):
-        array = []
-        for child in node.getchildren():
-            array.append(xml_to_json(child))
-        return array
-
-    def _parse_body(self, body):
-        data = xml_to_json(body)
-        return data
-
-    def has_admin_extensions(self):
-        """
-        Returns True if the KSADM Admin Extensions are supported
-        False otherwise
-        """
-        if hasattr(self, '_has_admin_extensions'):
-            return self._has_admin_extensions
-        resp, body = self.list_roles()
-        self._has_admin_extensions = ('status' in resp and resp.status != 503)
-        return self._has_admin_extensions
+class IdentityClientXML(identity_client.IdentityClientJSON):
+    TYPE = "xml"
 
     def create_role(self, name):
         """Create a role."""
-        create_role = Element("role", xmlns=XMLNS, name=name)
-        resp, body = self.post('OS-KSADM/roles', str(Document(create_role)),
-                               self.headers)
-        body = self._parse_body(etree.fromstring(body))
-        return resp, body
+        create_role = xml.Element("role", xmlns=XMLNS, name=name)
+        resp, body = self.post('OS-KSADM/roles',
+                               str(xml.Document(create_role)))
+        return resp, self._parse_resp(body)
 
     def create_tenant(self, name, **kwargs):
         """
@@ -75,70 +39,18 @@
         enabled <true|false>: Initial tenant status (default is true)
         """
         en = kwargs.get('enabled', 'true')
-        create_tenant = Element("tenant",
-                                xmlns=XMLNS,
-                                name=name,
-                                description=kwargs.get('description', ''),
-                                enabled=str(en).lower())
-        resp, body = self.post('tenants', str(Document(create_tenant)),
-                               self.headers)
-        body = self._parse_body(etree.fromstring(body))
-        return resp, body
-
-    def delete_role(self, role_id):
-        """Delete a role."""
-        resp, body = self.delete('OS-KSADM/roles/%s' % str(role_id),
-                                 self.headers)
-        return resp, body
-
-    def list_user_roles(self, tenant_id, user_id):
-        """Returns a list of roles assigned to a user for a tenant."""
-        url = '/tenants/%s/users/%s/roles' % (tenant_id, user_id)
-        resp, body = self.get(url, self.headers)
-        body = self._parse_array(etree.fromstring(body))
-        return resp, body
-
-    def assign_user_role(self, tenant_id, user_id, role_id):
-        """Add roles to a user on a tenant."""
-        resp, body = self.put('/tenants/%s/users/%s/roles/OS-KSADM/%s' %
-                              (tenant_id, user_id, role_id), '', self.headers)
-        body = self._parse_body(etree.fromstring(body))
-        return resp, body
-
-    def remove_user_role(self, tenant_id, user_id, role_id):
-        """Removes a role assignment for a user on a tenant."""
-        return self.delete('/tenants/%s/users/%s/roles/OS-KSADM/%s' %
-                           (tenant_id, user_id, role_id), self.headers)
-
-    def delete_tenant(self, tenant_id):
-        """Delete a tenant."""
-        resp, body = self.delete('tenants/%s' % str(tenant_id), self.headers)
-        return resp, body
-
-    def get_tenant(self, tenant_id):
-        """Get tenant details."""
-        resp, body = self.get('tenants/%s' % str(tenant_id), self.headers)
-        body = self._parse_body(etree.fromstring(body))
-        return resp, body
-
-    def list_roles(self):
-        """Returns roles."""
-        resp, body = self.get('OS-KSADM/roles', self.headers)
-        body = self._parse_array(etree.fromstring(body))
-        return resp, body
+        create_tenant = xml.Element("tenant",
+                                    xmlns=XMLNS,
+                                    name=name,
+                                    description=kwargs.get('description', ''),
+                                    enabled=str(en).lower())
+        resp, body = self.post('tenants', str(xml.Document(create_tenant)))
+        return resp, self._parse_resp(body)
 
     def list_tenants(self):
         """Returns tenants."""
-        resp, body = self.get('tenants', self.headers)
-        body = self._parse_array(etree.fromstring(body))
-        return resp, body
-
-    def get_tenant_by_name(self, tenant_name):
-        resp, tenants = self.list_tenants()
-        for tenant in tenants:
-            if tenant['name'] == tenant_name:
-                return tenant
-        raise exceptions.NotFound('No such tenant')
+        resp, body = self.get('tenants')
+        return resp, self._parse_resp(body)
 
     def update_tenant(self, tenant_id, **kwargs):
         """Updates a tenant."""
@@ -146,168 +58,69 @@
         name = kwargs.get('name', body['name'])
         desc = kwargs.get('description', body['description'])
         en = kwargs.get('enabled', body['enabled'])
-        update_tenant = Element("tenant",
-                                xmlns=XMLNS,
-                                id=tenant_id,
-                                name=name,
-                                description=desc,
-                                enabled=str(en).lower())
+        update_tenant = xml.Element("tenant",
+                                    xmlns=XMLNS,
+                                    id=tenant_id,
+                                    name=name,
+                                    description=desc,
+                                    enabled=str(en).lower())
 
         resp, body = self.post('tenants/%s' % tenant_id,
-                               str(Document(update_tenant)),
-                               self.headers)
-        body = self._parse_body(etree.fromstring(body))
-        return resp, body
+                               str(xml.Document(update_tenant)))
+        return resp, self._parse_resp(body)
 
     def create_user(self, name, password, tenant_id, email, **kwargs):
         """Create a user."""
-        create_user = Element("user",
-                              xmlns=XMLNS,
-                              name=name,
-                              password=password,
-                              tenantId=tenant_id,
-                              email=email)
+        create_user = xml.Element("user",
+                                  xmlns=XMLNS,
+                                  name=name,
+                                  password=password,
+                                  tenantId=tenant_id,
+                                  email=email)
         if 'enabled' in kwargs:
             create_user.add_attr('enabled', str(kwargs['enabled']).lower())
 
-        resp, body = self.post('users', str(Document(create_user)),
-                               self.headers)
-        body = self._parse_body(etree.fromstring(body))
-        return resp, body
+        resp, body = self.post('users', str(xml.Document(create_user)))
+        return resp, self._parse_resp(body)
 
     def update_user(self, user_id, **kwargs):
         """Updates a user."""
         if 'enabled' in kwargs:
             kwargs['enabled'] = str(kwargs['enabled']).lower()
-        update_user = Element("user", xmlns=XMLNS, **kwargs)
+        update_user = xml.Element("user", xmlns=XMLNS, **kwargs)
 
         resp, body = self.put('users/%s' % user_id,
-                              str(Document(update_user)),
-                              self.headers)
-        body = self._parse_body(etree.fromstring(body))
-        return resp, body
-
-    def get_user(self, user_id):
-        """GET a user."""
-        resp, body = self.get("users/%s" % user_id, self.headers)
-        body = self._parse_body(etree.fromstring(body))
-        return resp, body
-
-    def delete_user(self, user_id):
-        """Delete a user."""
-        resp, body = self.delete("users/%s" % user_id, self.headers)
-        return resp, body
-
-    def get_users(self):
-        """Get the list of users."""
-        resp, body = self.get("users", self.headers)
-        body = self._parse_array(etree.fromstring(body))
-        return resp, body
+                              str(xml.Document(update_user)))
+        return resp, self._parse_resp(body)
 
     def enable_disable_user(self, user_id, enabled):
         """Enables or disables a user."""
-        enable_user = Element("user", enabled=str(enabled).lower())
+        enable_user = xml.Element("user", enabled=str(enabled).lower())
         resp, body = self.put('users/%s/enabled' % user_id,
-                              str(Document(enable_user)), self.headers)
-        body = self._parse_array(etree.fromstring(body))
-        return resp, body
+                              str(xml.Document(enable_user)), self.headers)
+        return resp, self._parse_resp(body)
 
-    def delete_token(self, token_id):
-        """Delete a token."""
-        resp, body = self.delete("tokens/%s" % token_id, self.headers)
-        return resp, body
-
-    def list_users_for_tenant(self, tenant_id):
-        """List users for a Tenant."""
-        resp, body = self.get('/tenants/%s/users' % tenant_id, self.headers)
-        body = self._parse_array(etree.fromstring(body))
-        return resp, body
-
-    def get_user_by_username(self, tenant_id, username):
-        resp, users = self.list_users_for_tenant(tenant_id)
-        for user in users:
-            if user['name'] == username:
-                return user
-        raise exceptions.NotFound('No such user')
-
-    def create_service(self, name, type, **kwargs):
+    def create_service(self, name, service_type, **kwargs):
         """Create a service."""
         OS_KSADM = "http://docs.openstack.org/identity/api/ext/OS-KSADM/v1.0"
-        create_service = Element("service",
-                                 xmlns=OS_KSADM,
-                                 name=name,
-                                 type=type,
-                                 description=kwargs.get('description'))
+        create_service = xml.Element("service",
+                                     xmlns=OS_KSADM,
+                                     name=name,
+                                     type=service_type,
+                                     description=kwargs.get('description'))
         resp, body = self.post('OS-KSADM/services',
-                               str(Document(create_service)),
-                               self.headers)
-        body = self._parse_body(etree.fromstring(body))
-        return resp, body
-
-    def list_services(self):
-        """Returns services."""
-        resp, body = self.get('OS-KSADM/services', self.headers)
-        body = self._parse_array(etree.fromstring(body))
-        return resp, body
-
-    def get_service(self, service_id):
-        """Get Service."""
-        url = '/OS-KSADM/services/%s' % service_id
-        resp, body = self.get(url, self.headers)
-        body = self._parse_body(etree.fromstring(body))
-        return resp, body
-
-    def delete_service(self, service_id):
-        """Delete Service."""
-        url = '/OS-KSADM/services/%s' % service_id
-        return self.delete(url, self.headers)
+                               str(xml.Document(create_service)))
+        return resp, self._parse_resp(body)
 
