Merge ~freyes/ubuntu/+source/keystone:upstream into ~ubuntu-openstack-dev/ubuntu/+source/keystone:upstream

[Felipe Reyes]

diff --git a/.zuul.yaml b/.zuul.yaml
index fc3eebb..daadbc7 100644
--- a/.zuul.yaml
+++ b/.zuul.yaml
@@ -33,14 +33,6 @@
         USE_PYTHON3: True
 
 - job:
-    name: keystone-dsvm-py3-functional-fips
-    parent: keystone-dsvm-py3-functional
-    nodeset: devstack-single-node-centos-8-stream
-    description: |
-      Functional testing for a FIPS enabled Centos 8 system
-    pre-run: playbooks/enable-fips.yaml
-
-- job:
     name: keystone-dsvm-functional-federation-opensuse15
     parent: keystone-dsvm-functional
     nodeset: devstack-single-node-opensuse-15
@@ -110,6 +102,15 @@
       osa_test_repo: openstack/openstack-ansible-os_keystone
 
 - job:
+     name: keystone-tox-protection
+     parent: openstack-tox-py37
+     timeout: 3600
+     vars:
+       tox_envlist: protection
+       bindep_profile: test py37
+       python_version: 3.7
+
+- job:
     name: keystone-dsvm-ldap-domain-specific-driver
     parent: devstack-tempest
     vars:
@@ -209,7 +210,6 @@
       - check-requirements
       - integrated-gate-py3
       - release-notes-jobs-python3
-      - openstack-python3-wallaby-jobs-arm64
     check:
       jobs:
         - keystone-dsvm-py3-functional:
@@ -220,9 +220,6 @@
               - ^etc/.*$
               - ^keystone/tests/unit/.*$
               - ^releasenotes/.*$
-        - keystone-dsvm-py3-functional-fips:
-            voting: false
-            irrelevant-files: *irrelevant-files
         - keystone-dsvm-py3-functional-federation-ubuntu-focal:
             voting: false
             irrelevant-files: *irrelevant-files
@@ -248,7 +245,7 @@
             irrelevant-files: *tempest-irrelevant-files
         - tempest-ipv6-only:
             irrelevant-files: *tempest-irrelevant-files
-        - keystone-protection-functional
+        - keystone-tox-protection
     gate:
       jobs:
         - keystone-dsvm-py3-functional:
@@ -261,7 +258,7 @@
             irrelevant-files: *tempest-irrelevant-files
         - tempest-ipv6-only:
             irrelevant-files: *tempest-irrelevant-files
-        - keystone-protection-functional
+        - keystone-tox-protection
     experimental:
       jobs:
         - keystone-tox-patch_cover
@@ -271,6 +268,8 @@
             irrelevant-files: *irrelevant-files
         - tempest-pg-full:
             irrelevant-files: *tempest-irrelevant-files
+        - tempest-full-py3-opensuse15:
+            irrelevant-files: *tempest-irrelevant-files
         - keystone-dsvm-functional-federation-centos7:
             irrelevant-files: *irrelevant-files
         - keystone-dsvm-functional-federation-ubuntu-xenial:
diff --git a/AUTHORS b/AUTHORS
index e0e5154..558a789 100644
--- a/AUTHORS
+++ b/AUTHORS
@@ -1,7 +1,6 @@
 Adam Gandelman <[e-mail]>
 Adam Young <[e-mail]530>
 Adam Young <[e-mail]>
-Ade Lee <[e-mail]>
 Adipudi Praveena <padipudi@padipudi.(none)>
 Adrian Turjak <[e-mail]>
 Ajaya Agrawal <[e-mail]>
@@ -177,7 +176,6 @@ Ghe Rivero <[e-mail]>
 Gordon Chung <[e-mail]>
 Graham Hayes <[e-mail]>
 Grzegorz Grasza <[e-mail]>
-Grzegorz Grasza <[e-mail]>
 Guang Yee <[e-mail]>
 Guang Yee <[e-mail]>
 Guo Shan <[e-mail]>
@@ -199,7 +197,6 @@ Hervé Beraud <[e-mail]>
 Hidekazu Nakamura <[e-mail]>
 Hieu LE <[e-mail]>
 Hirofumi Ichihara <[e-mail]>
-Hironori Shiina <[e-mail]>
 Hongbin Lu <[e-mail]>
 Hugh Saunders <[e-mail]>
 Hugo Nicodemos <[e-mail]>
@@ -348,7 +345,6 @@ Matthew Thode <[e-mail]>
 Matthew Treinish <[e-mail]>
 Matthew Treinish <[e-mail]>
 Matthieu Huin <[e-mail]>
-Maurice Escher <[e-mail]>
 Michael Basnight <[e-mail]>
 Michael J Fork <[e-mail]>
 Michael Krotscheck <[e-mail]>
@@ -422,7 +418,6 @@ Robert Collins <[e-mail]>
 Robert Collins <[e-mail]>
 Robert H. Hyerle <[e-mail]>
 Robin Norwood <[e-mail]>
-Rodolfo Alonso Hernandez <[e-mail]>
 Rodolfo Alonso Hernandez <[e-mail]>
 Rodrigo Duarte <[e-mail]>
 Rodrigo Duarte Sousa <[e-mail]>
@@ -484,12 +479,10 @@ Sreyansh Jain <[e-mail]>
 Stanisław Pitucha <[e-mail]>
 Stef T <[e-mail]>
 Stephen Finucane <[e-mail]>
-Stephen Finucane <[e-mail]>
 Steve Baker <[e-mail]>
 Steve Martinelli <[e-mail]>
 Steve Martinelli <[e-mail]>
 Steven Hardy <[e-mail]>
-Stuart Grace <[e-mail]>
 Stuart McLaren <[e-mail]>
 Suramya Shah <[e-mail]>
 Sushil Kumar <[e-mail]>
@@ -499,7 +492,6 @@ Sylvain Afchain <[e-mail]>
 THOMAS J. COCOZZELLO <[e-mail]>
 Tahmina Ahmed <[e-mail]>
 Taishi Roy <[e-mail]>
-Takashi Kajinami <[e-mail]>
 Takashi NATSUME <[e-mail]>
 Telles Nobrega <[e-mail]>
 Theodore Ilie <[e-mail]>
@@ -564,7 +556,6 @@ Yong Sheng Gong <[e-mail]>
 Yong Sheng Gong <[e-mail]>
 You Ji <[e-mail]>
 You Yamagata <[e-mail]>
-YuehuiLei <[e-mail]>
 Yuiko Takada <[e-mail]>
 Yun Mao <[e-mail]>
 Yuriy Taraday <[e-mail]>
@@ -672,7 +663,6 @@ prashkre <[e-mail]>
 qinglin.cheng <[e-mail]>
 r-sekine <[e-mail]>
 rajat29 <[e-mail]>
-ricolin <[e-mail]>
 rocky <[e-mail]>
 root <root@newapps.(none)>
 rpedde <[e-mail]>
@@ -699,7 +689,6 @@ wanghui <[e-mail]>
 wanglong <[e-mail]>
 wangqiangbj <[e-mail]>
 wangxiyuan <[e-mail]>
-wangzihao <[e-mail]>
 werner mendizabal <[e-mail]>
 whoami-rajat <[e-mail]>
 wingwj <[e-mail]>
@@ -710,7 +699,6 @@ xingzhou <[e-mail]>
 xuhaigang <[e-mail]>
 xurong00037997 <[e-mail]>
 yanghuichan <[e-mail]>
-yangshaoxue <[e-mail]>
 yangweiwei <[e-mail]>
 yangyapeng <[e-mail]>
 yaroslavmt <[e-mail]>
diff --git a/ChangeLog b/ChangeLog
index d5d2a11..2f980e8 100644
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,64 +1,21 @@
 CHANGES
 =======
 
-* Add 'WarningsFixture'
-* Add support for pysaml2 >= 7.1.0
-* tox: Random fixups
-* Deprecate ineffective [memcache] options
-* Fix response code of 'Revoke Token' in api-ref
-* Accept STS and IAM services from Ceph Obj Gateway
-* Fix oslo policy warning assert in unit tests
-* Temporary exclude the common.sql.core.py from sphinx-apidoc target
-* Remove broken tempest-full-py3-opensuse15 job
-* Fix typos in application credential policies
-* Fix typo in identity provider policies
-* Update master for stable/xena
-* Improve performance on trust deletion
-* Replace deprecated assertDictContainsSubset
-
-20.0.0
+18.1.0
 ------
 
+* Fix typos in application credential policies
 * Fix typos in ec2 credential policies
-* Fix oslo policy DeprecatedRule warnings
-* Update local\_id limit to 255 characters
-* Add FIPS check job
-* Replace deprecated import of ABCs from collections
-* Moving IRC network reference to OFTC
-* Update master for stable/wallaby
-* Remove use of deprecated oslo.db options
-* docs: Fix failing build
-* Make DB queries compatible with SQLAlchemy 1.4.x
-* fix get\_security\_compliance\_domain\_config policy rule typo
-* setup.cfg: Replace dashes with underscores
+* Fix typo in identity provider policies
 * Hide AccountLocked exception from end users
 * Retry update\_user when sqlalchemy raises StaleDataErrors
-* Imported Translations from Zanata
-
-19.0.0.0rc1
------------
-
-* Add job for keystone functional protection tests
-* trivial: Update minor wording nit in RBAC persona documentation
-* Clarify top-level personas in RBAC documentation
-* Clarify \`\`reader\`\` role implementation in persona admin guide
-* [goal] Deprecate the JSON formatted policy file
-* Ignore oslo.db deprecating sqlalchemy-migrate warning
-* Add openstack-python3-wallaby-jobs-arm64 job
 * Support bytes type in generate\_public\_ID()
-* Imported Translations from Zanata
-* Drop lower-constraints job
-* fix E741 ambiguous variable name
-* fix E225 missing whitespace around operator
 * Use app cred user ID in policy enforcement
-* Generalize release note for bug 1878938
-* Use enforce\_new\_defaults when setting up keystone protection tests
+* Update TOX\_CONSTRAINTS\_FILE for stable/victoria
+* Drop lower-constraints job
+* Delete system role assignments from system\_assignment table
 * Implement more robust connection handling for asynchronous LDAP calls
-* Imported Translations from Zanata
-* Update master for stable/victoria
-* Add vine to lower-constraints
-* Simplify default config test
-* Replace assertItemsEqual with assertCountEqual
+* Update .gitreview for stable/victoria
 
 18.0.0
 ------
@@ -75,9 +32,7 @@ CHANGES
 * Spelling Fix
 * NIT: Spelling Fix
 * Properly handle octet (byte) strings when converting LDAP responses
-* Add support for functional RBAC tests
 * Fix invalid assertTrue which should be assertEqual
-* Delete system role assignments from system\_assignment table
 * Fix api-ref for list endpoints
 * Fix lower-constraint for PyMySQL
 * Fix doc for package mod\_wsgi on Centos8/RHEL8
diff --git a/PKG-INFO b/PKG-INFO
index 3b63a18..c4bc751 100644
--- a/PKG-INFO
+++ b/PKG-INFO
@@ -1,11 +1,73 @@
 Metadata-Version: 2.1
 Name: keystone
-Version: 20.1.0.dev27
+Version: 18.1.0
 Summary: OpenStack Identity
 Home-page: https://docs.openstack.org/keystone/latest
 Author: OpenStack
 Author-email: [e-mail]
 License: UNKNOWN
+Description: ==================
+        OpenStack Keystone
+        ==================
+        
+        .. image:: https://governance.openstack.org/tc/badges/keystone.svg
+            :target: https://governance.openstack.org/tc/reference/tags/index.html
+        
+        .. Change things from this point on
+        
+        OpenStack Keystone provides authentication, authorization and service discovery
+        mechanisms via HTTP primarily for use by projects in the OpenStack family. It
+        is most commonly deployed as an HTTP interface to existing identity systems,
+        such as LDAP.
+        
+        Developer documentation, the source of which is in ``doc/source/``, is
+        published at:
+        
+            https://docs.openstack.org/keystone/latest
+        
+        The API reference and documentation are available at:
+        
+            https://docs.openstack.org/api-ref/identity
+        
+        The canonical client library is available at:
+        
+            https://opendev.org/openstack/python-keystoneclient
+        
+        Documentation for cloud administrators is available at:
+        
+            https://docs.openstack.org/
+        
+        The source of documentation for cloud administrators is available at:
+        
+            https://opendev.org/openstack/openstack-manuals
+        
+        Information about our team meeting is available at:
+        
+            https://wiki.openstack.org/wiki/Meetings/KeystoneMeeting
+        
+        Release notes is available at:
+        
+            https://docs.openstack.org/releasenotes/keystone
+        
+        Bugs and feature requests are tracked on Launchpad at:
+        
+            https://bugs.launchpad.net/keystone
+        
+        Future design work is tracked at:
+        
+            https://specs.openstack.org/openstack/keystone-specs
+        
+        Contributors are encouraged to join IRC (``#openstack-keystone`` on freenode):
+        
+            https://wiki.openstack.org/wiki/IRC
+        
+        Source for the project:
+        
+            https://opendev.org/openstack/keystone
+        
+        For information on contributing to Keystone, see ``CONTRIBUTING.rst``.
+        
+        
 Platform: UNKNOWN
 Classifier: Environment :: OpenStack
 Classifier: Intended Audience :: Information Technology
@@ -24,69 +86,3 @@ Provides-Extra: ldap
 Provides-Extra: memcache
 Provides-Extra: mongodb
 Provides-Extra: test
-License-File: LICENSE
-License-File: AUTHORS
-
-==================
-OpenStack Keystone
-==================
-
-.. image:: https://governance.openstack.org/tc/badges/keystone.svg
-    :target: https://governance.openstack.org/tc/reference/tags/index.html
-
-.. Change things from this point on
-
-OpenStack Keystone provides authentication, authorization and service discovery
-mechanisms via HTTP primarily for use by projects in the OpenStack family. It
-is most commonly deployed as an HTTP interface to existing identity systems,
-such as LDAP.
-
-Developer documentation, the source of which is in ``doc/source/``, is
-published at:
-
-    https://docs.openstack.org/keystone/latest
-
-The API reference and documentation are available at:
-
-    https://docs.openstack.org/api-ref/identity
-
-The canonical client library is available at:
-
-    https://opendev.org/openstack/python-keystoneclient
-
-Documentation for cloud administrators is available at:
-
-    https://docs.openstack.org/
-
-The source of documentation for cloud administrators is available at:
-
-    https://opendev.org/openstack/openstack-manuals
-
-Information about our team meeting is available at:
-
-    https://wiki.openstack.org/wiki/Meetings/KeystoneMeeting
-
-Release notes is available at:
-
-    https://docs.openstack.org/releasenotes/keystone
-
-Bugs and feature requests are tracked on Launchpad at:
-
-    https://bugs.launchpad.net/keystone
-
-Future design work is tracked at:
-
-    https://specs.openstack.org/openstack/keystone-specs
-
-Contributors are encouraged to join IRC (``#openstack-keystone`` on OFTC):
-
-    https://wiki.openstack.org/wiki/IRC
-
-Source for the project:
-
-    https://opendev.org/openstack/keystone
-
-For information on contributing to Keystone, see ``CONTRIBUTING.rst``.
-
-
-
diff --git a/README.rst b/README.rst
index 520a71e..2a19ff5 100644
--- a/README.rst
+++ b/README.rst
@@ -49,7 +49,7 @@ Future design work is tracked at:
 
     https://specs.openstack.org/openstack/keystone-specs
 
-Contributors are encouraged to join IRC (``#openstack-keystone`` on OFTC):
+Contributors are encouraged to join IRC (``#openstack-keystone`` on freenode):
 
     https://wiki.openstack.org/wiki/IRC
 
diff --git a/api-ref/source/v3/authenticate-v3.inc b/api-ref/source/v3/authenticate-v3.inc
index d69972a..11f19cb 100644
--- a/api-ref/source/v3/authenticate-v3.inc
+++ b/api-ref/source/v3/authenticate-v3.inc
@@ -965,7 +965,7 @@ Status Codes
 