 
-class TokenClientXML(RestClientXML):
-
-    def __init__(self):
-        auth_url = CONF.identity.uri
-
-        # TODO(jaypipes) Why is this all repeated code in here?
-        # Normalize URI to ensure /tokens is in it.
-        if 'tokens' not in auth_url:
-            auth_url = auth_url.rstrip('/') + '/tokens'
-
-        self.auth_url = auth_url
+class TokenClientXML(identity_client.TokenClientJSON):
+    TYPE = "xml"
 
     def auth(self, user, password, tenant):
-        passwordCreds = Element("passwordCredentials",
-                                username=user,
-                                password=password)
-        auth = Element("auth", tenantName=tenant)
+        passwordCreds = xml.Element("passwordCredentials",
+                                    username=user,
+                                    password=password)
+        auth = xml.Element("auth", tenantName=tenant)
         auth.append(passwordCreds)
-        headers = {'Content-Type': 'application/xml'}
-        resp, body = self.post(self.auth_url, headers=headers,
-                               body=str(Document(auth)))
-        return resp, body
-
-    def request(self, method, url, headers=None, body=None):
-        """A simple HTTP request interface."""
-        dscv = CONF.identity.disable_ssl_certificate_validation
-        self.http_obj = http.ClosingHttp(
-            disable_ssl_certificate_validation=dscv)
-        if headers is None:
-            headers = {}
-        self._log_request(method, url, headers, body)
-        resp, resp_body = self.http_obj.request(url, method,
-                                                headers=headers, body=body)
-        self._log_response(resp, resp_body)
-
-        if resp.status in (401, 403):
-            resp_body = json.loads(resp_body)
-            raise exceptions.Unauthorized(resp_body['error']['message'])
-
-        return resp, resp_body
-
-    def get_token(self, user, password, tenant):
-        resp, body = self.auth(user, password, tenant)
-        if resp['status'] != '202':
-            body = json.loads(body)
-            access = body['access']
-            token = access['token']
-            return token['id']
+        resp, body = self.post(self.auth_url, body=str(xml.Document(auth)))
+        return resp, body['access']
diff --git a/tempest/services/image/v1/json/image_client.py b/tempest/services/image/v1/json/image_client.py
index a5b93a0..bc9db38 100644
--- a/tempest/services/image/v1/json/image_client.py
+++ b/tempest/services/image/v1/json/image_client.py
@@ -33,12 +33,10 @@
 
 class ImageClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(ImageClientJSON, self).__init__(username, password,
-                                              auth_url, tenant_name)
-        self.service = CONF.images.catalog_type
-        if CONF.service_available.glance:
-            self.http = self._get_http()
+    def __init__(self, auth_provider):
+        super(ImageClientJSON, self).__init__(auth_provider)
+        self.service = CONF.image.catalog_type
+        self._http = None
 
     def _image_meta_from_headers(self, headers):
         meta = {'properties': {}}
@@ -106,13 +104,9 @@
             return None
 
     def _get_http(self):
-        token, endpoint = self.keystone_auth(self.user,
-                                             self.password,
-                                             self.auth_url,
-                                             self.service,
-                                             self.tenant_name)
         dscv = CONF.identity.disable_ssl_certificate_validation
-        return glance_http.HTTPClient(endpoint=endpoint, token=token,
+        return glance_http.HTTPClient(auth_provider=self.auth_provider,
+                                      filters=self.filters,
                                       insecure=dscv)
 
     def _create_with_data(self, headers, data):
@@ -132,6 +126,13 @@
         body = json.loads(''.join([c for c in body_iter]))
         return resp, body['image']
 
+    @property
+    def http(self):
+        if self._http is None:
+            if CONF.service_available.glance:
+                self._http = self._get_http()
+        return self._http
+
     def create_image(self, name, container_format, disk_format, **kwargs):
         params = {
             "name": name,
diff --git a/tempest/services/image/v2/json/image_client.py b/tempest/services/image/v2/json/image_client.py
index 0c4fb5c..b825519 100644
--- a/tempest/services/image/v2/json/image_client.py
+++ b/tempest/services/image/v2/json/image_client.py
@@ -28,19 +28,15 @@
 
 class ImageClientV2JSON(rest_client.RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(ImageClientV2JSON, self).__init__(username, password,
-                                                auth_url, tenant_name)
-        self.service = CONF.images.catalog_type
-        if CONF.service_available.glance:
-            self.http = self._get_http()
+    def __init__(self, auth_provider):
+        super(ImageClientV2JSON, self).__init__(auth_provider)
+        self.service = CONF.image.catalog_type
+        self._http = None
 
     def _get_http(self):
-        token, endpoint = self.keystone_auth(self.user, self.password,
-                                             self.auth_url, self.service,
-                                             self.tenant_name)
         dscv = CONF.identity.disable_ssl_certificate_validation
-        return glance_http.HTTPClient(endpoint=endpoint, token=token,
+        return glance_http.HTTPClient(auth_provider=self.auth_provider,
+                                      filters=self.filters,
                                       insecure=dscv)
 
     def get_images_schema(self):
@@ -65,6 +61,13 @@
 
         jsonschema.validate(body, schema)
 
+    @property
+    def http(self):
+        if self._http is None:
+            if CONF.service_available.glance:
+                self._http = self._get_http()
+        return self._http
+
     def create_image(self, name, container_format, disk_format, **kwargs):
         params = {
             "name": name,
diff --git a/tempest/services/network/json/network_client.py b/tempest/services/network/json/network_client.py
index 9908816..1458c7b 100644
--- a/tempest/services/network/json/network_client.py
+++ b/tempest/services/network/json/network_client.py
@@ -31,9 +31,8 @@
     quotas
     """
 
-    def get_rest_client(self, username,
-                        password, auth_url, tenant_name=None):
-        return RestClient(username, password, auth_url, tenant_name)
+    def get_rest_client(self, auth_provider):
+        return RestClient(auth_provider)
 
     def deserialize_single(self, body):
         return json.loads(body)
diff --git a/tempest/services/network/network_client_base.py b/tempest/services/network/network_client_base.py
index 467256e..96b9b1d 100644
--- a/tempest/services/network/network_client_base.py
+++ b/tempest/services/network/network_client_base.py
@@ -46,16 +46,14 @@
 
 
 class NetworkClientBase(object):
-    def __init__(self, username, password,
-                 auth_url, tenant_name=None):
+    def __init__(self, auth_provider):
         self.rest_client = self.get_rest_client(
-            username, password, auth_url, tenant_name)
+            auth_provider)
         self.rest_client.service = CONF.network.catalog_type
         self.version = '2.0'
         self.uri_prefix = "v%s" % (self.version)
 
-    def get_rest_client(self, username, password,
-                        auth_url, tenant_name):
+    def get_rest_client(self, auth_provider):
         raise NotImplementedError
 
     def post(self, uri, body, headers=None):
diff --git a/tempest/services/network/xml/network_client.py b/tempest/services/network/xml/network_client.py
index 4eb38be..720c842 100644
--- a/tempest/services/network/xml/network_client.py
+++ b/tempest/services/network/xml/network_client.py
@@ -28,10 +28,8 @@
     PLURALS = ['dns_nameservers', 'host_routes', 'allocation_pools',
                'fixed_ips', 'extensions']
 
-    def get_rest_client(self, username, password,
-                        auth_url, tenant_name=None):
-        return RestClientXML(username, password,
-                             auth_url, tenant_name)
+    def get_rest_client(self, auth_provider):
+        return RestClientXML(auth_provider)
 
     def _parse_array(self, node):
         array = []
diff --git a/tempest/services/object_storage/account_client.py b/tempest/services/object_storage/account_client.py
index 28d10aa..efac5f5 100644
--- a/tempest/services/object_storage/account_client.py
+++ b/tempest/services/object_storage/account_client.py
@@ -25,9 +25,8 @@
 
 
 class AccountClient(RestClient):
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(AccountClient, self).__init__(username, password,
-                                            auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(AccountClient, self).__init__(auth_provider)
         self.service = CONF.object_storage.catalog_type
         self.format = 'json'
 
@@ -59,7 +58,7 @@
                 url += 'bulk-delete&'
             url = '?%s%s' % (url, urllib.urlencode(params))
 
-        resp, body = self.delete(url, headers=None, body=data)
+        resp, body = self.delete(url, headers={}, body=data)
         return resp, body
 
     def list_account_metadata(self):
@@ -128,20 +127,20 @@
         return resp, body
 
     def list_extensions(self):
-        _base_url = self.base_url
-        self.base_url = "/".join(self.base_url.split("/")[:-2])
+        self.skip_path()
         resp, body = self.get('info')
-        self.base_url = _base_url
+        self.reset_path()
         body = json.loads(body)
         return resp, body
 
 
 class AccountClientCustomizedHeader(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(AccountClientCustomizedHeader, self).__init__(username,
-                                                            password, auth_url,
-                                                            tenant_name)
+    # TODO(andreaf) This class is now redundant, to be removed in next patch
+
+    def __init__(self, auth_provider):
+        super(AccountClientCustomizedHeader, self).__init__(
+            auth_provider)
         # Overwrites json-specific header encoding in RestClient
         self.service = CONF.object_storage.catalog_type
         self.format = 'json'
@@ -151,14 +150,17 @@
         self.http_obj = http.ClosingHttp()
         if headers is None:
             headers = {}
-        if self.base_url is None:
-            self._set_auth()
 
-        req_url = "%s/%s" % (self.base_url, url)
-
+        # Authorize the request
+        req_url, req_headers, req_body = self.auth_provider.auth_request(
+            method=method, url=url, headers=headers, body=body,
+            filters=self.filters
+        )
         self._log_request(method, req_url, headers, body)
+        # use original body
         resp, resp_body = self.http_obj.request(req_url, method,
-                                                headers=headers, body=body)
+                                                headers=req_headers,
+                                                body=req_body)
         self._log_response(resp, resp_body)
 
         if resp.status == 401 or resp.status == 403:
diff --git a/tempest/services/object_storage/container_client.py b/tempest/services/object_storage/container_client.py
index bc85c73..f224407 100644
--- a/tempest/services/object_storage/container_client.py
+++ b/tempest/services/object_storage/container_client.py
@@ -24,9 +24,8 @@
 
 
 class ContainerClient(RestClient):
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(ContainerClient, self).__init__(username, password,
-                                              auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(ContainerClient, self).__init__(auth_provider)
 
         # Overwrites json-specific header encoding in RestClient
         self.headers = {}
@@ -182,7 +181,7 @@
             url += '?'
             url += '&%s' % urllib.urlencode(params)
 
-        resp, body = self.get(url)
+        resp, body = self.get(url, headers={})
         if params and params.get('format') == 'json':
             body = json.loads(body)
         elif params and params.get('format') == 'xml':
diff --git a/tempest/services/object_storage/object_client.py b/tempest/services/object_storage/object_client.py
index 2a68a4f..79c5719 100644
--- a/tempest/services/object_storage/object_client.py
+++ b/tempest/services/object_storage/object_client.py
@@ -24,9 +24,8 @@
 
 
 class ObjectClient(RestClient):
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(ObjectClient, self).__init__(username, password,
-                                           auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(ObjectClient, self).__init__(auth_provider)
 
         self.service = CONF.object_storage.catalog_type
 
@@ -52,7 +51,7 @@
         url = "%s/%s" % (str(container), str(object_name))
         if params:
             url += '?%s' % urllib.urlencode(params)
-        resp, body = self.delete(url)
+        resp, body = self.delete(url, headers={})
         return resp, body
 
     def update_object_metadata(self, container, object_name, metadata,
@@ -138,10 +137,11 @@
 
 class ObjectClientCustomizedHeader(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(ObjectClientCustomizedHeader, self).__init__(username,
-                                                           password, auth_url,
-                                                           tenant_name)
+    # TODO(andreaf) This class is now redundant, to be removed in next patch
+
+    def __init__(self, auth_provider):
+        super(ObjectClientCustomizedHeader, self).__init__(
+            auth_provider)
         # Overwrites json-specific header encoding in RestClient
         self.service = CONF.object_storage.catalog_type
         self.format = 'json'
@@ -153,13 +153,17 @@
             disable_ssl_certificate_validation=dscv)
         if headers is None:
             headers = {}
-        if self.base_url is None:
-            self._set_auth()
 
-        req_url = "%s/%s" % (self.base_url, url)
+        # Authorize the request
+        req_url, req_headers, req_body = self.auth_provider.auth_request(
+            method=method, url=url, headers=headers, body=body,
+            filters=self.filters
+        )
+        # Use original method
         self._log_request(method, req_url, headers, body)
         resp, resp_body = self.http_obj.request(req_url, method,
-                                                headers=headers, body=body)
+                                                headers=req_headers,
+                                                body=req_body)
         self._log_response(resp, resp_body)
         if resp.status == 401 or resp.status == 403:
             raise exceptions.Unauthorized()
diff --git a/tempest/services/orchestration/json/orchestration_client.py b/tempest/services/orchestration/json/orchestration_client.py
index 273c2ae..b70b2e8 100644
--- a/tempest/services/orchestration/json/orchestration_client.py
+++ b/tempest/services/orchestration/json/orchestration_client.py
@@ -27,9 +27,8 @@
 
 class OrchestrationClient(rest_client.RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(OrchestrationClient, self).__init__(username, password,
-                                                  auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(OrchestrationClient, self).__init__(auth_provider)
         self.service = CONF.orchestration.catalog_type
         self.build_interval = CONF.orchestration.build_interval
         self.build_timeout = CONF.orchestration.build_timeout
@@ -178,7 +177,7 @@
             stack_name = body['stack_name']
             stack_status = body['stack_status']
             if stack_status == status:
-                return
+                return body
             if fail_regexp.search(stack_status):
                 raise exceptions.StackBuildErrorException(
                     stack_identifier=stack_identifier,
diff --git a/tempest/services/telemetry/json/telemetry_client.py b/tempest/services/telemetry/json/telemetry_client.py
index a1112da..747d7c1 100644
--- a/tempest/services/telemetry/json/telemetry_client.py
+++ b/tempest/services/telemetry/json/telemetry_client.py
@@ -20,9 +20,8 @@
 
 class TelemetryClientJSON(client.TelemetryClientBase):
 
-    def get_rest_client(self, username,
-                        password, auth_url, tenant_name=None):
-        return RestClient(username, password, auth_url, tenant_name)
+    def get_rest_client(self, auth_provider):
+        return RestClient(auth_provider)
 
     def deserialize(self, body):
         return json.loads(body.replace("\n", ""))
diff --git a/tempest/services/telemetry/telemetry_client_base.py b/tempest/services/telemetry/telemetry_client_base.py
index 24039c6..200c94a 100644
--- a/tempest/services/telemetry/telemetry_client_base.py
+++ b/tempest/services/telemetry/telemetry_client_base.py
@@ -35,17 +35,15 @@
     statistics
     """
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        self.rest_client = self.get_rest_client(username, password,
-                                                auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        self.rest_client = self.get_rest_client(auth_provider)
         self.rest_client.service = CONF.telemetry.catalog_type
         self.headers = self.rest_client.headers
         self.version = '2'
         self.uri_prefix = "v%s" % self.version
 
     @abc.abstractmethod
-    def get_rest_client(self, username, password,
-                        auth_url, tenant_name):
+    def get_rest_client(self, auth_provider):
         """
         :param config:
         :param username:
diff --git a/tempest/services/telemetry/xml/telemetry_client.py b/tempest/services/telemetry/xml/telemetry_client.py
index 862d08f..f29fe22 100644
--- a/tempest/services/telemetry/xml/telemetry_client.py
+++ b/tempest/services/telemetry/xml/telemetry_client.py
@@ -23,9 +23,8 @@
 
 class TelemetryClientXML(client.TelemetryClientBase):
 
-    def get_rest_client(self, username,
-                        password, auth_url, tenant_name=None):
-        return RestClientXML(username, password, auth_url, tenant_name)
+    def get_rest_client(self, auth_provider):
+        return RestClientXML(auth_provider)
 
     def _parse_array(self, body):
         array = []
diff --git a/tempest/services/volume/json/admin/volume_hosts_client.py b/tempest/services/volume/json/admin/volume_hosts_client.py
index e4178b9..6efb258 100644
--- a/tempest/services/volume/json/admin/volume_hosts_client.py
+++ b/tempest/services/volume/json/admin/volume_hosts_client.py
@@ -27,9 +27,8 @@
     Client class to send CRUD Volume Hosts API requests to a Cinder endpoint
     """
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(VolumeHostsClientJSON, self).__init__(username, password,
-                                                    auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(VolumeHostsClientJSON, self).__init__(auth_provider)
 
         self.service = CONF.volume.catalog_type
         self.build_interval = CONF.volume.build_interval
diff --git a/tempest/services/volume/json/admin/volume_types_client.py b/tempest/services/volume/json/admin/volume_types_client.py
index 5b6328b..653532e 100644
--- a/tempest/services/volume/json/admin/volume_types_client.py
+++ b/tempest/services/volume/json/admin/volume_types_client.py
@@ -27,9 +27,8 @@
     Client class to send CRUD Volume Types API requests to a Cinder endpoint
     """
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(VolumeTypesClientJSON, self).__init__(username, password,
-                                                    auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(VolumeTypesClientJSON, self).__init__(auth_provider)
 
         self.service = CONF.volume.catalog_type
         self.build_interval = CONF.volume.build_interval
diff --git a/tempest/services/volume/json/extensions_client.py b/tempest/services/volume/json/extensions_client.py
index c3bbb20..257b7c8 100644
--- a/tempest/services/volume/json/extensions_client.py
+++ b/tempest/services/volume/json/extensions_client.py
@@ -23,9 +23,8 @@
 
 class ExtensionsClientJSON(RestClient):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(ExtensionsClientJSON, self).__init__(username, password,
-                                                   auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(ExtensionsClientJSON, self).__init__(auth_provider)
         self.service = CONF.volume.catalog_type
 
     def list_extensions(self):
diff --git a/tempest/services/volume/json/snapshots_client.py b/tempest/services/volume/json/snapshots_client.py
index e8926bd..0a79469 100644
--- a/tempest/services/volume/json/snapshots_client.py
+++ b/tempest/services/volume/json/snapshots_client.py
@@ -27,9 +27,8 @@
 class SnapshotsClientJSON(RestClient):
     """Client class to send CRUD Volume API requests."""
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(SnapshotsClientJSON, self).__init__(username, password,
-                                                  auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(SnapshotsClientJSON, self).__init__(auth_provider)
 
         self.service = CONF.volume.catalog_type
         self.build_interval = CONF.volume.build_interval
diff --git a/tempest/services/volume/json/volumes_client.py b/tempest/services/volume/json/volumes_client.py
index 6c09e02..0524212 100644
--- a/tempest/services/volume/json/volumes_client.py
+++ b/tempest/services/volume/json/volumes_client.py
@@ -29,9 +29,8 @@
     Client class to send CRUD Volume API requests to a Cinder endpoint
     """
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(VolumesClientJSON, self).__init__(username, password,
-                                                auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(VolumesClientJSON, self).__init__(auth_provider)
 