 .. rest_status_code:: success status.yaml
 
-   - 204
+   - 201
 
 .. rest_status_code:: error status.yaml
 
diff --git a/devstack/lib/scope.sh b/devstack/lib/scope.sh
deleted file mode 100644
index 255ed69..0000000
--- a/devstack/lib/scope.sh
+++ /dev/null
@@ -1,26 +0,0 @@
-# Copyright 2019 SUSE LLC
-#
-# Licensed under the Apache License, Version 2.0 (the "License"); you may
-# not use this file except in compliance with the License. You may obtain
-# a copy of the License at
-#
-#      http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-# License for the specific language governing permissions and limitations
-# under the License.
-
-function configure_enforce_scope {
-    iniset $KEYSTONE_CONF oslo_policy enforce_scope true
-    iniset $KEYSTONE_CONF oslo_policy enforce_new_defaults true
-    iniset $KEYSTONE_CONF oslo_policy policy_file policy.yaml
-    sudo systemctl restart devstack@keystone
-}
-
-function configure_protection_tests {
-    iniset $TEMPEST_CONFIG identity-feature-enabled enforce_scope true
-    iniset $TEMPEST_CONFIG auth admin_system true
-    iniset $TEMPEST_CONFIG auth admin_project_name ''
-}
diff --git a/devstack/plugin.sh b/devstack/plugin.sh
index 8f7a385..924b820 100644
--- a/devstack/plugin.sh
+++ b/devstack/plugin.sh
@@ -15,7 +15,6 @@
 
 KEYSTONE_PLUGIN=$DEST/keystone/devstack
 source $KEYSTONE_PLUGIN/lib/federation.sh
-source $KEYSTONE_PLUGIN/lib/scope.sh
 
 # For more information on Devstack plugins, including a more detailed
 # explanation on when the different steps are executed please see:
@@ -48,12 +47,6 @@ elif [[ "$1" == "stack" && "$2" == "test-config" ]]; then
     if is_service_enabled keystone-saml2-federation; then
         configure_tests_settings
     fi
-    if [[ "$(trueorfalse False KEYSTONE_ENFORCE_SCOPE)" == "True" ]] ; then
-        # devstack and tempest assume enforce_scope is false, so need to wait
-        # until the final phase to turn it on
-        configure_enforce_scope
-        configure_protection_tests
-    fi
 fi
 
 if [[ "$1" == "unstack" ]]; then
diff --git a/doc/source/admin/cli-manage-projects-users-and-roles.rst b/doc/source/admin/cli-manage-projects-users-and-roles.rst
index 8d2f837..f27979d 100644
--- a/doc/source/admin/cli-manage-projects-users-and-roles.rst
+++ b/doc/source/admin/cli-manage-projects-users-and-roles.rst
@@ -10,8 +10,8 @@ define which actions users can perform. You assign roles to
 user-project pairs.
 
 You can define actions for OpenStack service roles in the
-``/etc/PROJECT/policy.yaml`` files. For example, define actions for
-Compute service roles in the ``/etc/nova/policy.yaml`` file.
+``/etc/PROJECT/policy.json`` files. For example, define actions for
+Compute service roles in the ``/etc/nova/policy.json`` file.
 
 You can manage projects, users, and roles independently from each other.
 
diff --git a/doc/source/admin/domain-specific-config.inc b/doc/source/admin/domain-specific-config.inc
index 2d8f993..3797e30 100644
--- a/doc/source/admin/domain-specific-config.inc
+++ b/doc/source/admin/domain-specific-config.inc
@@ -146,12 +146,6 @@ then the same public ID will be created. This is useful if you are running
 multiple keystones and want to ensure the same ID would be generated whichever
 server you hit.
 
-.. NOTE::
-
-    In case of the LDAP backend, the names of users and groups are not hashed.
-    As a result, these are length limited to 255 characters. Longer names
-    will result in an error.
-
 While keystone will dynamically maintain the identity mapping, including
 removing entries when entities are deleted via the keystone, for those entities
 in backends that are managed outside of keystone (e.g. a read-only LDAP),
diff --git a/doc/source/admin/identity-concepts.rst b/doc/source/admin/identity-concepts.rst
index 0f8cfc5..3d615c0 100644
--- a/doc/source/admin/identity-concepts.rst
+++ b/doc/source/admin/identity-concepts.rst
@@ -122,9 +122,9 @@ Identity user management examples:
      Individual services assign meaning to roles, typically through
      limiting or granting access to users with the role to the
      operations that the service supports. Role access is typically
-     configured in the service's ``policy.yaml`` file. For example,
+     configured in the service's ``policy.json`` file. For example,
      to limit Compute access to the ``compute-user`` role, edit the
-     Compute service's ``policy.yaml`` file to require this role for
+     Compute service's ``policy.json`` file to require this role for
      Compute operations.
 
 The Identity service assigns a project and a role to a user. You might
@@ -139,25 +139,25 @@ A user can have different roles in different projects. For example, Alice
 might also have the ``admin`` role in the ``Cyberdyne`` project. A user
 can also have multiple roles in the same project.
 
-The ``/etc/[SERVICE_CODENAME]/policy.yaml`` file controls the
+The ``/etc/[SERVICE_CODENAME]/policy.json`` file controls the
 tasks that users can perform for a given service. For example, the
-``/etc/nova/policy.yaml`` file specifies the access policy for the
-Compute service, the ``/etc/glance/policy.yaml`` file specifies
+``/etc/nova/policy.json`` file specifies the access policy for the
+Compute service, the ``/etc/glance/policy.json`` file specifies
 the access policy for the Image service, and the
-``/etc/keystone/policy.yaml`` file specifies the access policy for
+``/etc/keystone/policy.json`` file specifies the access policy for
 the Identity service.
 
-The default ``policy.yaml`` files in the Compute, Identity, and
+The default ``policy.json`` files in the Compute, Identity, and
 Image services recognize only the ``admin`` role. Any user with
 any role in a project can access all operations that do not require the
 ``admin`` role.
 
 To restrict users from performing operations in, for example, the
 Compute service, you must create a role in the Identity service and
-then modify the ``/etc/nova/policy.yaml`` file so that this role
+then modify the ``/etc/nova/policy.json`` file so that this role
 is required for Compute operations.
 
-For example, the following line in the ``/etc/cinder/policy.yaml``
+For example, the following line in the ``/etc/cinder/policy.json``
 file does not restrict which users can create volumes:
 
 .. code-block:: none
diff --git a/doc/source/admin/service-api-protection.rst b/doc/source/admin/service-api-protection.rst
index 47886ae..80b8af1 100644
--- a/doc/source/admin/service-api-protection.rst
+++ b/doc/source/admin/service-api-protection.rst
@@ -10,16 +10,14 @@ Like most OpenStack services, keystone protects its API using role-based access
 control (RBAC).
 
 Users can access different APIs depending on the roles they have on a project,
-domain, or system, which we refer to as scope.
+domain, or system.
 
 As of the Rocky release, keystone provides three roles called ``admin``,
 ``member``, and ``reader`` by default. Operators can grant these roles to any
-actor (e.g., group or user) on any scope (e.g., system, domain, or project).
+actor (e.g., group or user) on any target (e.g., system, domain, or project).
 If you need a refresher on authorization scopes and token types, please refer
 to the `token guide`_. The following sections describe how each default role
-behaves with keystone's API across different scopes. Additionally, other
-service developers can use this document as a guide for implementing similar
-patterns in their services.
+behaves with keystone's API across different scopes.
 
 Default roles and behaviors across scopes allow operators to delegate more
 functionality to their team, auditors, customers, and users without maintaining
@@ -31,10 +29,9 @@ custom policies.
 Roles Definitions
 -----------------
 
-The default roles provided by keystone, via ``keystone-manage boostrap``, are
-related through role implications. The ``admin`` role implies the ``member``
-role, and the ``member`` role implies the ``reader`` role. These implications
-mean users with the ``admin`` role automatically have the ``member`` and
+The default roles imply one another. The ``admin`` role implies the ``member``
+role, and the ``member`` role implies the ``reader`` role. This implication
+means users with the ``admin`` role automatically have the ``member`` and
 ``reader`` roles. Additionally, users with the ``member`` role automatically
 have the ``reader`` role. Implying roles reduces role assignments and forms a
 natural hierarchy between the default roles. It also reduces the complexity of
@@ -54,26 +51,6 @@ Instead of:
 Reader
 ======
 
-.. warning::
-
-   While it's possible to use the ``reader`` role to perform audits, we highly
-   recommend assessing the viability of using ``reader`` for auditing from the
-   perspective of the compliance target you're pursuing.
-
-   The ``reader`` role is the least-privileged role within the role hierarchy
-   described here. As such, OpenStack development teams, by default, do not
-   advocate exposing sensitive information to users with the ``reader`` role,
-   regardless of the scope. We have noted the need for a formal, read-only,
-   role that is useful for inspecting all applicable resources within a
-   particular scope, but it shouldn't be implemented as the lowest level of
-   authorization. This work will come in a subsequent release where we support
-   an elevated read-only role, that implies ``reader``, but also exposes
-   sensitive information, where applicable.
-
-   This will allow operators to grant third-party auditors a permissive role
-   for viewing sensitive information, specifically for compliance targets that
-   require it.
-
 The ``reader`` role provides read-only access to resources within the system, a
 domain, or a project. Depending on the assignment scope, two users with the
 ``reader`` role can expect different API behaviors. For example, a user with
@@ -87,20 +64,6 @@ roles. For example, to accomplish this without analyzing assignment scope, you
 would need ``system-reader``, ``domain-reader``, and ``project-reader`` roles
 in addition to custom policies for each service.
 
-It's imperative to note that ``reader`` is the least authoritative role in the
-hierarchy because assignments using ``admin`` or ``member`` ultimately include
-the ``reader`` role. We document this explicitly so that ``reader`` roles are not
-overloaded with read-only access to sensitive information. For example, a deployment
-pursuing a specific compliance target may want to leverage the ``reader`` role
-to perform the audit. If the audit requires the auditor to evaluate sensitive
-information, like license keys or administrative metadata, within a given
-scope, auditors shouldn't expect to perform these operations with the
-``reader`` role. We justify this design decision because sensitive information
-should be explicitly protected, and not implicitly exposed.
-
-The ``reader`` role should be implemented and used from the perspective of
-least-privilege, which may or may not fulfill your auditing use case.
-
 Member
 ======
 
@@ -132,30 +95,9 @@ services are addressing this individually at their own pace).
    As of the Train release, keystone applies the following personas
    consistently across its API.
 
----------------
-System Personas
----------------
-
-This section describes authorization personas typically used for operators and
-deployers. You can find all users with system role assignments using the
-following query:
-
-.. code-block:: console
-
-    $ openstack role assignment list --names --system all
-    +--------+------------------------+------------------------+---------+--------+--------+-----------+
-    | Role   | User                   | Group                  | Project | Domain | System | Inherited |
-    +--------+------------------------+------------------------+---------+--------+--------+-----------+
-    | admin  |                        | system-admins@Default  |         |        | all    | False     |
-    | admin  | admin@Default          |                        |         |        | all    | False     |
-    | admin  | operator@Default       |                        |         |        | all    | False     |
-    | reader |                        | system-support@Default |         |        | all    | False     |
-    | admin  | operator@Default       |                        |         |        | all    | False     |
-    | member | system-support@Default |                        |         |        | all    | False     |
-    +--------+------------------------+------------------------+---------+--------+--------+-----------+
-
+---------------------
 System Administrators
-=====================
+---------------------
 
 *System administrators* are allowed to manage every resource in keystone.
 System administrators are typically operators and cloud administrators. They
@@ -169,7 +111,7 @@ assignments:
 
 .. code-block:: console
 
-    $ openstack role assignment list --names --system all --role admin
+    $ openstack role assignment list --names --system all
     +-------+------------------+-----------------------+---------+--------+--------+-----------+
     | Role  | User             | Group                 | Project | Domain | System | Inherited |
     +-------+------------------+-----------------------+---------+--------+--------+-----------+
@@ -178,57 +120,38 @@ assignments:
     | admin | operator@Default |                       |         |        | all    | False     |
     +-------+------------------+-----------------------+---------+--------+--------+-----------+
 
+-------------------------------
 System Members & System Readers
-===============================
+-------------------------------
 
 In keystone, *system members* and *system readers* are very similar and have
 the same authorization. Users with these roles on the system can view all
-resources within keystone. They can list role assignments, users, projects, and
-group memberships, among other resources.
+resources within keystone. They can audit role assignments, users, projects,
+and group memberships, among other resources.
 
-The *system reader* persona is useful for members of a support team or auditors
-if the audit doesn't require access to sensitive information. You can find
-*system members* and *system readers* in your deployment with the following
-assignments:
+The *system reader* persona is useful for auditors or members of a support
+team. You can find *system members* and *system readers* in your deployment
+with the following assignments:
 
 .. code-block:: console
 
     $ openstack role assignment list --names --system all --role member --role reader
-    +--------+------------------------+------------------------+---------+--------+--------+-----------+
-    | Role   | User                   | Group                  | Project | Domain | System | Inherited |
-    +--------+------------------------+------------------------+---------+--------+--------+-----------+
-    | reader |                        | system-support@Default |         |        | all    | False     |
-    | admin  | operator@Default       |                        |         |        | all    | False     |
-    | member | system-support@Default |                        |         |        | all    | False     |
-    +--------+------------------------+------------------------+---------+--------+--------+-----------+
+    +--------+------------------------+-------------------------+---------+--------+--------+-----------+
+    | Role   | User                   | Group                   | Project | Domain | System | Inherited |
+    +--------+------------------------+-------------------------+---------+--------+--------+-----------+
+    | reader |                        | system-auditors@Default |         |        | all    | False     |
+    | admin  | operator@Default       |                         |         |        | all    | False     |
+    | member | system-support@Default |                         |         |        | all    | False     |
+    +--------+------------------------+-------------------------+---------+--------+--------+-----------+
 
 .. warning::
 
    Filtering system role assignments is currently broken and is being tracked
    as a `bug <https://bugs.launchpad.net/keystone/+bug/1846817>`_.
 