         self.service = CONF.volume.catalog_type
         self.build_interval = CONF.volume.build_interval
diff --git a/tempest/services/volume/v2/__init__.py b/tempest/services/volume/v2/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tempest/services/volume/v2/__init__.py
diff --git a/tempest/services/volume/v2/json/__init__.py b/tempest/services/volume/v2/json/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tempest/services/volume/v2/json/__init__.py
diff --git a/tempest/services/volume/v2/json/volumes_client.py b/tempest/services/volume/v2/json/volumes_client.py
new file mode 100644
index 0000000..0524212
--- /dev/null
+++ b/tempest/services/volume/v2/json/volumes_client.py
@@ -0,0 +1,302 @@
+# Copyright 2012 OpenStack Foundation
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import json
+import time
+import urllib
+
+from tempest.common.rest_client import RestClient
+from tempest import config
+from tempest import exceptions
+
+CONF = config.CONF
+
+
+class VolumesClientJSON(RestClient):
+    """
+    Client class to send CRUD Volume API requests to a Cinder endpoint
+    """
+
+    def __init__(self, auth_provider):
+        super(VolumesClientJSON, self).__init__(auth_provider)
+
+        self.service = CONF.volume.catalog_type
+        self.build_interval = CONF.volume.build_interval
+        self.build_timeout = CONF.volume.build_timeout
+
+    def get_attachment_from_volume(self, volume):
+        """Return the element 'attachment' from input volumes."""
+        return volume['attachments'][0]
+
+    def list_volumes(self, params=None):
+        """List all the volumes created."""
+        url = 'volumes'
+        if params:
+                url += '?%s' % urllib.urlencode(params)
+
+        resp, body = self.get(url)
+        body = json.loads(body)
+        return resp, body['volumes']
+
+    def list_volumes_with_detail(self, params=None):
+        """List the details of all volumes."""
+        url = 'volumes/detail'
+        if params:
+                url += '?%s' % urllib.urlencode(params)
+
+        resp, body = self.get(url)
+        body = json.loads(body)
+        return resp, body['volumes']
+
+    def get_volume(self, volume_id):
+        """Returns the details of a single volume."""
+        url = "volumes/%s" % str(volume_id)
+        resp, body = self.get(url)
+        body = json.loads(body)
+        return resp, body['volume']
+
+    def create_volume(self, size, **kwargs):
+        """
+        Creates a new Volume.
+        size(Required): Size of volume in GB.
+        Following optional keyword arguments are accepted:
+        display_name: Optional Volume Name.
+        metadata: A dictionary of values to be used as metadata.
+        volume_type: Optional Name of volume_type for the volume
+        snapshot_id: When specified the volume is created from this snapshot
+        imageRef: When specified the volume is created from this image
+        """
+        post_body = {'size': size}
+        post_body.update(kwargs)
+        post_body = json.dumps({'volume': post_body})
+        resp, body = self.post('volumes', post_body, self.headers)
+        body = json.loads(body)
+        return resp, body['volume']
+
+    def update_volume(self, volume_id, **kwargs):
+        """Updates the Specified Volume."""
+        put_body = json.dumps({'volume': kwargs})
+        resp, body = self.put('volumes/%s' % volume_id, put_body,
+                              self.headers)
+        body = json.loads(body)
+        return resp, body['volume']
+
+    def delete_volume(self, volume_id):
+        """Deletes the Specified Volume."""
+        return self.delete("volumes/%s" % str(volume_id))
+
+    def upload_volume(self, volume_id, image_name, disk_format):
+        """Uploads a volume in Glance."""
+        post_body = {
+            'image_name': image_name,
+            'disk_format': disk_format
+        }
+        post_body = json.dumps({'os-volume_upload_image': post_body})
+        url = 'volumes/%s/action' % (volume_id)
+        resp, body = self.post(url, post_body, self.headers)
+        body = json.loads(body)
+        return resp, body['os-volume_upload_image']
+
+    def attach_volume(self, volume_id, instance_uuid, mountpoint):
+        """Attaches a volume to a given instance on a given mountpoint."""
+        post_body = {
+            'instance_uuid': instance_uuid,
+            'mountpoint': mountpoint,
+        }
+        post_body = json.dumps({'os-attach': post_body})
+        url = 'volumes/%s/action' % (volume_id)
+        resp, body = self.post(url, post_body, self.headers)
+        return resp, body
+
+    def detach_volume(self, volume_id):
+        """Detaches a volume from an instance."""
+        post_body = {}
+        post_body = json.dumps({'os-detach': post_body})
+        url = 'volumes/%s/action' % (volume_id)
+        resp, body = self.post(url, post_body, self.headers)
+        return resp, body
+
+    def reserve_volume(self, volume_id):
+        """Reserves a volume."""
+        post_body = {}
+        post_body = json.dumps({'os-reserve': post_body})
+        url = 'volumes/%s/action' % (volume_id)
+        resp, body = self.post(url, post_body, self.headers)
+        return resp, body
+
+    def unreserve_volume(self, volume_id):
+        """Restore a reserved volume ."""
+        post_body = {}
+        post_body = json.dumps({'os-unreserve': post_body})
+        url = 'volumes/%s/action' % (volume_id)
+        resp, body = self.post(url, post_body, self.headers)
+        return resp, body
+
+    def wait_for_volume_status(self, volume_id, status):
+        """Waits for a Volume to reach a given status."""
+        resp, body = self.get_volume(volume_id)
+        volume_name = body['display_name']
+        volume_status = body['status']
+        start = int(time.time())
+
+        while volume_status != status:
+            time.sleep(self.build_interval)
+            resp, body = self.get_volume(volume_id)
+            volume_status = body['status']
+            if volume_status == 'error':
+                raise exceptions.VolumeBuildErrorException(volume_id=volume_id)
+
+            if int(time.time()) - start >= self.build_timeout:
+                message = ('Volume %s failed to reach %s status within '
+                           'the required time (%s s).' %
+                           (volume_name, status, self.build_timeout))
+                raise exceptions.TimeoutException(message)
+
+    def is_resource_deleted(self, id):
+        try:
+            self.get_volume(id)
+        except exceptions.NotFound:
+            return True
+        return False
+
+    def extend_volume(self, volume_id, extend_size):
+        """Extend a volume."""
+        post_body = {
+            'new_size': extend_size
+        }
+        post_body = json.dumps({'os-extend': post_body})
+        url = 'volumes/%s/action' % (volume_id)
+        resp, body = self.post(url, post_body, self.headers)
+        return resp, body
+
+    def reset_volume_status(self, volume_id, status):
+        """Reset the Specified Volume's Status."""
+        post_body = json.dumps({'os-reset_status': {"status": status}})
+        resp, body = self.post('volumes/%s/action' % volume_id, post_body,
+                               self.headers)
+        return resp, body
+
+    def volume_begin_detaching(self, volume_id):
+        """Volume Begin Detaching."""
+        post_body = json.dumps({'os-begin_detaching': {}})
+        resp, body = self.post('volumes/%s/action' % volume_id, post_body,
+                               self.headers)
+        return resp, body
+
+    def volume_roll_detaching(self, volume_id):
+        """Volume Roll Detaching."""
+        post_body = json.dumps({'os-roll_detaching': {}})
+        resp, body = self.post('volumes/%s/action' % volume_id, post_body,
+                               self.headers)
+        return resp, body
+
+    def create_volume_transfer(self, vol_id, display_name=None):
+        """Create a volume transfer."""
+        post_body = {
+            'volume_id': vol_id
+        }
+        if display_name:
+            post_body['name'] = display_name
+        post_body = json.dumps({'transfer': post_body})
+        resp, body = self.post('os-volume-transfer',
+                               post_body,
+                               self.headers)
+        body = json.loads(body)
+        return resp, body['transfer']
+
+    def get_volume_transfer(self, transfer_id):
+        """Returns the details of a volume transfer."""
+        url = "os-volume-transfer/%s" % str(transfer_id)
+        resp, body = self.get(url, self.headers)
+        body = json.loads(body)
+        return resp, body['transfer']
+
+    def list_volume_transfers(self, params=None):
+        """List all the volume transfers created."""
+        url = 'os-volume-transfer'
+        if params:
+            url += '?%s' % urllib.urlencode(params)
+        resp, body = self.get(url)
+        body = json.loads(body)
+        return resp, body['transfers']
+
+    def delete_volume_transfer(self, transfer_id):
+        """Delete a volume transfer."""
+        return self.delete("os-volume-transfer/%s" % str(transfer_id))
+
+    def accept_volume_transfer(self, transfer_id, transfer_auth_key):
+        """Accept a volume transfer."""
+        post_body = {
+            'auth_key': transfer_auth_key,
+        }
+        url = 'os-volume-transfer/%s/accept' % transfer_id
+        post_body = json.dumps({'accept': post_body})
+        resp, body = self.post(url, post_body, self.headers)
+        body = json.loads(body)
+        return resp, body['transfer']
+
+    def update_volume_readonly(self, volume_id, readonly):
+        """Update the Specified Volume readonly."""
+        post_body = {
+            'readonly': readonly
+        }
+        post_body = json.dumps({'os-update_readonly_flag': post_body})
+        url = 'volumes/%s/action' % (volume_id)
+        resp, body = self.post(url, post_body, self.headers)
+        return resp, body
+
+    def force_delete_volume(self, volume_id):
+        """Force Delete Volume."""
+        post_body = json.dumps({'os-force_delete': {}})
+        resp, body = self.post('volumes/%s/action' % volume_id, post_body,
+                               self.headers)
+        return resp, body
+
+    def create_volume_metadata(self, volume_id, metadata):
+        """Create metadata for the volume."""
+        put_body = json.dumps({'metadata': metadata})
+        url = "volumes/%s/metadata" % str(volume_id)
+        resp, body = self.post(url, put_body, self.headers)
+        body = json.loads(body)
+        return resp, body['metadata']
+
+    def get_volume_metadata(self, volume_id):
+        """Get metadata of the volume."""
+        url = "volumes/%s/metadata" % str(volume_id)
+        resp, body = self.get(url, self.headers)
+        body = json.loads(body)
+        return resp, body['metadata']
+
+    def update_volume_metadata(self, volume_id, metadata):
+        """Update metadata for the volume."""
+        put_body = json.dumps({'metadata': metadata})
+        url = "volumes/%s/metadata" % str(volume_id)
+        resp, body = self.put(url, put_body, self.headers)
+        body = json.loads(body)
+        return resp, body['metadata']
+
+    def update_volume_metadata_item(self, volume_id, id, meta_item):
+        """Update metadata item for the volume."""
+        put_body = json.dumps({'meta': meta_item})
+        url = "volumes/%s/metadata/%s" % (str(volume_id), str(id))
+        resp, body = self.put(url, put_body, self.headers)
+        body = json.loads(body)
+        return resp, body['meta']
+
+    def delete_volume_metadata_item(self, volume_id, id):
+        """Delete metadata item for the volume."""
+        url = "volumes/%s/metadata/%s" % (str(volume_id), str(id))
+        resp, body = self.delete(url, self.headers)
+        return resp, body
diff --git a/tempest/services/volume/v2/xml/__init__.py b/tempest/services/volume/v2/xml/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tempest/services/volume/v2/xml/__init__.py
diff --git a/tempest/services/volume/v2/xml/volumes_client.py b/tempest/services/volume/v2/xml/volumes_client.py
new file mode 100644
index 0000000..deb56fd
--- /dev/null
+++ b/tempest/services/volume/v2/xml/volumes_client.py
@@ -0,0 +1,412 @@
+# Copyright 2012 IBM Corp.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import time
+import urllib
+
+from lxml import etree
+
+from tempest.common.rest_client import RestClientXML
+from tempest import config
+from tempest import exceptions
+from tempest.services.compute.xml.common import Document
+from tempest.services.compute.xml.common import Element
+from tempest.services.compute.xml.common import Text
+from tempest.services.compute.xml.common import xml_to_json
+from tempest.services.compute.xml.common import XMLNS_11
+
+CONF = config.CONF
+
+
+class VolumesClientXML(RestClientXML):
+    """
+    Client class to send CRUD Volume API requests to a Cinder endpoint
+    """
+
+    def __init__(self, auth_provider):
+        super(VolumesClientXML, self).__init__(auth_provider)
+        self.service = CONF.volume.catalog_type
+        self.build_interval = CONF.compute.build_interval
+        self.build_timeout = CONF.compute.build_timeout
+
+    def _parse_volume(self, body):
+        vol = dict((attr, body.get(attr)) for attr in body.keys())
+
+        for child in body.getchildren():
+            tag = child.tag
+            if tag.startswith("{"):
+                ns, tag = tag.split("}", 1)
+            if tag == 'metadata':
+                vol['metadata'] = dict((meta.get('key'),
+                                       meta.text) for meta in
+                                       child.getchildren())
+            else:
+                vol[tag] = xml_to_json(child)
+        return vol
+
+    def get_attachment_from_volume(self, volume):
+        """Return the element 'attachment' from input volumes."""
+        return volume['attachments']['attachment']
+
+    def _check_if_bootable(self, volume):
+        """
+        Check if the volume is bootable, also change the value
+        of 'bootable' from string to boolean.
+        """
+
+        # NOTE(jdg): Version 1 of Cinder API uses lc strings
+        # We should consider being explicit in this check to
+        # avoid introducing bugs like: LP #1227837
+
+        if volume['bootable'].lower() == 'true':
+            volume['bootable'] = True
+        elif volume['bootable'].lower() == 'false':
+            volume['bootable'] = False
+        else:
+            raise ValueError(
+                'bootable flag is supposed to be either True or False,'
+                'it is %s' % volume['bootable'])
+        return volume
+
+    def list_volumes(self, params=None):
+        """List all the volumes created."""
+        url = 'volumes'
+
+        if params:
+            url += '?%s' % urllib.urlencode(params)
+
+        resp, body = self.get(url, self.headers)
+        body = etree.fromstring(body)