----------------
-Domain Personas
----------------
-
-This section describes authorization personas for people who manage their own
-domains, which contain projects, users, and groups. You can find all users with
-role assignments on a specific domain using the following query:
-
-.. code-block:: console
-
-    $ openstack role assignment list --names --domain foobar
-    +--------+-----------------+----------------------+---------+--------+--------+-----------+
-    | Role   | User            | Group                | Project | Domain | System | Inherited |
-    +--------+-----------------+----------------------+---------+--------+--------+-----------+
-    | reader | support@Default |                      |         | foobar |        | False     |
-    | admin  | jsmith@Default  |                      |         | foobar |        | False     |
-    | admin  |                 | foobar-admins@foobar |         | foobar |        | False     |
-    | member | jdoe@foobar     |                      |         | foobar |        | False     |
-    +--------+-----------------+----------------------+---------+--------+--------+-----------+
-
+---------------------
 Domain Administrators
-=====================
+---------------------
 
 *Domain administrators* can manage most aspects of the domain or its contents.
 These users can create new projects and users within their domain. They can
@@ -251,18 +174,18 @@ assignment:
     | admin |                | foobar-admins@foobar |         | foobar |        | False     |
     +-------+----------------+----------------------+---------+--------+--------+-----------+
 
+-------------------------------
 Domain Members & Domain Readers
-===============================
+-------------------------------
 
 Domain members and domain readers have the same relationship as system members
 and system readers. They're allowed to view resources and information about
 their domain. They aren't allowed to access system-specific information or
 information about projects, groups, and users outside their domain.
 
-The domain member and domain reader use-cases are great for support teams,
-monitoring the details of an account, or auditing resources within a domain
-assuming the audit doesn't validate sensitive information. You can find domain
-members and domain readers with the following role assignments:
+The domain member and domain reader use-cases are great for auditing, support,
+or monitoring the details of an account. You can find domain members and domain
+readers with the following role assignments:
 
 .. code-block:: console
 
@@ -276,35 +199,16 @@ members and domain readers with the following role assignments:
     +--------+-----------------+-------+---------+--------+--------+-----------+
     | Role   | User            | Group | Project | Domain | System | Inherited |
     +--------+-----------------+-------+---------+--------+--------+-----------+
-    | reader | support@Default |       |         | foobar |        | False     |
+    | reader | auditor@Default |       |         | foobar |        | False     |
     +--------+-----------------+-------+---------+--------+--------+-----------+
 
-----------------
-Project Personas
-----------------
-
-This section describes authorization personas for users operating within a
-project. These personas are commonly used by end users. You can find all users
-with role assignments on a specific project using the following query:
-
-.. code-block:: console
-
-    $ openstack role assignment list --names --project production
-    +--------+----------------+----------------------------+-------------------+--------+--------+-----------+
-    | Role   | User           | Group                      | Project           | Domain | System | Inherited |
-    +--------+----------------+----------------------------+-------------------+--------+--------+-----------+
-    | admin  | jsmith@Default |                            | production@foobar |        |        | False     |
-    | admin  |                | production-admins@foobar   | production@foobar |        |        | False     |
-    | member |                | foobar-operators@Default   | production@foobar |        |        | False     |
-    | reader | alice@Default  |                            | production@foobar |        |        | False     |
-    | reader |                | production-support@Default | production@foobar |        |        | False     |
-    +--------+----------------+----------------------------+-------------------+--------+--------+-----------+
 
+----------------------
 Project Administrators
-======================
+----------------------
 
-*Project administrators* can only view and modify data within the project they
-have authorization on. They're able to view information about their projects
+*Project administrators* can only view and modify data within the project in
+their role assignment. They're able to view information about their projects
 and set tags on their projects. They're not allowed to view system or domain
 resources, as that would violate the tenancy of their role assignment. Since
 the majority of the resources in keystone's API are system and domain-specific,
@@ -323,8 +227,9 @@ role assignment:
     | admin |                | production-admins@foobar | production@foobar |        |        | False     |
     +-------+----------------+--------------------------+-------------------+--------+--------+-----------+
 
+---------------------------------
 Project Members & Project Readers
-=================================
+---------------------------------
 
 *Project members* and *project readers* can discover information about their
 projects. They can access important information like resource limits for their
@@ -344,12 +249,12 @@ the following role assignments:
     | member |      | foobar-operators@Default | production@foobar |        |        | False     |
     +--------+------+--------------------------+-------------------+--------+--------+-----------+
     $ openstack role assignment list --names --project production --role reader
-    +--------+---------------+----------------------------+-------------------+--------+--------+-----------+
-    | Role   | User          | Group                      | Project           | Domain | System | Inherited |
-    +--------+---------------+----------------------------+-------------------+--------+--------+-----------+
-    | reader | alice@Default |                            | production@foobar |        |        | False     |
-    | reader |               | production-support@Default | production@foobar |        |        | False     |
-    +--------+---------------+----------------------------+-------------------+--------+--------+-----------+
+    +--------+-----------------+----------------------------+-------------------+--------+--------+-----------+
+    | Role   | User            | Group                      | Project           | Domain | System | Inherited |
+    +--------+-----------------+----------------------------+-------------------+--------+--------+-----------+
+    | reader | auditor@Default |                            | production@foobar |        |        | False     |
+    | reader |                 | production-support@Default | production@foobar |        |        | False     |
+    +--------+-----------------+----------------------------+-------------------+--------+--------+-----------+
 
 ----------------
 Writing Policies
diff --git a/doc/source/admin/upgrading.rst b/doc/source/admin/upgrading.rst
index 709d98d..687dba4 100644
--- a/doc/source/admin/upgrading.rst
+++ b/doc/source/admin/upgrading.rst
@@ -42,7 +42,7 @@ Plan your upgrade:
   to re-read the release notes for the previous release (or two!).
 
 * Prepare your new configuration files, including ``keystone.conf``,
-  ``logging.conf``, ``policy.yaml``, ``keystone-paste.ini``, and anything else
+  ``logging.conf``, ``policy.json``, ``keystone-paste.ini``, and anything else
   in ``/etc/keystone/``, by customizing the corresponding files from the next
   release.
 
diff --git a/doc/source/conf.py b/doc/source/conf.py
index 45cd82f..819c1d9 100644
--- a/doc/source/conf.py
+++ b/doc/source/conf.py
@@ -55,11 +55,7 @@ apidoc_output_dir = 'api'
 apidoc_excluded_paths = [
     'tests/*',
     'tests',
-    'test',
-    # TODO(gmann): with new release of SQLAlchemy(1.4.27) TypeDecorator used
-    # in common/sql/core.py file started failing. Remove this oncethe issue of
-    # TypeDecorator is fixed.
-    'common/sql/core.py']
+    'test']
 apidoc_separate_modules = True
 
 # sphinxcontrib.seqdiag options
diff --git a/doc/source/configuration/policy.rst b/doc/source/configuration/policy.rst
index 3f80c5e..daafdea 100644
--- a/doc/source/configuration/policy.rst
+++ b/doc/source/configuration/policy.rst
@@ -2,15 +2,6 @@
 Policy configuration
 ====================
 
-.. warning::
-
-   JSON formatted policy file is deprecated since Keystone 19.0.0 (Wallaby).
-   This `oslopolicy-convert-json-to-yaml`__ tool will migrate your existing
-   JSON-formatted policy file to YAML in a backward-compatible way.
-
-.. __: https://docs.openstack.org/oslo.policy/latest/cli/oslopolicy-convert-json-to-yaml.html
-
-
 Configuration
 ~~~~~~~~~~~~~
 
diff --git a/doc/source/contributor/how-can-i-help.rst b/doc/source/contributor/how-can-i-help.rst
index 47c2f4a..4e37af0 100644
--- a/doc/source/contributor/how-can-i-help.rst
+++ b/doc/source/contributor/how-can-i-help.rst
@@ -50,7 +50,7 @@ become part of the team:
   You can also subscribe to email notifications for new bugs.
 * Subscribe to the [e-mail] mailing list (filter on
   subject tag ``[keystone]``) and join the #openstack-keystone IRC channel on
-  OFTC. Help answer user support questions if you or your organization has
+  freenode. Help answer user support questions if you or your organization has
   faced and solved a similar problem, or chime in on design discussions that
   will affect you and your organization.
 * Check out the low hanging fruit bugs, submit patches to fix them:
diff --git a/doc/source/getting-started/community.rst b/doc/source/getting-started/community.rst
index 4598cd8..47145ad 100644
--- a/doc/source/getting-started/community.rst
+++ b/doc/source/getting-started/community.rst
@@ -34,10 +34,10 @@ from feature designs to documentation to testing to deployment scripts.
 .. _Launchpad: https://launchpad.net/keystone
 .. _wiki: https://wiki.openstack.org/
 
-#openstack-keystone on OFTC IRC Network
----------------------------------------
+#openstack-keystone on Freenode IRC Network
+-------------------------------------------
 
-You can find Keystone folks in `<irc://oftc.net/#openstack-keystone>`_.
+You can find Keystone folks in `<irc://freenode.net/#openstack-keystone>`_.
 This is usually the best place to ask questions and find your way around. IRC
 stands for Internet Relay Chat and it is a way to chat online in real time.
 You can also ask a question and come back to the log files to read the answer
diff --git a/doc/source/getting-started/policy_mapping.rst b/doc/source/getting-started/policy_mapping.rst
index a7cb27c..2975b45 100644
--- a/doc/source/getting-started/policy_mapping.rst
+++ b/doc/source/getting-started/policy_mapping.rst
@@ -2,7 +2,7 @@
 Mapping of policy target to API
 ===============================
 
-The following table shows the target in the policy.yaml file for each API.
+The following table shows the target in the policy.json file for each API.
 
 =========================================================  ===
 Target                                                     API
diff --git a/keystone.egg-info/PKG-INFO b/keystone.egg-info/PKG-INFO
index 3b63a18..c4bc751 100644
--- a/keystone.egg-info/PKG-INFO
+++ b/keystone.egg-info/PKG-INFO
@@ -1,11 +1,73 @@
 Metadata-Version: 2.1
 Name: keystone
-Version: 20.1.0.dev27
+Version: 18.1.0
 Summary: OpenStack Identity
 Home-page: https://docs.openstack.org/keystone/latest
 Author: OpenStack
 Author-email: [e-mail]
 License: UNKNOWN
+Description: ==================
+        OpenStack Keystone
+        ==================
+        
+        .. image:: https://governance.openstack.org/tc/badges/keystone.svg
+            :target: https://governance.openstack.org/tc/reference/tags/index.html
+        
+        .. Change things from this point on
+        
+        OpenStack Keystone provides authentication, authorization and service discovery
+        mechanisms via HTTP primarily for use by projects in the OpenStack family. It
+        is most commonly deployed as an HTTP interface to existing identity systems,
+        such as LDAP.
+        
+        Developer documentation, the source of which is in ``doc/source/``, is
+        published at:
+        
+            https://docs.openstack.org/keystone/latest
+        
+        The API reference and documentation are available at:
+        
+            https://docs.openstack.org/api-ref/identity
+        
+        The canonical client library is available at:
+        
+            https://opendev.org/openstack/python-keystoneclient
+        
+        Documentation for cloud administrators is available at:
+        
+            https://docs.openstack.org/
+        
+        The source of documentation for cloud administrators is available at:
+        
+            https://opendev.org/openstack/openstack-manuals
+        
+        Information about our team meeting is available at:
+        
+            https://wiki.openstack.org/wiki/Meetings/KeystoneMeeting
+        
+        Release notes is available at:
+        
+            https://docs.openstack.org/releasenotes/keystone
+        
+        Bugs and feature requests are tracked on Launchpad at:
+        
+            https://bugs.launchpad.net/keystone
+        
+        Future design work is tracked at:
+        
+            https://specs.openstack.org/openstack/keystone-specs
+        
+        Contributors are encouraged to join IRC (``#openstack-keystone`` on freenode):
+        
+            https://wiki.openstack.org/wiki/IRC
+        
+        Source for the project:
+        
+            https://opendev.org/openstack/keystone
+        
+        For information on contributing to Keystone, see ``CONTRIBUTING.rst``.
+        
+        
 Platform: UNKNOWN
 Classifier: Environment :: OpenStack
 Classifier: Intended Audience :: Information Technology
@@ -24,69 +86,3 @@ Provides-Extra: ldap
 Provides-Extra: memcache
 Provides-Extra: mongodb
 Provides-Extra: test
-License-File: LICENSE
-License-File: AUTHORS
-
-==================
-OpenStack Keystone
-==================
-
-.. image:: https://governance.openstack.org/tc/badges/keystone.svg
-    :target: https://governance.openstack.org/tc/reference/tags/index.html
-
-.. Change things from this point on
-
-OpenStack Keystone provides authentication, authorization and service discovery
-mechanisms via HTTP primarily for use by projects in the OpenStack family. It
-is most commonly deployed as an HTTP interface to existing identity systems,
-such as LDAP.
-
-Developer documentation, the source of which is in ``doc/source/``, is
-published at:
-
-    https://docs.openstack.org/keystone/latest
-
-The API reference and documentation are available at:
-
-    https://docs.openstack.org/api-ref/identity
-
-The canonical client library is available at:
-
-    https://opendev.org/openstack/python-keystoneclient
-
-Documentation for cloud administrators is available at:
-
-    https://docs.openstack.org/
-
-The source of documentation for cloud administrators is available at:
-
-    https://opendev.org/openstack/openstack-manuals
-
-Information about our team meeting is available at:
-
-    https://wiki.openstack.org/wiki/Meetings/KeystoneMeeting
-
-Release notes is available at:
-
-    https://docs.openstack.org/releasenotes/keystone
-
-Bugs and feature requests are tracked on Launchpad at:
-
-    https://bugs.launchpad.net/keystone
-
-Future design work is tracked at:
-
-    https://specs.openstack.org/openstack/keystone-specs
-
-Contributors are encouraged to join IRC (``#openstack-keystone`` on OFTC):
-
-    https://wiki.openstack.org/wiki/IRC
-
-Source for the project:
-
-    https://opendev.org/openstack/keystone
-
-For information on contributing to Keystone, see ``CONTRIBUTING.rst``.
-
-
-
diff --git a/keystone.egg-info/SOURCES.txt b/keystone.egg-info/SOURCES.txt
index fc8c6b6..b1af601 100644
--- a/keystone.egg-info/SOURCES.txt
+++ b/keystone.egg-info/SOURCES.txt
@@ -315,7 +315,6 @@ devstack/files/federation/shib_apache_alias.txt
 devstack/files/federation/shib_apache_handler.txt
 devstack/files/federation/shibboleth2.xml
 devstack/lib/federation.sh
-devstack/lib/scope.sh
 doc/Makefile
 doc/README.rst
 doc/requirements.txt
@@ -473,7 +472,6 @@ keystone.egg-info/SOURCES.txt
 keystone.egg-info/dependency_links.txt
 keystone.egg-info/entry_points.txt
 keystone.egg-info/not-zip-safe
-keystone.egg-info/pbr.json
 keystone.egg-info/requires.txt
 keystone.egg-info/top_level.txt
 keystone/api/__init__.py
@@ -705,7 +703,6 @@ keystone/common/sql/contract_repo/versions/075_placeholder.py
 keystone/common/sql/contract_repo/versions/076_placeholder.py
 keystone/common/sql/contract_repo/versions/077_placeholder.py
 keystone/common/sql/contract_repo/versions/078_placeholder.py
-keystone/common/sql/contract_repo/versions/079_contract_update_local_id_limit.py
 keystone/common/sql/contract_repo/versions/__init__.py
 keystone/common/sql/data_migration_repo/README
 keystone/common/sql/data_migration_repo/__init__.py
@@ -789,7 +786,6 @@ keystone/common/sql/data_migration_repo/versions/075_placeholder.py
 keystone/common/sql/data_migration_repo/versions/076_placeholder.py
 keystone/common/sql/data_migration_repo/versions/077_placeholder.py
 keystone/common/sql/data_migration_repo/versions/078_placeholder.py
-keystone/common/sql/data_migration_repo/versions/079_migrate_update_local_id_limit.py
 keystone/common/sql/data_migration_repo/versions/__init__.py
 keystone/common/sql/expand_repo/README
 keystone/common/sql/expand_repo/__init__.py
@@ -873,7 +869,6 @@ keystone/common/sql/expand_repo/versions/075_placeholder.py
 keystone/common/sql/expand_repo/versions/076_placeholder.py
 keystone/common/sql/expand_repo/versions/077_placeholder.py
 keystone/common/sql/expand_repo/versions/078_placeholder.py
-keystone/common/sql/expand_repo/versions/079_expand_update_local_id_limit.py
 keystone/common/sql/expand_repo/versions/__init__.py
 keystone/common/sql/migrate_repo/README
 keystone/common/sql/migrate_repo/__init__.py
@@ -1235,6 +1230,8 @@ keystone/tests/unit/config_files/backend_multi_ldap_sql.conf
 keystone/tests/unit/config_files/backend_pool_liveldap.conf
 keystone/tests/unit/config_files/backend_sql.conf
 keystone/tests/unit/config_files/backend_tls_liveldap.conf
+keystone/tests/unit/config_files/deprecated.conf
+keystone/tests/unit/config_files/deprecated_override.conf
 keystone/tests/unit/config_files/test_auth_plugin.conf
 keystone/tests/unit/config_files/domain_configs_default_ldap_one_sql/keystone.domain1.conf
 keystone/tests/unit/config_files/domain_configs_multi_ldap/keystone.Default.conf
@@ -1281,7 +1278,6 @@ keystone/tests/unit/ksfixtures/key_repository.py
 keystone/tests/unit/ksfixtures/ldapdb.py
 keystone/tests/unit/ksfixtures/policy.py
 keystone/tests/unit/ksfixtures/temporaryfile.py
-keystone/tests/unit/ksfixtures/warnings.py
 keystone/tests/unit/limit/__init__.py
 keystone/tests/unit/limit/test_backends.py
 keystone/tests/unit/policy/__init__.py
@@ -1328,7 +1324,6 @@ keystone/trust/backends/__init__.py
 keystone/trust/backends/base.py
 keystone/trust/backends/sql.py
 keystone_tempest_plugin/README.rst
-playbooks/enable-fips.yaml
 rally-jobs/README.rst
 rally-jobs/keystone.yaml
 releasenotes/notes/.placeholder
@@ -1573,11 +1568,8 @@ releasenotes/notes/bug-1885753-51df25f3ff1d9ae8.yaml
 releasenotes/notes/bug-1886017-bc2ad648d57101a2.yaml
 releasenotes/notes/bug-1889936-78d6853b5212b8f1.yaml
 releasenotes/notes/bug-1896125-b17a4d12730fe493.yaml
-releasenotes/notes/bug-1897280-e7065c4368a325ad.yaml
 releasenotes/notes/bug-1901207-13762f85b8a04481.yaml
 releasenotes/notes/bug-1901654-69b9f35d11cd0c75.yaml
-releasenotes/notes/bug-1929066-6e741c9182620a37.yaml
-releasenotes/notes/bug-1941020-f694395a9bcea72f.yaml
 releasenotes/notes/bug1828565-0790c4c60ba34100.yaml
 releasenotes/notes/bug_1526462-df9a3f3974d9040f.yaml
 releasenotes/notes/bug_1543048_and_1668503-7ead4e15faaab778.yaml
@@ -1588,7 +1580,6 @@ releasenotes/notes/catalog-caching-12f2532cfb71325a.yaml
 releasenotes/notes/catalog_project_id-519f5a70f9f7c4c6.yaml
 releasenotes/notes/convert-keystone-to-flask-80d980e239b662b0.yaml
 releasenotes/notes/deprecate-endpoint-policy-cfg-option-d018acab72a398a0.yaml
-releasenotes/notes/deprecate-json-formatted-policy-file-95f6307f88358f58.yaml
 releasenotes/notes/deprecate-memcache-token-persistence-eac88c80147ea241.yaml
 releasenotes/notes/deprecate-policies-api-b104fbd1d2367b1b.yaml
 releasenotes/notes/deprecate-v2-apis-894284c17be881d2.yaml
@@ -1678,15 +1669,10 @@ releasenotes/source/stein.rst
 releasenotes/source/train.rst
 releasenotes/source/unreleased.rst
 releasenotes/source/ussuri.rst
-releasenotes/source/victoria.rst
-releasenotes/source/wallaby.rst
-releasenotes/source/xena.rst
 releasenotes/source/_static/.placeholder
 releasenotes/source/_templates/.placeholder
 releasenotes/source/locale/en_GB/LC_MESSAGES/releasenotes.po
-releasenotes/source/locale/fr/LC_MESSAGES/releasenotes.po
 releasenotes/source/locale/ja/LC_MESSAGES/releasenotes.po
-releasenotes/source/locale/ko_KR/LC_MESSAGES/releasenotes.po
 tools/cover.sh
 tools/fast8.sh
 tools/sample_data.sh
diff --git a/keystone.egg-info/pbr.json b/keystone.egg-info/pbr.json
deleted file mode 100644
index 7de0b70..0000000
--- a/keystone.egg-info/pbr.json
+++ /dev/null
@@ -1 +0,0 @@
-{"git_version": "2ddf8f321", "is_release": false}
\ No newline at end of file
diff --git a/keystone.egg-info/requires.txt b/keystone.egg-info/requires.txt
index 7ca68f2..b85b25d 100644
--- a/keystone.egg-info/requires.txt
+++ b/keystone.egg-info/requires.txt
@@ -11,16 +11,16 @@ keystonemiddleware>=7.0.0
 msgpack>=0.5.0
 oauthlib>=0.6.2
 oslo.cache>=1.26.0
-oslo.config>=6.8.0
+oslo.config>=5.2.0
 oslo.context>=2.22.0
 oslo.db>=6.0.0
 oslo.i18n>=3.15.3
 oslo.log>=3.44.0
 oslo.messaging>=5.29.0
 oslo.middleware>=3.31.0
-oslo.policy>=3.7.0
+oslo.policy>=3.0.2
 oslo.serialization!=2.19.1,>=2.18.0
-oslo.upgradecheck>=1.3.0
+oslo.upgradecheck>=0.1.0
 oslo.utils>=3.33.0
 osprofiler>=1.4.0
 passlib>=1.7.0
diff --git a/keystone/api/s3tokens.py b/keystone/api/s3tokens.py
index 4a8439d..73d0b39 100644
--- a/keystone/api/s3tokens.py
+++ b/keystone/api/s3tokens.py
@@ -56,10 +56,7 @@ def _calculate_signature_v4(string_to_sign, secret_key):
     if len(parts) != 4 or parts[0] != b'AWS4-HMAC-SHA256':
         raise exception.Unauthorized(message=_('Invalid EC2 signature.'))
     scope = parts[2].split(b'/')
-    if len(scope) != 4 or scope[3] != b'aws4_request':
-        raise exception.Unauthorized(message=_('Invalid EC2 signature.'))
-    allowed_services = [b's3', b'iam', b'sts']
-    if scope[2] not in allowed_services:
+    if len(scope) != 4 or scope[2] != b's3' or scope[3] != b'aws4_request':
         raise exception.Unauthorized(message=_('Invalid EC2 signature.'))
 
     def _sign(key, msg):
diff --git a/keystone/cmd/status.py b/keystone/cmd/status.py
index 64b2e62..3585c2e 100644
--- a/keystone/cmd/status.py
+++ b/keystone/cmd/status.py
@@ -12,7 +12,6 @@
 
 from oslo_policy import _checks
 from oslo_policy import policy
-from oslo_upgradecheck import common_checks
 from oslo_upgradecheck import upgradecheck
 
 from keystone.common import driver_hints
@@ -87,8 +86,6 @@ class Checks(upgradecheck.UpgradeCommands):
          check_trust_policies_are_not_empty),
         ("Check default roles are immutable",
          check_default_roles_are_immutable),
-        ("Policy File JSON to YAML Migration",
-         (common_checks.check_policy_json, {'conf': CONF})),
     )
 
 
diff --git a/keystone/common/policies/application_credential.py b/keystone/common/policies/application_credential.py
index bae998a..e44c661 100644
--- a/keystone/common/policies/application_credential.py
+++ b/keystone/common/policies/application_credential.py
@@ -18,30 +18,23 @@ from keystone.common.policies import base
 collection_path = '/v3/users/{user_id}/application_credentials'
 resource_path = collection_path + '/{application_credential_id}'
 
-DEPRECATED_REASON = (
-    "The application credential API is now aware of system scope and default "
-    "roles."
-)
-
 deprecated_list_application_credentials_for_user = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_application_credentials',
-    check_str=base.RULE_ADMIN_OR_OWNER,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_OR_OWNER
 )
 deprecated_get_application_credentials_for_user = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_application_credential',
-    check_str=base.RULE_ADMIN_OR_OWNER,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_OR_OWNER
 )
 deprecated_delete_application_credentials_for_user = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_application_credential',
-    check_str=base.RULE_ADMIN_OR_OWNER,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_OR_OWNER
 )
 
+DEPRECATED_REASON = (
+    "The application credential API is now aware of system scope and default "
+    "roles."
+)
 
 application_credential_policies = [
     policy.DocumentedRuleDefault(
@@ -53,7 +46,9 @@ application_credential_policies = [
                      'method': 'GET'},
                     {'path': resource_path,
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_get_application_credentials_for_user),
+        deprecated_rule=deprecated_get_application_credentials_for_user,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_application_credentials',
         check_str=base.RULE_SYSTEM_READER_OR_OWNER,
@@ -63,7 +58,9 @@ application_credential_policies = [
                      'method': 'GET'},
                     {'path': collection_path,
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_list_application_credentials_for_user),
+        deprecated_rule=deprecated_list_application_credentials_for_user,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'create_application_credential',
         check_str=base.RULE_OWNER,
@@ -78,7 +75,9 @@ application_credential_policies = [
         description='Delete an application credential.',
         operations=[{'path': resource_path,
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_application_credentials_for_user)
+        deprecated_rule=deprecated_delete_application_credentials_for_user,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN)
 ]
 
 
diff --git a/keystone/common/policies/consumer.py b/keystone/common/policies/consumer.py
index 7931bf0..bf9a6bd 100644
--- a/keystone/common/policies/consumer.py
+++ b/keystone/common/policies/consumer.py
@@ -15,41 +15,30 @@ from oslo_policy import policy
 
 from keystone.common.policies import base
 
-DEPRECATED_REASON = (
-    "The OAUTH1 consumer API is now aware of system scope and default roles."
-)
-
 deprecated_get_consumer = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_consumer',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_list_consumers = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_consumers',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_create_consumer = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_consumer',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_update_consumer = policy.DeprecatedRule(
     name=base.IDENTITY % 'update_consumer',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_delete_consumer = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_consumer',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 
+DEPRECATED_REASON = (
+    "The OAUTH1 consumer API is now aware of system scope and default roles."
+)
 
 consumer_policies = [
     policy.DocumentedRuleDefault(
@@ -59,7 +48,9 @@ consumer_policies = [
         description='Show OAUTH1 consumer details.',
         operations=[{'path': '/v3/OS-OAUTH1/consumers/{consumer_id}',
                      'method': 'GET'}],
-        deprecated_rule=deprecated_get_consumer),
+        deprecated_rule=deprecated_get_consumer,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_consumers',