+        volumes = []
+        if body is not None:
+            volumes += [self._parse_volume(vol) for vol in list(body)]
+        for v in volumes:
+            v = self._check_if_bootable(v)
+        return resp, volumes
+
+    def list_volumes_with_detail(self, params=None):
+        """List all the details of volumes."""
+        url = 'volumes/detail'
+
+        if params:
+            url += '?%s' % urllib.urlencode(params)
+
+        resp, body = self.get(url, self.headers)
+        body = etree.fromstring(body)
+        volumes = []
+        if body is not None:
+            volumes += [self._parse_volume(vol) for vol in list(body)]
+        for v in volumes:
+            v = self._check_if_bootable(v)
+        return resp, volumes
+
+    def get_volume(self, volume_id):
+        """Returns the details of a single volume."""
+        url = "volumes/%s" % str(volume_id)
+        resp, body = self.get(url, self.headers)
+        body = self._parse_volume(etree.fromstring(body))
+        body = self._check_if_bootable(body)
+        return resp, body
+
+    def create_volume(self, size, **kwargs):
+        """Creates a new Volume.
+
+        :param size: Size of volume in GB. (Required)
+        :param display_name: Optional Volume Name.
+        :param metadata: An optional dictionary of values for metadata.
+        :param volume_type: Optional Name of volume_type for the volume
+        :param snapshot_id: When specified the volume is created from
+                            this snapshot
+        :param imageRef: When specified the volume is created from this
+                         image
+        """
+        # NOTE(afazekas): it should use a volume namespace
+        volume = Element("volume", xmlns=XMLNS_11, size=size)
+
+        if 'metadata' in kwargs:
+            _metadata = Element('metadata')
+            volume.append(_metadata)
+            for key, value in kwargs['metadata'].items():
+                meta = Element('meta')
+                meta.add_attr('key', key)
+                meta.append(Text(value))
+                _metadata.append(meta)
+            attr_to_add = kwargs.copy()
+            del attr_to_add['metadata']
+        else:
+            attr_to_add = kwargs
+
+        for key, value in attr_to_add.items():
+            volume.add_attr(key, value)
+
+        resp, body = self.post('volumes', str(Document(volume)),
+                               self.headers)
+        body = xml_to_json(etree.fromstring(body))
+        return resp, body
+
+    def update_volume(self, volume_id, **kwargs):
+        """Updates the Specified Volume."""
+        put_body = Element("volume", xmlns=XMLNS_11, **kwargs)
+
+        resp, body = self.put('volumes/%s' % volume_id,
+                              str(Document(put_body)),
+                              self.headers)
+        body = xml_to_json(etree.fromstring(body))
+        return resp, body
+
+    def delete_volume(self, volume_id):
+        """Deletes the Specified Volume."""
+        return self.delete("volumes/%s" % str(volume_id))
+
+    def wait_for_volume_status(self, volume_id, status):
+        """Waits for a Volume to reach a given status."""
+        resp, body = self.get_volume(volume_id)
+        volume_status = body['status']
+        start = int(time.time())
+
+        while volume_status != status:
+            time.sleep(self.build_interval)
+            resp, body = self.get_volume(volume_id)
+            volume_status = body['status']
+            if volume_status == 'error':
+                raise exceptions.VolumeBuildErrorException(volume_id=volume_id)
+
+            if int(time.time()) - start >= self.build_timeout:
+                message = 'Volume %s failed to reach %s status within '\
+                          'the required time (%s s).' % (volume_id,
+                                                         status,
+                                                         self.build_timeout)
+                raise exceptions.TimeoutException(message)
+
+    def is_resource_deleted(self, id):
+        try:
+            self.get_volume(id)
+        except exceptions.NotFound:
+            return True
+        return False
+
+    def attach_volume(self, volume_id, instance_uuid, mountpoint):
+        """Attaches a volume to a given instance on a given mountpoint."""
+        post_body = Element("os-attach",
+                            instance_uuid=instance_uuid,
+                            mountpoint=mountpoint
+                            )
+        url = 'volumes/%s/action' % str(volume_id)
+        resp, body = self.post(url, str(Document(post_body)), self.headers)
+        if body:
+            body = xml_to_json(etree.fromstring(body))
+        return resp, body
+
+    def detach_volume(self, volume_id):
+        """Detaches a volume from an instance."""
+        post_body = Element("os-detach")
+        url = 'volumes/%s/action' % str(volume_id)
+        resp, body = self.post(url, str(Document(post_body)), self.headers)
+        if body:
+            body = xml_to_json(etree.fromstring(body))
+        return resp, body
+
+    def upload_volume(self, volume_id, image_name, disk_format):
+        """Uploads a volume in Glance."""
+        post_body = Element("os-volume_upload_image",
+                            image_name=image_name,
+                            disk_format=disk_format)
+        url = 'volumes/%s/action' % str(volume_id)
+        resp, body = self.post(url, str(Document(post_body)), self.headers)
+        volume = xml_to_json(etree.fromstring(body))
+        return resp, volume
+
+    def extend_volume(self, volume_id, extend_size):
+        """Extend a volume."""
+        post_body = Element("os-extend",
+                            new_size=extend_size)
+        url = 'volumes/%s/action' % str(volume_id)
+        resp, body = self.post(url, str(Document(post_body)), self.headers)
+        if body:
+            body = xml_to_json(etree.fromstring(body))
+        return resp, body
+
+    def reset_volume_status(self, volume_id, status):
+        """Reset the Specified Volume's Status."""
+        post_body = Element("os-reset_status",
+                            status=status
+                            )
+        url = 'volumes/%s/action' % str(volume_id)
+        resp, body = self.post(url, str(Document(post_body)), self.headers)
+        if body:
+            body = xml_to_json(etree.fromstring(body))
+        return resp, body
+
+    def volume_begin_detaching(self, volume_id):
+        """Volume Begin Detaching."""
+        post_body = Element("os-begin_detaching")
+        url = 'volumes/%s/action' % str(volume_id)
+        resp, body = self.post(url, str(Document(post_body)), self.headers)
+        if body:
+            body = xml_to_json(etree.fromstring(body))
+        return resp, body
+
+    def volume_roll_detaching(self, volume_id):
+        """Volume Roll Detaching."""
+        post_body = Element("os-roll_detaching")
+        url = 'volumes/%s/action' % str(volume_id)
+        resp, body = self.post(url, str(Document(post_body)), self.headers)
+        if body:
+            body = xml_to_json(etree.fromstring(body))
+        return resp, body
+
+    def reserve_volume(self, volume_id):
+        """Reserves a volume."""
+        post_body = Element("os-reserve")
+        url = 'volumes/%s/action' % str(volume_id)
+        resp, body = self.post(url, str(Document(post_body)), self.headers)
+        if body:
+            body = xml_to_json(etree.fromstring(body))
+        return resp, body
+
+    def unreserve_volume(self, volume_id):
+        """Restore a reserved volume ."""
+        post_body = Element("os-unreserve")
+        url = 'volumes/%s/action' % str(volume_id)
+        resp, body = self.post(url, str(Document(post_body)), self.headers)
+        if body:
+            body = xml_to_json(etree.fromstring(body))
+        return resp, body
+
+    def create_volume_transfer(self, vol_id, display_name=None):
+        """Create a volume transfer."""
+        post_body = Element("transfer",
+                            volume_id=vol_id)
+        if display_name:
+            post_body.add_attr('name', display_name)
+        resp, body = self.post('os-volume-transfer',
+                               str(Document(post_body)),
+                               self.headers)
+        volume = xml_to_json(etree.fromstring(body))
+        return resp, volume
+
+    def get_volume_transfer(self, transfer_id):
+        """Returns the details of a volume transfer."""
+        url = "os-volume-transfer/%s" % str(transfer_id)
+        resp, body = self.get(url, self.headers)
+        volume = xml_to_json(etree.fromstring(body))
+        return resp, volume
+
+    def list_volume_transfers(self, params=None):
+        """List all the volume transfers created."""
+        url = 'os-volume-transfer'
+        if params:
+            url += '?%s' % urllib.urlencode(params)
+
+        resp, body = self.get(url, self.headers)
+        body = etree.fromstring(body)
+        volumes = []
+        if body is not None:
+            volumes += [self._parse_volume_transfer(vol) for vol in list(body)]
+        return resp, volumes
+
+    def _parse_volume_transfer(self, body):
+        vol = dict((attr, body.get(attr)) for attr in body.keys())
+        for child in body.getchildren():
+            tag = child.tag
+            if tag.startswith("{"):
+                tag = tag.split("}", 1)
+            vol[tag] = xml_to_json(child)
+        return vol
+
+    def delete_volume_transfer(self, transfer_id):
+        """Delete a volume transfer."""
+        return self.delete("os-volume-transfer/%s" % str(transfer_id))
+
+    def accept_volume_transfer(self, transfer_id, transfer_auth_key):
+        """Accept a volume transfer."""
+        post_body = Element("accept", auth_key=transfer_auth_key)
+        url = 'os-volume-transfer/%s/accept' % transfer_id
+        resp, body = self.post(url, str(Document(post_body)), self.headers)
+        volume = xml_to_json(etree.fromstring(body))
+        return resp, volume
+
+    def update_volume_readonly(self, volume_id, readonly):
+        """Update the Specified Volume readonly."""
+        post_body = Element("os-update_readonly_flag",
+                            readonly=readonly)
+        url = 'volumes/%s/action' % str(volume_id)
+        resp, body = self.post(url, str(Document(post_body)), self.headers)
+        if body:
+            body = xml_to_json(etree.fromstring(body))
+        return resp, body
+
+    def force_delete_volume(self, volume_id):
+        """Force Delete Volume."""
+        post_body = Element("os-force_delete")
+        url = 'volumes/%s/action' % str(volume_id)
+        resp, body = self.post(url, str(Document(post_body)), self.headers)
+        if body:
+            body = xml_to_json(etree.fromstring(body))
+        return resp, body
+
+    def _metadata_body(self, meta):
+        post_body = Element('metadata')
+        for k, v in meta.items():
+            data = Element('meta', key=k)
+            data.append(Text(v))
+            post_body.append(data)
+        return post_body
+
+    def _parse_key_value(self, node):
+        """Parse <foo key='key'>value</foo> data into {'key': 'value'}."""
+        data = {}
+        for node in node.getchildren():
+            data[node.get('key')] = node.text
+        return data
+
+    def create_volume_metadata(self, volume_id, metadata):
+        """Create metadata for the volume."""
+        post_body = self._metadata_body(metadata)
+        resp, body = self.post('volumes/%s/metadata' % volume_id,
+                               str(Document(post_body)),
+                               self.headers)
+        body = self._parse_key_value(etree.fromstring(body))
+        return resp, body
+
+    def get_volume_metadata(self, volume_id):
+        """Get metadata of the volume."""
+        url = "volumes/%s/metadata" % str(volume_id)
+        resp, body = self.get(url, self.headers)
+        body = self._parse_key_value(etree.fromstring(body))
+        return resp, body
+
+    def update_volume_metadata(self, volume_id, metadata):
+        """Update metadata for the volume."""
+        put_body = self._metadata_body(metadata)
+        url = "volumes/%s/metadata" % str(volume_id)
+        resp, body = self.put(url, str(Document(put_body)), self.headers)
+        body = self._parse_key_value(etree.fromstring(body))
+        return resp, body
+
+    def update_volume_metadata_item(self, volume_id, id, meta_item):
+        """Update metadata item for the volume."""
+        for k, v in meta_item.items():
+            put_body = Element('meta', key=k)
+            put_body.append(Text(v))
+        url = "volumes/%s/metadata/%s" % (str(volume_id), str(id))
+        resp, body = self.put(url, str(Document(put_body)), self.headers)
+        body = xml_to_json(etree.fromstring(body))
+        return resp, body
+
+    def delete_volume_metadata_item(self, volume_id, id):
+        """Delete metadata item for the volume."""
+        url = "volumes/%s/metadata/%s" % (str(volume_id), str(id))
+        return self.delete(url)
diff --git a/tempest/services/volume/xml/admin/volume_hosts_client.py b/tempest/services/volume/xml/admin/volume_hosts_client.py
index 39b82e5..7278fd9 100644
--- a/tempest/services/volume/xml/admin/volume_hosts_client.py
+++ b/tempest/services/volume/xml/admin/volume_hosts_client.py
@@ -29,9 +29,8 @@
     Client class to send CRUD Volume Hosts API requests to a Cinder endpoint
     """
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(VolumeHostsClientXML, self).__init__(username, password,
-                                                   auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(VolumeHostsClientXML, self).__init__(auth_provider)
         self.service = CONF.volume.catalog_type
         self.build_interval = CONF.compute.build_interval
         self.build_timeout = CONF.compute.build_timeout
diff --git a/tempest/services/volume/xml/admin/volume_types_client.py b/tempest/services/volume/xml/admin/volume_types_client.py
index 942c4e1..29ba431 100644
--- a/tempest/services/volume/xml/admin/volume_types_client.py
+++ b/tempest/services/volume/xml/admin/volume_types_client.py
@@ -34,9 +34,8 @@
     Client class to send CRUD Volume Types API requests to a Cinder endpoint
     """
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(VolumeTypesClientXML, self).__init__(username, password,
-                                                   auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(VolumeTypesClientXML, self).__init__(auth_provider)
         self.service = CONF.volume.catalog_type
         self.build_interval = CONF.compute.build_interval
         self.build_timeout = CONF.compute.build_timeout
diff --git a/tempest/services/volume/xml/extensions_client.py b/tempest/services/volume/xml/extensions_client.py
index a04616d..21e1d04 100644
--- a/tempest/services/volume/xml/extensions_client.py
+++ b/tempest/services/volume/xml/extensions_client.py
@@ -24,9 +24,8 @@
 