         check_str=base.SYSTEM_READER,
@@ -67,7 +58,9 @@ consumer_policies = [
         description='List OAUTH1 consumers.',
         operations=[{'path': '/v3/OS-OAUTH1/consumers',
                      'method': 'GET'}],
-        deprecated_rule=deprecated_list_consumers),
+        deprecated_rule=deprecated_list_consumers,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'create_consumer',
         check_str=base.SYSTEM_ADMIN,
@@ -75,7 +68,9 @@ consumer_policies = [
         description='Create OAUTH1 consumer.',
         operations=[{'path': '/v3/OS-OAUTH1/consumers',
                      'method': 'POST'}],
-        deprecated_rule=deprecated_create_consumer),
+        deprecated_rule=deprecated_create_consumer,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'update_consumer',
         check_str=base.SYSTEM_ADMIN,
@@ -83,7 +78,9 @@ consumer_policies = [
         description='Update OAUTH1 consumer.',
         operations=[{'path': '/v3/OS-OAUTH1/consumers/{consumer_id}',
                      'method': 'PATCH'}],
-        deprecated_rule=deprecated_update_consumer),
+        deprecated_rule=deprecated_update_consumer,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_consumer',
         check_str=base.SYSTEM_ADMIN,
@@ -91,7 +88,9 @@ consumer_policies = [
         description='Delete OAUTH1 consumer.',
         operations=[{'path': '/v3/OS-OAUTH1/consumers/{consumer_id}',
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_consumer),
+        deprecated_rule=deprecated_delete_consumer,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
 ]
 
 
diff --git a/keystone/common/policies/credential.py b/keystone/common/policies/credential.py
index 675e318..52a9fa8 100644
--- a/keystone/common/policies/credential.py
+++ b/keystone/common/policies/credential.py
@@ -21,33 +21,23 @@ DEPRECATED_REASON = (
 
 deprecated_get_credential = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_credential',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_list_credentials = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_credentials',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_create_credential = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_credential',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_update_credential = policy.DeprecatedRule(
     name=base.IDENTITY % 'update_credential',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_delete_credential = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_credential',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 
 
@@ -60,6 +50,8 @@ credential_policies = [
         operations=[{'path': '/v3/credentials/{credential_id}',
                      'method': 'GET'}],
         deprecated_rule=deprecated_get_credential,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_credentials',
@@ -69,6 +61,8 @@ credential_policies = [
         operations=[{'path': '/v3/credentials',
                      'method': 'GET'}],
         deprecated_rule=deprecated_list_credentials,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'create_credential',
@@ -78,6 +72,8 @@ credential_policies = [
         operations=[{'path': '/v3/credentials',
                      'method': 'POST'}],
         deprecated_rule=deprecated_create_credential,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'update_credential',
@@ -87,6 +83,8 @@ credential_policies = [
         operations=[{'path': '/v3/credentials/{credential_id}',
                      'method': 'PATCH'}],
         deprecated_rule=deprecated_update_credential,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_credential',
@@ -96,6 +94,8 @@ credential_policies = [
         operations=[{'path': '/v3/credentials/{credential_id}',
                      'method': 'DELETE'}],
         deprecated_rule=deprecated_delete_credential,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN
     )
 ]
 
diff --git a/keystone/common/policies/domain.py b/keystone/common/policies/domain.py
index cd743ee..7d3e3d7 100644
--- a/keystone/common/policies/domain.py
+++ b/keystone/common/policies/domain.py
@@ -21,33 +21,23 @@ DEPRECATED_REASON = (
 
 deprecated_list_domains = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_domains',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_get_domain = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_domain',
-    check_str=base.RULE_ADMIN_OR_TARGET_DOMAIN,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_OR_TARGET_DOMAIN
 )
 deprecated_update_domain = policy.DeprecatedRule(
     name=base.IDENTITY % 'update_domain',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_create_domain = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_domain',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_delete_domain = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_domain',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 SYSTEM_USER_OR_DOMAIN_USER_OR_PROJECT_USER = (
     '(role:reader and system_scope:all) or '
@@ -66,7 +56,9 @@ domain_policies = [
         description='Show domain details.',
         operations=[{'path': '/v3/domains/{domain_id}',
                      'method': 'GET'}],
-        deprecated_rule=deprecated_get_domain),
+        deprecated_rule=deprecated_get_domain,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_domains',
         check_str=base.SYSTEM_READER,
@@ -74,7 +66,9 @@ domain_policies = [
         description='List domains.',
         operations=[{'path': '/v3/domains',
                      'method': 'GET'}],
-        deprecated_rule=deprecated_list_domains),
+        deprecated_rule=deprecated_list_domains,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'create_domain',
         check_str=base.SYSTEM_ADMIN,
@@ -82,7 +76,9 @@ domain_policies = [
         description='Create domain.',
         operations=[{'path': '/v3/domains',
                      'method': 'POST'}],
-        deprecated_rule=deprecated_create_domain),
+        deprecated_rule=deprecated_create_domain,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'update_domain',
         check_str=base.SYSTEM_ADMIN,
@@ -90,7 +86,9 @@ domain_policies = [
         description='Update domain.',
         operations=[{'path': '/v3/domains/{domain_id}',
                      'method': 'PATCH'}],
-        deprecated_rule=deprecated_update_domain),
+        deprecated_rule=deprecated_update_domain,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_domain',
         check_str=base.SYSTEM_ADMIN,
@@ -98,7 +96,9 @@ domain_policies = [
         description='Delete domain.',
         operations=[{'path': '/v3/domains/{domain_id}',
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_domain),
+        deprecated_rule=deprecated_delete_domain,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
 ]
 
 
diff --git a/keystone/common/policies/domain_config.py b/keystone/common/policies/domain_config.py
index b1c8fda..a157f0d 100644
--- a/keystone/common/policies/domain_config.py
+++ b/keystone/common/policies/domain_config.py
@@ -15,46 +15,36 @@ from oslo_policy import policy
 
 from keystone.common.policies import base
 
-DEPRECATED_REASON = (
-    "The domain config API is now aware of system scope and default roles."
-)
-
 deprecated_get_domain_config = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_domain_config',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_get_domain_config_default = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_domain_config_default',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_create_domain_config = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_domain_config',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_update_domain_config = policy.DeprecatedRule(
     name=base.IDENTITY % 'update_domain_config',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_delete_domain_config = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_domain_config',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 
+DEPRECATED_REASON = (
+    "The domain config API is now aware of system scope and default roles."
+)
+
 domain_config_policies = [
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'create_domain_config',
@@ -75,7 +65,9 @@ domain_config_policies = [
                 'method': 'PUT'
             }
         ],
-        deprecated_rule=deprecated_create_domain_config
+        deprecated_rule=deprecated_create_domain_config,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'get_domain_config',
@@ -111,6 +103,8 @@ domain_config_policies = [
             }
         ],
         deprecated_rule=deprecated_get_domain_config,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'get_security_compliance_domain_config',
@@ -130,12 +124,12 @@ domain_config_policies = [
                 'method': 'HEAD'
             },
             {
-                'path': ('/v3/domains/{domain_id}/config/'
+                'path': ('v3/domains/{domain_id}/config/'
                          'security_compliance/{option}'),
                 'method': 'GET'
             },
             {
-                'path': ('/v3/domains/{domain_id}/config/'
+                'path': ('v3/domains/{domain_id}/config/'
                          'security_compliance/{option}'),
                 'method': 'HEAD'
             }
@@ -162,6 +156,8 @@ domain_config_policies = [
             }
         ],
         deprecated_rule=deprecated_update_domain_config,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_domain_config',
@@ -184,6 +180,8 @@ domain_config_policies = [
             }
         ],
         deprecated_rule=deprecated_delete_domain_config,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'get_domain_config_default',
@@ -218,6 +216,8 @@ domain_config_policies = [
             }
         ],
         deprecated_rule=deprecated_get_domain_config_default,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN
     )
 ]
 
diff --git a/keystone/common/policies/ec2_credential.py b/keystone/common/policies/ec2_credential.py
index 9e52709..266a80e 100644
--- a/keystone/common/policies/ec2_credential.py
+++ b/keystone/common/policies/ec2_credential.py
@@ -15,35 +15,26 @@ from oslo_policy import policy
 
 from keystone.common.policies import base
 
-DEPRECATED_REASON = (
-    "The EC2 credential API is now aware of system scope and default roles."
-)
-
 deprecated_ec2_get_credential = policy.DeprecatedRule(
     name=base.IDENTITY % 'ec2_get_credential',
-    check_str=base.RULE_ADMIN_OR_CREDENTIAL_OWNER,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_OR_CREDENTIAL_OWNER
 )
 deprecated_ec2_list_credentials = policy.DeprecatedRule(
     name=base.IDENTITY % 'ec2_list_credentials',
-    check_str=base.RULE_ADMIN_OR_OWNER,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_OR_OWNER
 )
 deprecated_ec2_create_credential = policy.DeprecatedRule(
     name=base.IDENTITY % 'ec2_create_credential',
-    check_str=base.RULE_ADMIN_OR_OWNER,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_OR_OWNER
 )
 deprecated_ec2_delete_credential = policy.DeprecatedRule(
     name=base.IDENTITY % 'ec2_delete_credential',
-    check_str=base.RULE_ADMIN_OR_CREDENTIAL_OWNER,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_OR_CREDENTIAL_OWNER
 )
 
+DEPRECATED_REASON = (
+    "The EC2 credential API is now aware of system scope and default roles."
+)
 
 ec2_credential_policies = [
     policy.DocumentedRuleDefault(
@@ -54,7 +45,9 @@ ec2_credential_policies = [
         operations=[{'path': ('/v3/users/{user_id}/credentials/OS-EC2/'
                               '{credential_id}'),
                      'method': 'GET'}],
-        deprecated_rule=deprecated_ec2_get_credential
+        deprecated_rule=deprecated_ec2_get_credential,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'ec2_list_credentials',
@@ -64,6 +57,8 @@ ec2_credential_policies = [
         operations=[{'path': '/v3/users/{user_id}/credentials/OS-EC2',
                      'method': 'GET'}],
         deprecated_rule=deprecated_ec2_list_credentials,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'ec2_create_credential',
@@ -73,6 +68,8 @@ ec2_credential_policies = [
         operations=[{'path': '/v3/users/{user_id}/credentials/OS-EC2',
                      'method': 'POST'}],
         deprecated_rule=deprecated_ec2_create_credential,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'ec2_delete_credential',
@@ -83,6 +80,8 @@ ec2_credential_policies = [
                               '{credential_id}'),
                      'method': 'DELETE'}],
         deprecated_rule=deprecated_ec2_delete_credential,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN
     )
 ]
 
diff --git a/keystone/common/policies/endpoint.py b/keystone/common/policies/endpoint.py
index 7858249..b99a40e 100644
--- a/keystone/common/policies/endpoint.py
+++ b/keystone/common/policies/endpoint.py
@@ -15,34 +15,24 @@ from oslo_policy import policy
 
 from keystone.common.policies import base
 
-DEPRECATED_REASON = (
-    "The endpoint API is now aware of system scope and default roles."
-)
-
 deprecated_get_endpoint = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_endpoint', check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
 )
 deprecated_list_endpoints = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_endpoints', check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
 )
 deprecated_update_endpoint = policy.DeprecatedRule(
     name=base.IDENTITY % 'update_endpoint', check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
 )
 deprecated_create_endpoint = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_endpoint', check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
 )
 deprecated_delete_endpoint = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_endpoint', check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+)
+
+DEPRECATED_REASON = (
+    "The endpoint API is now aware of system scope and default roles."
 )
 
 
@@ -54,7 +44,9 @@ endpoint_policies = [
         description='Show endpoint details.',
         operations=[{'path': '/v3/endpoints/{endpoint_id}',
                      'method': 'GET'}],
-        deprecated_rule=deprecated_get_endpoint),
+        deprecated_rule=deprecated_get_endpoint,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_endpoints',
         check_str=base.SYSTEM_READER,
@@ -62,7 +54,9 @@ endpoint_policies = [
         description='List endpoints.',
         operations=[{'path': '/v3/endpoints',
                      'method': 'GET'}],
-        deprecated_rule=deprecated_list_endpoints),
+        deprecated_rule=deprecated_list_endpoints,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'create_endpoint',
         check_str=base.SYSTEM_ADMIN,
@@ -70,7 +64,9 @@ endpoint_policies = [
         description='Create endpoint.',
         operations=[{'path': '/v3/endpoints',
                      'method': 'POST'}],
-        deprecated_rule=deprecated_create_endpoint),
+        deprecated_rule=deprecated_create_endpoint,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'update_endpoint',
         check_str=base.SYSTEM_ADMIN,
@@ -78,7 +74,9 @@ endpoint_policies = [
         description='Update endpoint.',
         operations=[{'path': '/v3/endpoints/{endpoint_id}',
                      'method': 'PATCH'}],
-        deprecated_rule=deprecated_update_endpoint),
+        deprecated_rule=deprecated_update_endpoint,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_endpoint',
         check_str=base.SYSTEM_ADMIN,
@@ -86,7 +84,9 @@ endpoint_policies = [
         description='Delete endpoint.',
         operations=[{'path': '/v3/endpoints/{endpoint_id}',
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_endpoint)
+        deprecated_rule=deprecated_delete_endpoint,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN)
 ]
 
 
diff --git a/keystone/common/policies/endpoint_group.py b/keystone/common/policies/endpoint_group.py
index 741e0b7..691a6fe 100644
--- a/keystone/common/policies/endpoint_group.py
+++ b/keystone/common/policies/endpoint_group.py
@@ -15,85 +15,64 @@ from oslo_policy import policy
 
 from keystone.common.policies import base
 
-DEPRECATED_REASON = (
-    "The endpoint groups API is now aware of system scope and default roles."
-)
-
 deprecated_list_endpoint_groups = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_endpoint_groups',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_get_endpoint_group = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_endpoint_group',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_list_projects_assoc_with_endpoint_group = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_projects_associated_with_endpoint_group',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_list_endpoints_assoc_with_endpoint_group = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_endpoints_associated_with_endpoint_group',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_get_endpoint_group_in_project = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_endpoint_group_in_project',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_list_endpoint_groups_for_project = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_endpoint_groups_for_project',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_create_endpoint_group = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_endpoint_group',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_update_endpoint_group = policy.DeprecatedRule(
     name=base.IDENTITY % 'update_endpoint_group',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_delete_endpoint_group = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_endpoint_group',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_add_endpoint_group_to_project = policy.DeprecatedRule(
     name=base.IDENTITY % 'add_endpoint_group_to_project',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_remove_endpoint_group_from_project = policy.DeprecatedRule(
     name=base.IDENTITY % 'remove_endpoint_group_from_project',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+)
+
+
+DEPRECATED_REASON = (
+    "The endpoint groups API is now aware of system scope and default roles."
 )
 
 
@@ -105,7 +84,9 @@ group_endpoint_policies = [
         description='Create endpoint group.',
         operations=[{'path': '/v3/OS-EP-FILTER/endpoint_groups',
                      'method': 'POST'}],
-        deprecated_rule=deprecated_create_endpoint_group),
+        deprecated_rule=deprecated_create_endpoint_group,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_endpoint_groups',
         check_str=base.SYSTEM_READER,
@@ -113,7 +94,9 @@ group_endpoint_policies = [
         description='List endpoint groups.',
         operations=[{'path': '/v3/OS-EP-FILTER/endpoint_groups',
                      'method': 'GET'}],
-        deprecated_rule=deprecated_list_endpoint_groups),
+        deprecated_rule=deprecated_list_endpoint_groups,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'get_endpoint_group',
         check_str=base.SYSTEM_READER,
@@ -125,7 +108,9 @@ group_endpoint_policies = [
                     {'path': ('/v3/OS-EP-FILTER/endpoint_groups/'
                               '{endpoint_group_id}'),
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_get_endpoint_group),
+        deprecated_rule=deprecated_get_endpoint_group,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'update_endpoint_group',
         check_str=base.SYSTEM_ADMIN,
@@ -134,7 +119,9 @@ group_endpoint_policies = [
         operations=[{'path': ('/v3/OS-EP-FILTER/endpoint_groups/'
                               '{endpoint_group_id}'),
                      'method': 'PATCH'}],
-        deprecated_rule=deprecated_update_endpoint_group),
+        deprecated_rule=deprecated_update_endpoint_group,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_endpoint_group',
         check_str=base.SYSTEM_ADMIN,
@@ -143,7 +130,9 @@ group_endpoint_policies = [
         operations=[{'path': ('/v3/OS-EP-FILTER/endpoint_groups/'
                               '{endpoint_group_id}'),
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_endpoint_group),
+        deprecated_rule=deprecated_delete_endpoint_group,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_projects_associated_with_endpoint_group',
         check_str=base.SYSTEM_READER,
@@ -153,7 +142,9 @@ group_endpoint_policies = [
         operations=[{'path': ('/v3/OS-EP-FILTER/endpoint_groups/'
                               '{endpoint_group_id}/projects'),
                      'method': 'GET'}],
-        deprecated_rule=deprecated_list_projects_assoc_with_endpoint_group),
+        deprecated_rule=deprecated_list_projects_assoc_with_endpoint_group,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_endpoints_associated_with_endpoint_group',
         check_str=base.SYSTEM_READER,
@@ -162,7 +153,9 @@ group_endpoint_policies = [
         operations=[{'path': ('/v3/OS-EP-FILTER/endpoint_groups/'
                               '{endpoint_group_id}/endpoints'),
                      'method': 'GET'}],
-        deprecated_rule=deprecated_list_endpoints_assoc_with_endpoint_group),
+        deprecated_rule=deprecated_list_endpoints_assoc_with_endpoint_group,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'get_endpoint_group_in_project',
         check_str=base.SYSTEM_READER,
@@ -175,7 +168,9 @@ group_endpoint_policies = [
                     {'path': ('/v3/OS-EP-FILTER/endpoint_groups/'
                               '{endpoint_group_id}/projects/{project_id}'),
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_get_endpoint_group_in_project),
+        deprecated_rule=deprecated_get_endpoint_group_in_project,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_endpoint_groups_for_project',
         check_str=base.SYSTEM_READER,
@@ -184,7 +179,9 @@ group_endpoint_policies = [
         operations=[{'path': ('/v3/OS-EP-FILTER/projects/{project_id}/'
                               'endpoint_groups'),
                      'method': 'GET'}],
-        deprecated_rule=deprecated_list_endpoint_groups_for_project),
+        deprecated_rule=deprecated_list_endpoint_groups_for_project,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'add_endpoint_group_to_project',
         check_str=base.SYSTEM_ADMIN,
@@ -193,7 +190,9 @@ group_endpoint_policies = [
         operations=[{'path': ('/v3/OS-EP-FILTER/endpoint_groups/'
                               '{endpoint_group_id}/projects/{project_id}'),
                      'method': 'PUT'}],
-        deprecated_rule=deprecated_add_endpoint_group_to_project),
+        deprecated_rule=deprecated_add_endpoint_group_to_project,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'remove_endpoint_group_from_project',
         check_str=base.SYSTEM_ADMIN,
@@ -202,7 +201,9 @@ group_endpoint_policies = [
         operations=[{'path': ('/v3/OS-EP-FILTER/endpoint_groups/'
                               '{endpoint_group_id}/projects/{project_id}'),
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_remove_endpoint_group_from_project)
+        deprecated_rule=deprecated_remove_endpoint_group_from_project,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN)
 ]
 
 
diff --git a/keystone/common/policies/grant.py b/keystone/common/policies/grant.py
index 0e1b928..09ef1c9 100644
--- a/keystone/common/policies/grant.py
+++ b/keystone/common/policies/grant.py
@@ -66,79 +66,54 @@ SYSTEM_ADMIN_OR_DOMAIN_ADMIN = (
     '(' + DOMAIN_MATCHES_ROLE + ')'
 )
 
-DEPRECATED_REASON = (
-    "The assignment API is now aware of system scope and default roles."
-)
-
 deprecated_check_system_grant_for_user = policy.DeprecatedRule(
     name=base.IDENTITY % 'check_system_grant_for_user',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_list_system_grants_for_user = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_system_grants_for_user',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_create_system_grant_for_user = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_system_grant_for_user',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_revoke_system_grant_for_user = policy.DeprecatedRule(
     name=base.IDENTITY % 'revoke_system_grant_for_user',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_check_system_grant_for_group = policy.DeprecatedRule(
     name=base.IDENTITY % 'check_system_grant_for_group',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_list_system_grants_for_group = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_system_grants_for_group',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_create_system_grant_for_group = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_system_grant_for_group',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_revoke_system_grant_for_group = policy.DeprecatedRule(
     name=base.IDENTITY % 'revoke_system_grant_for_group',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_list_grants = policy.DeprecatedRule(
-    name=base.IDENTITY % 'list_grants', check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    name=base.IDENTITY % 'list_grants', check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_check_grant = policy.DeprecatedRule(
-    name=base.IDENTITY % 'check_grant', check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    name=base.IDENTITY % 'check_grant', check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_create_grant = policy.DeprecatedRule(
-    name=base.IDENTITY % 'create_grant', check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    name=base.IDENTITY % 'create_grant', check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_revoke_grant = policy.DeprecatedRule(
-    name=base.IDENTITY % 'revoke_grant', check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    name=base.IDENTITY % 'revoke_grant', check_str=base.RULE_ADMIN_REQUIRED
 )
 
+DEPRECATED_REASON = (
+    "The assignment API is now aware of system scope and default roles."
+)
 
 resource_paths = [
     '/projects/{project_id}/users/{user_id}/roles/{role_id}',
@@ -192,7 +167,9 @@ grant_policies = [
                      'are inherited to all projects in the subtree, if '
                      'applicable.'),
         operations=list_operations(resource_paths, ['HEAD', 'GET']),
-        deprecated_rule=deprecated_check_grant),
+        deprecated_rule=deprecated_check_grant,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_grants',
         check_str=SYSTEM_READER_OR_DOMAIN_READER_LIST,
@@ -204,7 +181,9 @@ grant_policies = [
                      'domains, where grants are inherited to all projects '
                      'in the specified domain.'),
         operations=list_grants_operations,
-        deprecated_rule=deprecated_list_grants),
+        deprecated_rule=deprecated_list_grants,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'create_grant',
         check_str=SYSTEM_ADMIN_OR_DOMAIN_ADMIN,
@@ -216,7 +195,9 @@ grant_policies = [
                      'are inherited to all projects in the subtree, if '
                      'applicable.'),
         operations=list_operations(resource_paths, ['PUT']),
-        deprecated_rule=deprecated_create_grant),
+        deprecated_rule=deprecated_create_grant,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'revoke_grant',
         check_str=SYSTEM_ADMIN_OR_DOMAIN_ADMIN,
@@ -230,7 +211,9 @@ grant_policies = [
                      'the target would remove the logical effect of '
                      'inheriting it to the target\'s projects subtree.'),
         operations=list_operations(resource_paths, ['DELETE']),
-        deprecated_rule=deprecated_revoke_grant),
+        deprecated_rule=deprecated_revoke_grant,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_system_grants_for_user',
         check_str=base.SYSTEM_READER,
@@ -243,6 +226,8 @@ grant_policies = [
             }
         ],
         deprecated_rule=deprecated_list_system_grants_for_user,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'check_system_grant_for_user',
@@ -256,6 +241,8 @@ grant_policies = [
             }
         ],
         deprecated_rule=deprecated_check_system_grant_for_user,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'create_system_grant_for_user',
@@ -269,6 +256,8 @@ grant_policies = [
             }
         ],
         deprecated_rule=deprecated_create_system_grant_for_user,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'revoke_system_grant_for_user',
@@ -282,6 +271,8 @@ grant_policies = [
             }
         ],
         deprecated_rule=deprecated_revoke_system_grant_for_user,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_system_grants_for_group',
@@ -295,6 +286,8 @@ grant_policies = [
             }
         ],
         deprecated_rule=deprecated_list_system_grants_for_group,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'check_system_grant_for_group',
@@ -308,6 +301,8 @@ grant_policies = [
             }
         ],
         deprecated_rule=deprecated_check_system_grant_for_group,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'create_system_grant_for_group',
@@ -321,6 +316,8 @@ grant_policies = [
             }
         ],
         deprecated_rule=deprecated_create_system_grant_for_group,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'revoke_system_grant_for_group',
@@ -334,6 +331,8 @@ grant_policies = [
             }
         ],
         deprecated_rule=deprecated_revoke_system_grant_for_group,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN
     )
 ]
 
diff --git a/keystone/common/policies/group.py b/keystone/common/policies/group.py
index 0106bad..d33da92 100644
--- a/keystone/common/policies/group.py
+++ b/keystone/common/policies/group.py
@@ -51,63 +51,43 @@ DEPRECATED_REASON = (
 
 deprecated_get_group = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_group',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_list_groups = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_groups',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_list_groups_for_user = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_groups_for_user',
-    check_str=base.RULE_ADMIN_OR_OWNER,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_OR_OWNER
 )
 deprecated_list_users_in_group = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_users_in_group',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_check_user_in_group = policy.DeprecatedRule(
     name=base.IDENTITY % 'check_user_in_group',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_create_group = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_group',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_update_group = policy.DeprecatedRule(
     name=base.IDENTITY % 'update_group',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_delete_group = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_group',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_remove_user_from_group = policy.DeprecatedRule(
     name=base.IDENTITY % 'remove_user_from_group',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_add_user_to_group = policy.DeprecatedRule(
     name=base.IDENTITY % 'add_user_to_group',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 
 group_policies = [
@@ -120,7 +100,9 @@ group_policies = [
                      'method': 'GET'},
                     {'path': '/v3/groups/{group_id}',
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_get_group),
+        deprecated_rule=deprecated_get_group,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_groups',
         check_str=SYSTEM_READER_OR_DOMAIN_READER,
@@ -130,7 +112,9 @@ group_policies = [
                      'method': 'GET'},
                     {'path': '/v3/groups',
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_list_groups),
+        deprecated_rule=deprecated_list_groups,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_groups_for_user',
         check_str=SYSTEM_READER_OR_DOMAIN_READER_FOR_TARGET_USER_OR_OWNER,
@@ -140,7 +124,9 @@ group_policies = [
                      'method': 'GET'},
                     {'path': '/v3/users/{user_id}/groups',
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_list_groups_for_user),
+        deprecated_rule=deprecated_list_groups_for_user,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'create_group',
         check_str=SYSTEM_ADMIN_OR_DOMAIN_ADMIN,
@@ -148,7 +134,9 @@ group_policies = [
         description='Create group.',
         operations=[{'path': '/v3/groups',
                      'method': 'POST'}],
-        deprecated_rule=deprecated_create_group),
+        deprecated_rule=deprecated_create_group,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'update_group',
         check_str=SYSTEM_ADMIN_OR_DOMAIN_ADMIN,
@@ -156,7 +144,9 @@ group_policies = [
         description='Update group.',
         operations=[{'path': '/v3/groups/{group_id}',
                      'method': 'PATCH'}],
-        deprecated_rule=deprecated_update_group),
+        deprecated_rule=deprecated_update_group,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_group',
         check_str=SYSTEM_ADMIN_OR_DOMAIN_ADMIN,
@@ -164,7 +154,9 @@ group_policies = [
         description='Delete group.',
         operations=[{'path': '/v3/groups/{group_id}',
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_group),
+        deprecated_rule=deprecated_delete_group,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_users_in_group',
         check_str=SYSTEM_READER_OR_DOMAIN_READER,
@@ -174,7 +166,9 @@ group_policies = [
                      'method': 'GET'},
                     {'path': '/v3/groups/{group_id}/users',
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_list_users_in_group),
+        deprecated_rule=deprecated_list_users_in_group,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'remove_user_from_group',
         check_str=SYSTEM_ADMIN_OR_DOMAIN_ADMIN_FOR_TARGET_GROUP_USER,
@@ -182,7 +176,9 @@ group_policies = [
         description='Remove user from group.',
         operations=[{'path': '/v3/groups/{group_id}/users/{user_id}',
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_remove_user_from_group),
+        deprecated_rule=deprecated_remove_user_from_group,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'check_user_in_group',
         check_str=SYSTEM_READER_OR_DOMAIN_READER_FOR_TARGET_GROUP_USER,
@@ -192,7 +188,9 @@ group_policies = [
                      'method': 'HEAD'},
                     {'path': '/v3/groups/{group_id}/users/{user_id}',
                      'method': 'GET'}],
-        deprecated_rule=deprecated_check_user_in_group),
+        deprecated_rule=deprecated_check_user_in_group,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'add_user_to_group',
         check_str=SYSTEM_ADMIN_OR_DOMAIN_ADMIN_FOR_TARGET_GROUP_USER,
@@ -200,7 +198,9 @@ group_policies = [
         description='Add user to group.',
         operations=[{'path': '/v3/groups/{group_id}/users/{user_id}',
                      'method': 'PUT'}],
-        deprecated_rule=deprecated_add_user_to_group)
+        deprecated_rule=deprecated_add_user_to_group,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN)
 ]
 
 
diff --git a/keystone/common/policies/identity_provider.py b/keystone/common/policies/identity_provider.py
index c1b4d5a..8d6ad46 100644
--- a/keystone/common/policies/identity_provider.py
+++ b/keystone/common/policies/identity_provider.py
@@ -15,41 +15,30 @@ from oslo_policy import policy
 
 from keystone.common.policies import base
 
-DEPRECATED_REASON = (
-    "The identity provider API is now aware of system scope and default roles."
-)
-
 deprecated_get_idp = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_identity_provider',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_list_idp = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_identity_providers',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_update_idp = policy.DeprecatedRule(
     name=base.IDENTITY % 'update_identity_provider',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_create_idp = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_identity_provider',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_delete_idp = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_identity_provider',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 
+DEPRECATED_REASON = (
+    "The identity provider API is now aware of system scope and default roles."
+)
 
 identity_provider_policies = [
     policy.DocumentedRuleDefault(
@@ -65,7 +54,9 @@ identity_provider_policies = [
         description='Create identity provider.',
         operations=[{'path': '/v3/OS-FEDERATION/identity_providers/{idp_id}',
                      'method': 'PUT'}],
-        deprecated_rule=deprecated_create_idp),
+        deprecated_rule=deprecated_create_idp,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_identity_providers',
         check_str=base.SYSTEM_READER,
@@ -82,6 +73,8 @@ identity_provider_policies = [
             }
         ],
         deprecated_rule=deprecated_list_idp,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'get_identity_provider',
@@ -99,6 +92,8 @@ identity_provider_policies = [
             }
         ],
         deprecated_rule=deprecated_get_idp,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'update_identity_provider',
@@ -107,7 +102,9 @@ identity_provider_policies = [
         description='Update identity provider.',
         operations=[{'path': '/v3/OS-FEDERATION/identity_providers/{idp_id}',
                      'method': 'PATCH'}],
-        deprecated_rule=deprecated_update_idp),
+        deprecated_rule=deprecated_update_idp,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_identity_provider',
         check_str=base.SYSTEM_ADMIN,
@@ -115,7 +112,9 @@ identity_provider_policies = [
         description='Delete identity provider.',
         operations=[{'path': '/v3/OS-FEDERATION/identity_providers/{idp_id}',
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_idp),
+        deprecated_rule=deprecated_delete_idp,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
 ]
 
 
diff --git a/keystone/common/policies/implied_role.py b/keystone/common/policies/implied_role.py
index 01bcc00..6d164b0 100644
--- a/keystone/common/policies/implied_role.py
+++ b/keystone/common/policies/implied_role.py
@@ -15,45 +15,33 @@ from oslo_policy import policy
 
 from keystone.common.policies import base
 
-DEPRECATED_REASON = (
-    "The implied role API is now aware of system scope and default roles."
-)
-
 deprecated_get_implied_role = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_implied_role',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_list_implied_roles = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_implied_roles',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 deprecated_list_role_inference_rules = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_role_inference_rules',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 deprecated_check_implied_role = policy.DeprecatedRule(