 class ExtensionsClientXML(RestClientXML):
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(ExtensionsClientXML, self).__init__(username, password,
-                                                  auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(ExtensionsClientXML, self).__init__(auth_provider)
         self.service = CONF.volume.catalog_type
 
     def _parse_array(self, node):
diff --git a/tempest/services/volume/xml/snapshots_client.py b/tempest/services/volume/xml/snapshots_client.py
index 5e62b6d..4f066a6 100644
--- a/tempest/services/volume/xml/snapshots_client.py
+++ b/tempest/services/volume/xml/snapshots_client.py
@@ -33,9 +33,8 @@
 class SnapshotsClientXML(RestClientXML):
     """Client class to send CRUD Volume API requests."""
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(SnapshotsClientXML, self).__init__(username, password,
-                                                 auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(SnapshotsClientXML, self).__init__(auth_provider)
 
         self.service = CONF.volume.catalog_type
         self.build_interval = CONF.volume.build_interval
diff --git a/tempest/services/volume/xml/volumes_client.py b/tempest/services/volume/xml/volumes_client.py
index 7adaf4b..deb56fd 100644
--- a/tempest/services/volume/xml/volumes_client.py
+++ b/tempest/services/volume/xml/volumes_client.py
@@ -35,9 +35,8 @@
     Client class to send CRUD Volume API requests to a Cinder endpoint
     """
 
-    def __init__(self, username, password, auth_url, tenant_name=None):
-        super(VolumesClientXML, self).__init__(username, password,
-                                               auth_url, tenant_name)
+    def __init__(self, auth_provider):
+        super(VolumesClientXML, self).__init__(auth_provider)
         self.service = CONF.volume.catalog_type
         self.build_interval = CONF.compute.build_interval
         self.build_timeout = CONF.compute.build_timeout
diff --git a/tempest/stress/actions/unit_test.py b/tempest/stress/actions/unit_test.py
index 8bd2f22..2f1d28f 100644
--- a/tempest/stress/actions/unit_test.py
+++ b/tempest/stress/actions/unit_test.py
@@ -10,10 +10,13 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+from tempest import config
 from tempest.openstack.common import importutils
 from tempest.openstack.common import log as logging
 import tempest.stress.stressaction as stressaction
 
+CONF = config.CONF
+
 
 class SetUpClassRunTime(object):
 
@@ -73,10 +76,14 @@
                 self.klass.setUpClass()
                 self.setupclass_called = True
 
-            self.run_core()
-
-            if (self.class_setup_per == SetUpClassRunTime.action):
-                self.klass.tearDownClass()
+            try:
+                self.run_core()
+            except Exception as e:
+                raise e
+            finally:
+                if (CONF.stress.leave_dirty_stack is False
+                    and self.class_setup_per == SetUpClassRunTime.action):
+                    self.klass.tearDownClass()
         else:
             self.run_core()
 
diff --git a/tempest/test.py b/tempest/test.py
index 5464c03..dcba226 100644
--- a/tempest/test.py
+++ b/tempest/test.py
@@ -17,6 +17,7 @@
 import functools
 import json
 import os
+import sys
 import time
 import urllib
 import uuid
@@ -70,16 +71,35 @@
     This decorator applies a testtools attr for each service that gets
     exercised by a test case.
     """
-    valid_service_list = ['compute', 'image', 'volume', 'orchestration',
-                          'network', 'identity', 'object_storage', 'dashboard']
+    service_list = {
+        'compute': CONF.service_available.nova,
+        'image': CONF.service_available.glance,
+        'volume': CONF.service_available.cinder,
+        'orchestration': CONF.service_available.heat,
+        # NOTE(mtreinish) nova-network will provide networking functionality
+        # if neutron isn't available, so always set to True.
+        'network': True,
+        'identity': True,
+        'object_storage': CONF.service_available.swift,
+        'dashboard': CONF.service_available.horizon,
+    }
 
     def decorator(f):
         for service in args:
-            if service not in valid_service_list:
+            if service not in service_list:
                 raise exceptions.InvalidServiceTag('%s is not a valid service'
                                                    % service)
         attr(type=list(args))(f)
-        return f
+
+        @functools.wraps(f)
+        def wrapper(self, *func_args, **func_kwargs):
+            for service in args:
+                if not service_list[service]:
+                    msg = 'Skipped because the %s service is not available' % (
+                        service)
+                    raise testtools.TestCase.skipException(msg)
+            return f(self, *func_args, **func_kwargs)
+        return wrapper
     return decorator
 
 
@@ -222,10 +242,23 @@
 
 atexit.register(validate_tearDownClass)
 
-
-class BaseTestCase(testtools.TestCase,
+if sys.version_info >= (2, 7):
+    class BaseDeps(testtools.TestCase,
                    testtools.testcase.WithAttributes,
                    testresources.ResourcedTestCase):
+        pass
+else:
+    # Define asserts for py26
+    import unittest2
+
+    class BaseDeps(testtools.TestCase,
+                   testtools.testcase.WithAttributes,
+                   testresources.ResourcedTestCase,
+                   unittest2.TestCase):
+        pass
+
+
+class BaseTestCase(BaseDeps):
 
     setUpClassCalled = False
     _service = None
@@ -405,11 +438,16 @@
         schema = description.get("json-schema", None)
         resources = description.get("resources", [])
         scenario_list = []
+        expected_result = None
         for resource in resources:
+            if isinstance(resource, dict):
+                expected_result = resource['expected_result']
+                resource = resource['name']
             LOG.debug("Add resource to test %s" % resource)
             scn_name = "inv_res_%s" % (resource)
             scenario_list.append((scn_name, {"resource": (resource,
-                                                          str(uuid.uuid4()))
+                                                          str(uuid.uuid4())),
+                                             "expected_result": expected_result
                                              }))
         if schema is not None:
             for invalid in generate_json.generate_invalid(schema):
@@ -460,16 +498,12 @@
             if schema:
                 valid = generate_json.generate_valid(schema)
             new_url, body = self._http_arguments(valid, url, method)
-            resp, resp_body = self.client.send_request(method, new_url,
-                                                       resources, body=body)
-            self._check_negative_response(resp.status, resp_body)
-            return
-
-        if hasattr(self, "schema"):
+        elif hasattr(self, "schema"):
             new_url, body = self._http_arguments(self.schema, url, method)
-            resp, resp_body = self.client.send_request(method, new_url,
-                                                       resources, body=body)
-            self._check_negative_response(resp.status, resp_body)
+
+        resp, resp_body = self.client.send_request(method, new_url,
+                                                   resources, body=body)
+        self._check_negative_response(resp.status, resp_body)
 
     def _http_arguments(self, json_dict, url, method):
         LOG.debug("dict: %s url: %s method: %s" % (json_dict, url, method))
@@ -510,6 +544,8 @@
         :param name: The name of the kind of resource such as "flavor", "role",
             etc.
         """
+        if isinstance(name, dict):
+            name = name['name']
         if hasattr(self, "resource") and self.resource[0] == name:
             LOG.debug("Return invalid resource (%s) value: %s" %
                       (self.resource[0], self.resource[1]))
diff --git a/tempest/tests/fake_auth_provider.py b/tempest/tests/fake_auth_provider.py
new file mode 100644
index 0000000..bc68d26
--- /dev/null
+++ b/tempest/tests/fake_auth_provider.py
@@ -0,0 +1,20 @@
+# Copyright 2014 Hewlett-Packard Development Company, L.P.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+
+class FakeAuthProvider(object):
+
+    def auth_request(self, method, url, headers=None, body=None, filters=None):
+        return url, headers, body
diff --git a/tempest/tests/negative/__init__.py b/tempest/tests/negative/__init__.py
new file mode 100644
index 0000000..e69de29
--- /dev/null
+++ b/tempest/tests/negative/__init__.py
diff --git a/tempest/tests/negative/test_generate_json.py b/tempest/tests/negative/test_generate_json.py
new file mode 100644
index 0000000..a0aa088
--- /dev/null
+++ b/tempest/tests/negative/test_generate_json.py
@@ -0,0 +1,53 @@
+# Copyright 2014 Deutsche Telekom AG
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from tempest.common import generate_json as gen
+import tempest.test
+
+
+class TestGenerateJson(tempest.test.BaseTestCase):
+
+    fake_input_str = {"type": "string",
+                      "minLength": 2,
+                      "maxLength": 8,
+                      'results': {'gen_number': 404}}
+
+    fake_input_int = {"type": "integer",
+                      "maximum": 255,
+                      "minimum": 1}
+
+    fake_input_obj = {"type": "object",
+                      "properties": {"minRam": {"type": "integer"},
+                                     "diskName": {"type": "string"},
+                                     "maxRam": {"type": "integer", }
+                                     }
+                      }
+
+    def _validate_result(self, data):
+        self.assertTrue(isinstance(data, list))
+        for t in data:
+            self.assertTrue(isinstance(t, tuple))
+
+    def test_generate_invalid_string(self):
+        result = gen.generate_invalid(self.fake_input_str)
+        self._validate_result(result)
+
+    def test_generate_invalid_integer(self):
+        result = gen.generate_invalid(self.fake_input_int)
+        self._validate_result(result)
+
+    def test_generate_invalid_obj(self):
+        result = gen.generate_invalid(self.fake_input_obj)
+        self._validate_result(result)
diff --git a/tempest/tests/negative/test_negative_auto_test.py b/tempest/tests/negative/test_negative_auto_test.py
new file mode 100644
index 0000000..4c59383
--- /dev/null
+++ b/tempest/tests/negative/test_negative_auto_test.py
@@ -0,0 +1,64 @@
+# Copyright 2014 Deutsche Telekom AG
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+import mock
+
+import tempest.test as test
+
+
+class TestNegativeAutoTest(test.BaseTestCase):
+    # Fake entries
+    _interface = 'json'
+    _service = 'compute'
+
+    fake_input_desc = {"name": "list-flavors-with-detail",
+                       "http-method": "GET",
+                       "url": "flavors/detail",
+                       "json-schema": {"type": "object",
+                                      "properties":
+                                      {"minRam": {"type": "integer"},
+                                       "minDisk": {"type": "integer"}}
+                                       },
+                       "resources": ["flavor", "volume", "image"]
+                       }
+
+    def _check_prop_entries(self, result, entry):
+        entries = [a for a in result if entry in a[0]]
+        self.assertIsNotNone(entries)
+        self.assertIs(len(entries), 2)
+        for entry in entries:
+            self.assertIsNotNone(entry[1]['schema'])
+
+    def _check_resource_entries(self, result, entry):
+        entries = [a for a in result if entry in a[0]]
+        self.assertIsNotNone(entries)
+        self.assertIs(len(entries), 3)
+        for entry in entries:
+            self.assertIsNotNone(entry[1]['resource'])
+
+    @mock.patch('tempest.test.NegativeAutoTest.load_schema')
+    def test_generate_scenario(self, open_mock):
+        open_mock.return_value = self.fake_input_desc
+        scenarios = test.NegativeAutoTest.\
+            generate_scenario(None)
+
+        self.assertIsInstance(scenarios, list)
+        for scenario in scenarios:
+            self.assertIsInstance(scenario, tuple)
+            self.assertIsInstance(scenario[0], str)
+            self.assertIsInstance(scenario[1], dict)
+        self._check_prop_entries(scenarios, "prop_minRam")
+        self._check_prop_entries(scenarios, "prop_minDisk")
+        self._check_resource_entries(scenarios, "inv_res")
diff --git a/tempest/tests/test_rest_client.py b/tempest/tests/test_rest_client.py
index f3c7440..ba43daf 100644
--- a/tempest/tests/test_rest_client.py
+++ b/tempest/tests/test_rest_client.py
@@ -13,29 +13,34 @@
 #    under the License.
 
 import httplib2
+import json
 
 from tempest.common import rest_client
 from tempest import config
 from tempest import exceptions
 from tempest.openstack.common.fixture import mockpatch
+from tempest.services.compute.xml import common as xml
 from tempest.tests import base
+from tempest.tests import fake_auth_provider
 from tempest.tests import fake_config
 from tempest.tests import fake_http
 
 
 class BaseRestClientTestClass(base.TestCase):
 
-    def _set_token(self):
-        self.rest_client.token = 'fake token'
+    url = 'fake_endpoint'
+
+    def _get_region(self):
+        return 'fake region'
 
     def setUp(self):
         super(BaseRestClientTestClass, self).setUp()
         self.stubs.Set(config, 'TempestConfigPrivate', fake_config.FakeConfig)
-        self.rest_client = rest_client.RestClient('fake_user', 'fake_pass',
-                                                  'http://fake_url/v2.0')
+        self.rest_client = rest_client.RestClient(
+            fake_auth_provider.FakeAuthProvider())
         self.stubs.Set(httplib2.Http, 'request', self.fake_http.request)
-        self.useFixture(mockpatch.PatchObject(self.rest_client, '_set_auth',
-                                              side_effect=self._set_token()))
+        self.useFixture(mockpatch.PatchObject(self.rest_client, '_get_region',
+                                              side_effect=self._get_region()))
         self.useFixture(mockpatch.PatchObject(self.rest_client,
                                               '_log_response'))
 
@@ -48,36 +53,33 @@
                                               '_error_checker'))
 
     def test_post(self):
-        __, return_dict = self.rest_client.post('fake_endpoint', {},
-                                                {})
+        __, return_dict = self.rest_client.post(self.url, {}, {})
         self.assertEqual('POST', return_dict['method'])
 
     def test_get(self):
-        __, return_dict = self.rest_client.get('fake_endpoint')
+        __, return_dict = self.rest_client.get(self.url)
         self.assertEqual('GET', return_dict['method'])
 
     def test_delete(self):
-        __, return_dict = self.rest_client.delete('fake_endpoint')
+        __, return_dict = self.rest_client.delete(self.url)
         self.assertEqual('DELETE', return_dict['method'])
 
     def test_patch(self):
-        __, return_dict = self.rest_client.patch('fake_endpoint', {},
-                                                 {})
+        __, return_dict = self.rest_client.patch(self.url, {}, {})
         self.assertEqual('PATCH', return_dict['method'])
 
     def test_put(self):
-        __, return_dict = self.rest_client.put('fake_endpoint', {},
-                                               {})
+        __, return_dict = self.rest_client.put(self.url, {}, {})
         self.assertEqual('PUT', return_dict['method'])
 
     def test_head(self):
         self.useFixture(mockpatch.PatchObject(self.rest_client,
                                               'response_checker'))
-        __, return_dict = self.rest_client.head('fake_endpoint')
+        __, return_dict = self.rest_client.head(self.url)
         self.assertEqual('HEAD', return_dict['method'])
 
     def test_copy(self):
-        __, return_dict = self.rest_client.copy('fake_endpoint')
+        __, return_dict = self.rest_client.copy(self.url)
         self.assertEqual('COPY', return_dict['method'])
 