     name=base.IDENTITY % 'check_implied_role',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 deprecated_create_implied_role = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_implied_role',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 deprecated_delete_implied_role = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_implied_role',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+)
+
+DEPRECATED_REASON = (
+    "The implied role API is now aware of system scope and default roles."
 )
 
 
@@ -73,7 +61,9 @@ implied_role_policies = [
         operations=[
             {'path': '/v3/roles/{prior_role_id}/implies/{implied_role_id}',
              'method': 'GET'}],
-        deprecated_rule=deprecated_get_implied_role),
+        deprecated_rule=deprecated_get_implied_role,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_implied_roles',
         check_str=base.SYSTEM_READER,
@@ -87,7 +77,9 @@ implied_role_policies = [
         operations=[
             {'path': '/v3/roles/{prior_role_id}/implies', 'method': 'GET'},
             {'path': '/v3/roles/{prior_role_id}/implies', 'method': 'HEAD'}],
-        deprecated_rule=deprecated_list_implied_roles),
+        deprecated_rule=deprecated_list_implied_roles,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'create_implied_role',
         check_str=base.SYSTEM_ADMIN,
@@ -99,7 +91,9 @@ implied_role_policies = [
         operations=[
             {'path': '/v3/roles/{prior_role_id}/implies/{implied_role_id}',
              'method': 'PUT'}],
-        deprecated_rule=deprecated_create_implied_role),
+        deprecated_rule=deprecated_create_implied_role,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_implied_role',
         check_str=base.SYSTEM_ADMIN,
@@ -112,7 +106,9 @@ implied_role_policies = [
         operations=[
             {'path': '/v3/roles/{prior_role_id}/implies/{implied_role_id}',
              'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_implied_role),
+        deprecated_rule=deprecated_delete_implied_role,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_role_inference_rules',
         check_str=base.SYSTEM_READER,
@@ -124,7 +120,9 @@ implied_role_policies = [
         operations=[
             {'path': '/v3/role_inferences', 'method': 'GET'},
             {'path': '/v3/role_inferences', 'method': 'HEAD'}],
-        deprecated_rule=deprecated_list_role_inference_rules),
+        deprecated_rule=deprecated_list_role_inference_rules,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'check_implied_role',
         check_str=base.SYSTEM_READER,
@@ -136,7 +134,9 @@ implied_role_policies = [
         operations=[
             {'path': '/v3/roles/{prior_role_id}/implies/{implied_role_id}',
              'method': 'HEAD'}],
-        deprecated_rule=deprecated_check_implied_role),
+        deprecated_rule=deprecated_check_implied_role,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
 ]
 
 
diff --git a/keystone/common/policies/mapping.py b/keystone/common/policies/mapping.py
index 6c4f0de..498bc7c 100644
--- a/keystone/common/policies/mapping.py
+++ b/keystone/common/policies/mapping.py
@@ -15,41 +15,30 @@ from oslo_policy import policy
 
 from keystone.common.policies import base
 
-DEPRECATED_REASON = (
-    "The federated mapping API is now aware of system scope and default roles."
-)
-
 deprecated_get_mapping = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_mapping',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_list_mappings = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_mappings',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_update_mapping = policy.DeprecatedRule(
     name=base.IDENTITY % 'update_mapping',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_create_mapping = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_mapping',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_delete_mapping = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_mapping',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 
+DEPRECATED_REASON = (
+    "The federated mapping API is now aware of system scope and default roles."
+)
 
 mapping_policies = [
     policy.DocumentedRuleDefault(
@@ -66,7 +55,9 @@ mapping_policies = [
                      'more sets of rules.'),
         operations=[{'path': '/v3/OS-FEDERATION/mappings/{mapping_id}',
                      'method': 'PUT'}],
-        deprecated_rule=deprecated_create_mapping),
+        deprecated_rule=deprecated_create_mapping,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'get_mapping',
         check_str=base.SYSTEM_READER,
@@ -82,7 +73,9 @@ mapping_policies = [
                 'method': 'HEAD'
             }
         ],
-        deprecated_rule=deprecated_get_mapping
+        deprecated_rule=deprecated_get_mapping,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_mappings',
@@ -100,6 +93,8 @@ mapping_policies = [
             }
         ],
         deprecated_rule=deprecated_list_mappings,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_mapping',
@@ -108,7 +103,9 @@ mapping_policies = [
         description='Delete a federated mapping.',
         operations=[{'path': '/v3/OS-FEDERATION/mappings/{mapping_id}',
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_mapping),
+        deprecated_rule=deprecated_delete_mapping,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'update_mapping',
         check_str=base.SYSTEM_ADMIN,
@@ -116,7 +113,9 @@ mapping_policies = [
         description='Update a federated mapping.',
         operations=[{'path': '/v3/OS-FEDERATION/mappings/{mapping_id}',
                      'method': 'PATCH'}],
-        deprecated_rule=deprecated_update_mapping)
+        deprecated_rule=deprecated_update_mapping,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN)
 ]
 
 
diff --git a/keystone/common/policies/policy.py b/keystone/common/policies/policy.py
index 502fa9d..4c912f3 100644
--- a/keystone/common/policies/policy.py
+++ b/keystone/common/policies/policy.py
@@ -15,43 +15,33 @@ from oslo_policy import policy
 
 from keystone.common.policies import base
 
-DEPRECATED_REASON = (
-    "The policy API is now aware of system scope and default roles."
-)
-
 deprecated_get_policy = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_policy',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_list_policies = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_policies',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_update_policy = policy.DeprecatedRule(
     name=base.IDENTITY % 'update_policy',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_create_policy = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_policy',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_delete_policy = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_policy',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+)
+
+DEPRECATED_REASON = (
+    "The policy API is now aware of system scope and default roles."
 )
 
 
@@ -65,7 +55,9 @@ policy_policies = [
         description='Show policy details.',
         operations=[{'path': '/v3/policies/{policy_id}',
                      'method': 'GET'}],
-        deprecated_rule=deprecated_get_policy),
+        deprecated_rule=deprecated_get_policy,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_policies',
         check_str=base.SYSTEM_READER,
@@ -73,7 +65,9 @@ policy_policies = [
         description='List policies.',
         operations=[{'path': '/v3/policies',
                      'method': 'GET'}],
-        deprecated_rule=deprecated_list_policies),
+        deprecated_rule=deprecated_list_policies,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'create_policy',
         check_str=base.SYSTEM_ADMIN,
@@ -81,7 +75,9 @@ policy_policies = [
         description='Create policy.',
         operations=[{'path': '/v3/policies',
                      'method': 'POST'}],
-        deprecated_rule=deprecated_create_policy),
+        deprecated_rule=deprecated_create_policy,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'update_policy',
         check_str=base.SYSTEM_ADMIN,
@@ -89,7 +85,9 @@ policy_policies = [
         description='Update policy.',
         operations=[{'path': '/v3/policies/{policy_id}',
                      'method': 'PATCH'}],
-        deprecated_rule=deprecated_update_policy),
+        deprecated_rule=deprecated_update_policy,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_policy',
         check_str=base.SYSTEM_ADMIN,
@@ -97,7 +95,9 @@ policy_policies = [
         description='Delete policy.',
         operations=[{'path': '/v3/policies/{policy_id}',
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_policy)
+        deprecated_rule=deprecated_delete_policy,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN)
 ]
 
 
diff --git a/keystone/common/policies/policy_association.py b/keystone/common/policies/policy_association.py
index 1cf6f86..af57900 100644
--- a/keystone/common/policies/policy_association.py
+++ b/keystone/common/policies/policy_association.py
@@ -19,88 +19,65 @@ from keystone.common.policies import base
 # System-scoped tokens should be required to manage policy associations to
 # existing system-level resources.
 
-DEPRECATED_REASON = (
-    "The policy association API is now aware of system scope and default "
-    "roles."
-)
-
 deprecated_check_policy_assoc_for_endpoint = policy.DeprecatedRule(
     name=base.IDENTITY % 'check_policy_association_for_endpoint',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_check_policy_assoc_for_service = policy.DeprecatedRule(
     name=base.IDENTITY % 'check_policy_association_for_service',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_check_policy_assoc_for_region_and_service = policy.DeprecatedRule(
     name=base.IDENTITY % 'check_policy_association_for_region_and_service',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_get_policy_for_endpoint = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_policy_for_endpoint',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_list_endpoints_for_policy = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_endpoints_for_policy',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_create_policy_assoc_for_endpoint = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_policy_association_for_endpoint',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_delete_policy_assoc_for_endpoint = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_policy_association_for_endpoint',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_create_policy_assoc_for_service = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_policy_association_for_service',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_delete_policy_assoc_for_service = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_policy_association_for_service',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_create_policy_assoc_for_region_and_service = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_policy_association_for_region_and_service',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_delete_policy_assoc_for_region_and_service = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_policy_association_for_region_and_service',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
+DEPRECATED_REASON = (
+    "The policy association API is now aware of system scope and default "
+    "roles."
+)
 
 policy_association_policies = [
     policy.DocumentedRuleDefault(
@@ -111,7 +88,9 @@ policy_association_policies = [
         operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/'
                               'endpoints/{endpoint_id}'),
                      'method': 'PUT'}],
-        deprecated_rule=deprecated_create_policy_assoc_for_endpoint),
+        deprecated_rule=deprecated_create_policy_assoc_for_endpoint,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'check_policy_association_for_endpoint',
         check_str=base.SYSTEM_READER,
@@ -123,7 +102,9 @@ policy_association_policies = [
                     {'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/'
                               'endpoints/{endpoint_id}'),
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_check_policy_assoc_for_endpoint),
+        deprecated_rule=deprecated_check_policy_assoc_for_endpoint,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_policy_association_for_endpoint',
         check_str=base.SYSTEM_ADMIN,
@@ -132,7 +113,9 @@ policy_association_policies = [
         operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/'
                               'endpoints/{endpoint_id}'),
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_policy_assoc_for_endpoint),
+        deprecated_rule=deprecated_delete_policy_assoc_for_endpoint,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'create_policy_association_for_service',
         check_str=base.SYSTEM_ADMIN,
@@ -141,7 +124,9 @@ policy_association_policies = [
         operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/'
                               'services/{service_id}'),
                      'method': 'PUT'}],
-        deprecated_rule=deprecated_create_policy_assoc_for_service),
+        deprecated_rule=deprecated_create_policy_assoc_for_service,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'check_policy_association_for_service',
         check_str=base.SYSTEM_READER,
@@ -153,7 +138,9 @@ policy_association_policies = [
                     {'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/'
                               'services/{service_id}'),
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_check_policy_assoc_for_service),
+        deprecated_rule=deprecated_check_policy_assoc_for_service,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_policy_association_for_service',
         check_str=base.SYSTEM_ADMIN,
@@ -162,7 +149,9 @@ policy_association_policies = [
         operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/'
                               'services/{service_id}'),
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_policy_assoc_for_service),
+        deprecated_rule=deprecated_delete_policy_assoc_for_service,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % (
             'create_policy_association_for_region_and_service'),
@@ -173,7 +162,9 @@ policy_association_policies = [
         operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/'
                               'services/{service_id}/regions/{region_id}'),
                      'method': 'PUT'}],
-        deprecated_rule=deprecated_create_policy_assoc_for_region_and_service),
+        deprecated_rule=deprecated_create_policy_assoc_for_region_and_service,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'check_policy_association_for_region_and_service',
         check_str=base.SYSTEM_READER,
@@ -185,7 +176,9 @@ policy_association_policies = [
                     {'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/'
                               'services/{service_id}/regions/{region_id}'),
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_check_policy_assoc_for_region_and_service),
+        deprecated_rule=deprecated_check_policy_assoc_for_region_and_service,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % (
             'delete_policy_association_for_region_and_service'),
@@ -195,7 +188,9 @@ policy_association_policies = [
         operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/'
                               'services/{service_id}/regions/{region_id}'),
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_policy_assoc_for_region_and_service),
+        deprecated_rule=deprecated_delete_policy_assoc_for_region_and_service,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'get_policy_for_endpoint',
         check_str=base.SYSTEM_READER,
@@ -207,7 +202,9 @@ policy_association_policies = [
                     {'path': ('/v3/endpoints/{endpoint_id}/OS-ENDPOINT-POLICY/'
                               'policy'),
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_get_policy_for_endpoint),
+        deprecated_rule=deprecated_get_policy_for_endpoint,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_endpoints_for_policy',
         check_str=base.SYSTEM_READER,
@@ -216,7 +213,9 @@ policy_association_policies = [
         operations=[{'path': ('/v3/policies/{policy_id}/OS-ENDPOINT-POLICY/'
                               'endpoints'),
                      'method': 'GET'}],
-        deprecated_rule=deprecated_list_endpoints_for_policy)
+        deprecated_rule=deprecated_list_endpoints_for_policy,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN)
 ]
 
 
diff --git a/keystone/common/policies/project.py b/keystone/common/policies/project.py
index db7cdee..c7b7c0a 100644
--- a/keystone/common/policies/project.py
+++ b/keystone/common/policies/project.py
@@ -52,84 +52,60 @@ SYSTEM_ADMIN_OR_DOMAIN_ADMIN = (
     '(role:admin and domain_id:%(target.project.domain_id)s)'
 )
 
-DEPRECATED_REASON = (
-    "The project API is now aware of system scope and default roles."
-)
-
 deprecated_list_projects = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_projects',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_get_project = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_project',
-    check_str=base.RULE_ADMIN_OR_TARGET_PROJECT,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_OR_TARGET_PROJECT
 )
 deprecated_list_user_projects = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_user_projects',
-    check_str=base.RULE_ADMIN_OR_OWNER,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_OR_OWNER
 )
 deprecated_create_project = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_project',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_update_project = policy.DeprecatedRule(
     name=base.IDENTITY % 'update_project',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_delete_project = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_project',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_list_project_tags = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_project_tags',
-    check_str=base.RULE_ADMIN_OR_TARGET_PROJECT,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_OR_TARGET_PROJECT
 )
 deprecated_get_project_tag = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_project_tag',
-    check_str=base.RULE_ADMIN_OR_TARGET_PROJECT,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_OR_TARGET_PROJECT
 )
 deprecated_update_project_tag = policy.DeprecatedRule(
     name=base.IDENTITY % 'update_project_tags',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_create_project_tag = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_project_tag',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_delete_project_tag = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_project_tag',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_delete_project_tags = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_project_tags',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 
 
+DEPRECATED_REASON = (
+    "The project API is now aware of system scope and default roles."
+)
+
 TAGS_DEPRECATED_REASON = """
 As of the Train release, the project tags API understands how to handle
 system-scoped tokens in addition to project and domain tokens, making the API
@@ -146,7 +122,9 @@ project_policies = [
         description='Show project details.',