 
@@ -88,4 +90,143 @@
 
     def test_post(self):
         self.assertRaises(exceptions.NotFound, self.rest_client.post,
-                          'fake_endpoint', {}, {})
+                          self.url, {}, {})
+
+
+class TestRestClientHeadersJSON(TestRestClientHTTPMethods):
+    TYPE = "json"
+
+    def _verify_headers(self, resp):
+        self.assertEqual(self.rest_client._get_type(), self.TYPE)
+        resp = dict((k.lower(), v) for k, v in resp.iteritems())
+        self.assertEqual(self.header_value, resp['accept'])
+        self.assertEqual(self.header_value, resp['content-type'])
+
+    def setUp(self):
+        super(TestRestClientHeadersJSON, self).setUp()
+        self.rest_client.TYPE = self.TYPE
+        self.header_value = 'application/%s' % self.rest_client._get_type()
+
+    def test_post(self):
+        resp, __ = self.rest_client.post(self.url, {})
+        self._verify_headers(resp)
+
+    def test_get(self):
+        resp, __ = self.rest_client.get(self.url)
+        self._verify_headers(resp)
+
+    def test_delete(self):
+        resp, __ = self.rest_client.delete(self.url)
+        self._verify_headers(resp)
+
+    def test_patch(self):
+        resp, __ = self.rest_client.patch(self.url, {})
+        self._verify_headers(resp)
+
+    def test_put(self):
+        resp, __ = self.rest_client.put(self.url, {})
+        self._verify_headers(resp)
+
+    def test_head(self):
+        self.useFixture(mockpatch.PatchObject(self.rest_client,
+                                              'response_checker'))
+        resp, __ = self.rest_client.head(self.url)
+        self._verify_headers(resp)
+
+    def test_copy(self):
+        resp, __ = self.rest_client.copy(self.url)
+        self._verify_headers(resp)
+
+
+class TestRestClientHeadersXML(TestRestClientHeadersJSON):
+    TYPE = "xml"
+
+    # These two tests are needed in one exemplar
+    def test_send_json_accept_xml(self):
+        resp, __ = self.rest_client.get(self.url,
+                                        self.rest_client.get_headers("xml",
+                                                                     "json"))
+        resp = dict((k.lower(), v) for k, v in resp.iteritems())
+        self.assertEqual("application/json", resp["content-type"])
+        self.assertEqual("application/xml", resp["accept"])
+
+    def test_send_xml_accept_json(self):
+        resp, __ = self.rest_client.get(self.url,
+                                        self.rest_client.get_headers("json",
+                                                                     "xml"))
+        resp = dict((k.lower(), v) for k, v in resp.iteritems())
+        self.assertEqual("application/json", resp["accept"])
+        self.assertEqual("application/xml", resp["content-type"])
+
+
+class TestRestClientParseRespXML(BaseRestClientTestClass):
+    TYPE = "xml"
+
+    keys = ["fake_key1", "fake_key2"]
+    values = ["fake_value1", "fake_value2"]
+    item_expected = {key: value for key, value in zip(keys, values)}
+    list_expected = {"body_list": [
+        {keys[0]: values[0]},
+        {keys[1]: values[1]},
+    ]}
+    dict_expected = {"body_dict": {
+        keys[0]: values[0],
+        keys[1]: values[1],
+    }}
+
+    def setUp(self):
+        self.fake_http = fake_http.fake_httplib2()
+        super(TestRestClientParseRespXML, self).setUp()
+        self.rest_client.TYPE = self.TYPE
+
+    def test_parse_resp_body_item(self):
+        body_item = xml.Element("item", **self.item_expected)
+        body = self.rest_client._parse_resp(str(xml.Document(body_item)))
+        self.assertEqual(self.item_expected, body)
+
+    def test_parse_resp_body_list(self):
+        self.rest_client.list_tags = ["fake_list", ]
+        body_list = xml.Element(self.rest_client.list_tags[0])
+        for i in range(2):
+            body_list.append(xml.Element("fake_item",
+                                         **self.list_expected["body_list"][i]))
+        body = self.rest_client._parse_resp(str(xml.Document(body_list)))
+        self.assertEqual(self.list_expected["body_list"], body)
+
+    def test_parse_resp_body_dict(self):
+        self.rest_client.dict_tags = ["fake_dict", ]
+        body_dict = xml.Element(self.rest_client.dict_tags[0])
+
+        for i in range(2):
+            body_dict.append(xml.Element("fake_item", xml.Text(self.values[i]),
+                                         key=self.keys[i]))
+
+        body = self.rest_client._parse_resp(str(xml.Document(body_dict)))
+        self.assertEqual(self.dict_expected["body_dict"], body)
+
+
+class TestRestClientParseRespJSON(TestRestClientParseRespXML):
+    TYPE = "json"
+
+    def test_parse_resp_body_item(self):
+        body = self.rest_client._parse_resp(json.dumps(self.item_expected))
+        self.assertEqual(self.item_expected, body)
+
+    def test_parse_resp_body_list(self):
+        body = self.rest_client._parse_resp(json.dumps(self.list_expected))
+        self.assertEqual(self.list_expected["body_list"], body)
+
+    def test_parse_resp_body_dict(self):
+        body = self.rest_client._parse_resp(json.dumps(self.dict_expected))
+        self.assertEqual(self.dict_expected["body_dict"], body)
+
+    def test_parse_resp_two_top_keys(self):
+        dict_two_keys = self.dict_expected.copy()
+        dict_two_keys.update({"second_key": ""})
+        body = self.rest_client._parse_resp(json.dumps(dict_two_keys))
+        self.assertEqual(dict_two_keys, body)
+
+    def test_parse_resp_one_top_key_without_list_or_dict(self):
+        data = {"one_top_key": "not_list_or_dict_value"}
+        body = self.rest_client._parse_resp(json.dumps(data))
+        self.assertEqual(data, body)
diff --git a/tempest/tests/test_ssh.py b/tempest/tests/test_ssh.py
index 429ed56..a6eedc4 100644
--- a/tempest/tests/test_ssh.py
+++ b/tempest/tests/test_ssh.py
@@ -88,15 +88,17 @@
         client_mock.connect.side_effect = [socket.error, socket.error, True]
         t_mock.side_effect = [
             1000,  # Start time
+            1000,  # LOG.warning() calls time.time() loop 1
             1001,  # Sleep loop 1
+            1001,  # LOG.warning() calls time.time() loop 2
             1002   # Sleep loop 2
         ]
 
         client._get_ssh_connection(sleep=1)
 
         expected_sleeps = [
-            mock.call(1),
-            mock.call(1.01)
+            mock.call(2),
+            mock.call(3)
         ]
         self.assertEqual(expected_sleeps, s_mock.mock_calls)
 
@@ -111,7 +113,9 @@
         ]
         t_mock.side_effect = [
             1000,  # Start time
+            1000,  # LOG.warning() calls time.time() loop 1
             1001,  # Sleep loop 1
+            1001,  # LOG.warning() calls time.time() loop 2
             1002,  # Sleep loop 2
             1003,  # Sleep loop 3
             1004  # LOG.error() calls time.time()
diff --git a/tools/check_logs.py b/tools/check_logs.py
index f3204e3..15988a6 100755
--- a/tools/check_logs.py
+++ b/tools/check_logs.py
@@ -28,7 +28,7 @@
 is_neutron = os.environ.get('DEVSTACK_GATE_NEUTRON', "0") == "1"
 is_grenade = (os.environ.get('DEVSTACK_GATE_GRENADE', "0") == "1" or
               os.environ.get('DEVSTACK_GATE_GRENADE_FORWARD', "0") == "1")
-dump_all_errors = is_neutron
+dump_all_errors = True
 
 
 def process_files(file_specs, url_specs, whitelists):
@@ -69,6 +69,7 @@
                     print_log_name = False
                 if not whitelisted:
                     had_errors = True
+                    print("*** Not Whitelisted ***"),
                 print(line)
     return had_errors
 
diff --git a/tools/verify_tempest_config.py b/tools/verify_tempest_config.py
index 913c90b..29eed9d 100755
--- a/tools/verify_tempest_config.py
+++ b/tools/verify_tempest_config.py
@@ -40,12 +40,12 @@
 
 
 def verify_nova_api_versions(os):
-    # Check nova api versions
-    os.servers_client._set_auth()
-    v2_endpoint = os.servers_client.base_url
-    endpoint = 'http://' + v2_endpoint.split('/')[2]
-    __, body = RAW_HTTP.request(endpoint, 'GET')
+    # Check nova api versions - only get base URL without PATH
+    os.servers_client.skip_path = True
+    __, body = RAW_HTTP.request(os.servers_client.base_url, 'GET')
     body = json.loads(body)
+    # Restore full base_url
+    os.servers_client.skip_path = False
     versions = map(lambda x: x['id'], body['versions'])
     if CONF.compute_feature_enabled.api_v3 != ('v3.0' in versions):
         print('Config option compute api_v3 should be change to: %s' % (
diff --git a/tox.ini b/tox.ini
index 88f2537..1580b14 100644
--- a/tox.ini
+++ b/tox.ini
@@ -6,9 +6,6 @@
 [testenv]
 sitepackages = True
 setenv = VIRTUAL_ENV={envdir}
-         LANG=en_US.UTF-8
-         LANGUAGE=en_US:en
-         LC_ALL=C
          OS_TEST_PATH=./tempest/test_discover
 usedevelop = True
 install_command = pip install {opts} {packages}
@@ -40,6 +37,12 @@
 commands =
   bash tools/pretty_tox.sh '(?!.*\[.*\bslow\b.*\])(^tempest\.(api|scenario|thirdparty|cli)) {posargs}'
 
+[testenv:full-serial]
+# The regex below is used to select which tests to run and exclude the slow tag:
+# See the testrepostiory bug: https://bugs.launchpad.net/testrepository/+bug/1208610
+commands =
+  bash tools/pretty_tox_serial.sh '(?!.*\[.*\bslow\b.*\])(^tempest\.(api|scenario|thirdparty|cli)) {posargs}'
+
 [testenv:testr-full]
 commands =
   bash tools/pretty_tox.sh '(?!.*\[.*\bslow\b.*\])(^tempest\.(api|scenario|thirdparty|cli)) {posargs}'