         operations=[{'path': '/v3/projects/{project_id}',
                      'method': 'GET'}],
-        deprecated_rule=deprecated_get_project),
+        deprecated_rule=deprecated_get_project,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_projects',
         check_str=SYSTEM_READER_OR_DOMAIN_READER,
@@ -158,7 +136,9 @@ project_policies = [
         description='List projects.',
         operations=[{'path': '/v3/projects',
                      'method': 'GET'}],
-        deprecated_rule=deprecated_list_projects),
+        deprecated_rule=deprecated_list_projects,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_user_projects',
         check_str=SYSTEM_READER_OR_DOMAIN_READER_OR_OWNER,
@@ -166,7 +146,9 @@ project_policies = [
         description='List projects for user.',
         operations=[{'path': '/v3/users/{user_id}/projects',
                      'method': 'GET'}],
-        deprecated_rule=deprecated_list_user_projects),
+        deprecated_rule=deprecated_list_user_projects,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'create_project',
         check_str=SYSTEM_ADMIN_OR_DOMAIN_ADMIN,
@@ -174,7 +156,9 @@ project_policies = [
         description='Create project.',
         operations=[{'path': '/v3/projects',
                      'method': 'POST'}],
-        deprecated_rule=deprecated_create_project),
+        deprecated_rule=deprecated_create_project,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'update_project',
         check_str=SYSTEM_ADMIN_OR_DOMAIN_ADMIN,
@@ -182,7 +166,9 @@ project_policies = [
         description='Update project.',
         operations=[{'path': '/v3/projects/{project_id}',
                      'method': 'PATCH'}],
-        deprecated_rule=deprecated_update_project),
+        deprecated_rule=deprecated_update_project,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_project',
         check_str=SYSTEM_ADMIN_OR_DOMAIN_ADMIN,
@@ -190,7 +176,9 @@ project_policies = [
         description='Delete project.',
         operations=[{'path': '/v3/projects/{project_id}',
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_project),
+        deprecated_rule=deprecated_delete_project,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_project_tags',
         check_str=SYSTEM_READER_OR_DOMAIN_READER_OR_PROJECT_USER,
@@ -200,7 +188,9 @@ project_policies = [
                      'method': 'GET'},
                     {'path': '/v3/projects/{project_id}/tags',
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_list_project_tags),
+        deprecated_rule=deprecated_list_project_tags,
+        deprecated_reason=TAGS_DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'get_project_tag',
         check_str=SYSTEM_READER_OR_DOMAIN_READER_OR_PROJECT_USER,
@@ -210,7 +200,9 @@ project_policies = [
                      'method': 'GET'},
                     {'path': '/v3/projects/{project_id}/tags/{value}',
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_get_project_tag),
+        deprecated_rule=deprecated_get_project_tag,
+        deprecated_reason=TAGS_DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'update_project_tags',
         check_str=SYSTEM_ADMIN_OR_DOMAIN_ADMIN_OR_PROJECT_ADMIN,
@@ -218,7 +210,9 @@ project_policies = [
         description='Replace all tags on a project with the new set of tags.',
         operations=[{'path': '/v3/projects/{project_id}/tags',
                      'method': 'PUT'}],
-        deprecated_rule=deprecated_update_project_tag),
+        deprecated_rule=deprecated_update_project_tag,
+        deprecated_reason=TAGS_DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'create_project_tag',
         check_str=SYSTEM_ADMIN_OR_DOMAIN_ADMIN_OR_PROJECT_ADMIN,
@@ -226,7 +220,9 @@ project_policies = [
         description='Add a single tag to a project.',
         operations=[{'path': '/v3/projects/{project_id}/tags/{value}',
                      'method': 'PUT'}],
-        deprecated_rule=deprecated_create_project_tag),
+        deprecated_rule=deprecated_create_project_tag,
+        deprecated_reason=TAGS_DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_project_tags',
         check_str=SYSTEM_ADMIN_OR_DOMAIN_ADMIN_OR_PROJECT_ADMIN,
@@ -234,7 +230,9 @@ project_policies = [
         description='Remove all tags from a project.',
         operations=[{'path': '/v3/projects/{project_id}/tags',
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_project_tags),
+        deprecated_rule=deprecated_delete_project_tags,
+        deprecated_reason=TAGS_DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_project_tag',
         check_str=SYSTEM_ADMIN_OR_DOMAIN_ADMIN_OR_PROJECT_ADMIN,
@@ -242,7 +240,9 @@ project_policies = [
         description='Delete a specified tag from project.',
         operations=[{'path': '/v3/projects/{project_id}/tags/{value}',
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_project_tag)
+        deprecated_rule=deprecated_delete_project_tag,
+        deprecated_reason=TAGS_DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN)
 ]
 
 
diff --git a/keystone/common/policies/project_endpoint.py b/keystone/common/policies/project_endpoint.py
index 86a020e..c04cddd 100644
--- a/keystone/common/policies/project_endpoint.py
+++ b/keystone/common/policies/project_endpoint.py
@@ -15,49 +15,39 @@ from oslo_policy import policy
 
 from keystone.common.policies import base
 
-DEPRECATED_REASON = """
-As of the Train release, the project endpoint API now understands default
-roles and system-scoped tokens, making the API more granular by default without
-compromising security. The new policy defaults account for these changes
-automatically. Be sure to take these new defaults into consideration if you are
-relying on overrides in your deployment for the project endpoint API.
-"""
-
 deprecated_list_projects_for_endpoint = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_projects_for_endpoint',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_add_endpoint_to_project = policy.DeprecatedRule(
     name=base.IDENTITY % 'add_endpoint_to_project',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_check_endpoint_in_project = policy.DeprecatedRule(
     name=base.IDENTITY % 'check_endpoint_in_project',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_list_endpoints_for_project = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_endpoints_for_project',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
 deprecated_remove_endpoint_from_project = policy.DeprecatedRule(
     name=base.IDENTITY % 'remove_endpoint_from_project',
     check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
 )
 
+DEPRECATED_REASON = """
+As of the Train release, the project endpoint API now understands default
+roles and system-scoped tokens, making the API more granular by default without
+compromising security. The new policy defaults account for these changes
+automatically. Be sure to take these new defaults into consideration if you are
+relying on overrides in your deployment for the project endpoint API.
+"""
+
 
 project_endpoint_policies = [
 
@@ -73,7 +63,9 @@ project_endpoint_policies = [
         operations=[{'path': ('/v3/OS-EP-FILTER/endpoints/{endpoint_id}/'
                               'projects'),
                      'method': 'GET'}],
-        deprecated_rule=deprecated_list_projects_for_endpoint),
+        deprecated_rule=deprecated_list_projects_for_endpoint,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'add_endpoint_to_project',
         check_str=base.SYSTEM_ADMIN,
@@ -82,7 +74,9 @@ project_endpoint_policies = [
         operations=[{'path': ('/v3/OS-EP-FILTER/projects/{project_id}/'
                               'endpoints/{endpoint_id}'),
                      'method': 'PUT'}],
-        deprecated_rule=deprecated_add_endpoint_to_project),
+        deprecated_rule=deprecated_add_endpoint_to_project,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'check_endpoint_in_project',
         check_str=base.SYSTEM_READER,
@@ -94,7 +88,9 @@ project_endpoint_policies = [
                     {'path': ('/v3/OS-EP-FILTER/projects/{project_id}/'
                               'endpoints/{endpoint_id}'),
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_check_endpoint_in_project),
+        deprecated_rule=deprecated_check_endpoint_in_project,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_endpoints_for_project',
         check_str=base.SYSTEM_READER,
@@ -103,7 +99,9 @@ project_endpoint_policies = [
         operations=[{'path': ('/v3/OS-EP-FILTER/projects/{project_id}/'
                               'endpoints'),
                      'method': 'GET'}],
-        deprecated_rule=deprecated_list_endpoints_for_project),
+        deprecated_rule=deprecated_list_endpoints_for_project,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'remove_endpoint_from_project',
         check_str=base.SYSTEM_ADMIN,
@@ -113,7 +111,9 @@ project_endpoint_policies = [
         operations=[{'path': ('/v3/OS-EP-FILTER/projects/{project_id}/'
                               'endpoints/{endpoint_id}'),
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_remove_endpoint_from_project),
+        deprecated_rule=deprecated_remove_endpoint_from_project,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
 ]
 
 
diff --git a/keystone/common/policies/protocol.py b/keystone/common/policies/protocol.py
index 887fc70..de2a729 100644
--- a/keystone/common/policies/protocol.py
+++ b/keystone/common/policies/protocol.py
@@ -15,42 +15,31 @@ from oslo_policy import policy
 
 from keystone.common.policies import base
 
-DEPRECATED_REASON = (
-    "The federated protocol API is now aware of system scope and default "
-    "roles."
-)
-
 deprecated_get_protocol = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_protocol',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_list_protocols = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_protocols',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_update_protocol = policy.DeprecatedRule(
     name=base.IDENTITY % 'update_protocol',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_create_protocol = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_protocol',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_delete_protocol = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_protocol',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 
+DEPRECATED_REASON = (
+    "The federated protocol API is now aware of system scope and default "
+    "roles."
+)
 
 protocol_policies = [
     policy.DocumentedRuleDefault(
@@ -64,7 +53,9 @@ protocol_policies = [
         operations=[{'path': ('/v3/OS-FEDERATION/identity_providers/{idp_id}/'
                               'protocols/{protocol_id}'),
                      'method': 'PUT'}],
-        deprecated_rule=deprecated_create_protocol),
+        deprecated_rule=deprecated_create_protocol,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'update_protocol',
         check_str=base.SYSTEM_ADMIN,
@@ -73,7 +64,9 @@ protocol_policies = [
         operations=[{'path': ('/v3/OS-FEDERATION/identity_providers/{idp_id}/'
                               'protocols/{protocol_id}'),
                      'method': 'PATCH'}],
-        deprecated_rule=deprecated_update_protocol),
+        deprecated_rule=deprecated_update_protocol,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'get_protocol',
         check_str=base.SYSTEM_READER,
@@ -82,7 +75,9 @@ protocol_policies = [
         operations=[{'path': ('/v3/OS-FEDERATION/identity_providers/{idp_id}/'
                               'protocols/{protocol_id}'),
                      'method': 'GET'}],
-        deprecated_rule=deprecated_get_protocol),
+        deprecated_rule=deprecated_get_protocol,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_protocols',
         check_str=base.SYSTEM_READER,
@@ -91,7 +86,9 @@ protocol_policies = [
         operations=[{'path': ('/v3/OS-FEDERATION/identity_providers/{idp_id}/'
                               'protocols'),
                      'method': 'GET'}],
-        deprecated_rule=deprecated_list_protocols),
+        deprecated_rule=deprecated_list_protocols,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_protocol',
         check_str=base.SYSTEM_ADMIN,
@@ -100,7 +97,9 @@ protocol_policies = [
         operations=[{'path': ('/v3/OS-FEDERATION/identity_providers/{idp_id}/'
                               'protocols/{protocol_id}'),
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_protocol)
+        deprecated_rule=deprecated_delete_protocol,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN)
 ]
 
 
diff --git a/keystone/common/policies/region.py b/keystone/common/policies/region.py
index f13299d..bf60f8f 100644
--- a/keystone/common/policies/region.py
+++ b/keystone/common/policies/region.py
@@ -15,29 +15,22 @@ from oslo_policy import policy
 
 from keystone.common.policies import base
 
-DEPRECATED_REASON = (
-    "The region API is now aware of system scope and default roles."
-)
-
 deprecated_create_region = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_region',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_update_region = policy.DeprecatedRule(
     name=base.IDENTITY % 'update_region',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_delete_region = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_region',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 
+DEPRECATED_REASON = (
+    "The region API is now aware of system scope and default roles."
+)
 
 region_policies = [
     policy.DocumentedRuleDefault(
@@ -73,7 +66,9 @@ region_policies = [
                      'method': 'POST'},
                     {'path': '/v3/regions/{region_id}',
                      'method': 'PUT'}],
-        deprecated_rule=deprecated_create_region),
+        deprecated_rule=deprecated_create_region,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'update_region',
         check_str=base.SYSTEM_ADMIN,
@@ -81,7 +76,9 @@ region_policies = [
         description='Update region.',
         operations=[{'path': '/v3/regions/{region_id}',
                      'method': 'PATCH'}],
-        deprecated_rule=deprecated_update_region),
+        deprecated_rule=deprecated_update_region,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_region',
         check_str=base.SYSTEM_ADMIN,
@@ -89,7 +86,9 @@ region_policies = [
         description='Delete region.',
         operations=[{'path': '/v3/regions/{region_id}',
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_region),
+        deprecated_rule=deprecated_delete_region,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
 ]
 
 
diff --git a/keystone/common/policies/role.py b/keystone/common/policies/role.py
index b372efb..7d6a38e 100644
--- a/keystone/common/policies/role.py
+++ b/keystone/common/policies/role.py
@@ -15,71 +15,50 @@ from oslo_policy import policy
 
 from keystone.common.policies import base
 
-DEPRECATED_REASON = (
-    "The role API is now aware of system scope and default roles."
-)
-
 deprecated_get_role = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_role',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_list_role = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_roles',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_update_role = policy.DeprecatedRule(
     name=base.IDENTITY % 'update_role',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_create_role = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_role',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_delete_role = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_role',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_get_domain_role = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_domain_role',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_list_domain_roles = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_domain_roles',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_update_domain_role = policy.DeprecatedRule(
     name=base.IDENTITY % 'update_domain_role',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_create_domain_role = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_domain_role',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_delete_domain_role = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_domain_role',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 
+DEPRECATED_REASON = (
+    "The role API is now aware of system scope and default roles."
+)
 
 role_policies = [
     policy.DocumentedRuleDefault(
@@ -96,7 +75,9 @@ role_policies = [
                      'method': 'GET'},
                     {'path': '/v3/roles/{role_id}',
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_get_role),
+        deprecated_rule=deprecated_get_role,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_roles',
         check_str=base.SYSTEM_READER,
@@ -106,7 +87,9 @@ role_policies = [
                      'method': 'GET'},
                     {'path': '/v3/roles',
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_list_role),
+        deprecated_rule=deprecated_list_role,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'create_role',
         check_str=base.SYSTEM_ADMIN,
@@ -114,7 +97,9 @@ role_policies = [
         description='Create role.',
         operations=[{'path': '/v3/roles',
                      'method': 'POST'}],
-        deprecated_rule=deprecated_create_role),
+        deprecated_rule=deprecated_create_role,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'update_role',
         check_str=base.SYSTEM_ADMIN,
@@ -122,7 +107,9 @@ role_policies = [
         description='Update role.',
         operations=[{'path': '/v3/roles/{role_id}',
                      'method': 'PATCH'}],
-        deprecated_rule=deprecated_update_role),
+        deprecated_rule=deprecated_update_role,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_role',
         check_str=base.SYSTEM_ADMIN,
@@ -130,7 +117,9 @@ role_policies = [
         description='Delete role.',
         operations=[{'path': '/v3/roles/{role_id}',
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_role),
+        deprecated_rule=deprecated_delete_role,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'get_domain_role',
         check_str=base.SYSTEM_READER,
@@ -145,7 +134,9 @@ role_policies = [
                      'method': 'GET'},
                     {'path': '/v3/roles/{role_id}',
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_get_domain_role),
+        deprecated_rule=deprecated_get_domain_role,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_domain_roles',
         check_str=base.SYSTEM_READER,
@@ -155,7 +146,9 @@ role_policies = [
                      'method': 'GET'},
                     {'path': '/v3/roles?domain_id={domain_id}',
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_list_domain_roles),
+        deprecated_rule=deprecated_list_domain_roles,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'create_domain_role',
         check_str=base.SYSTEM_ADMIN,
@@ -163,7 +156,9 @@ role_policies = [
         scope_types=['system'],
         operations=[{'path': '/v3/roles',
                      'method': 'POST'}],
-        deprecated_rule=deprecated_create_domain_role),
+        deprecated_rule=deprecated_create_domain_role,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'update_domain_role',
         check_str=base.SYSTEM_ADMIN,
@@ -171,7 +166,9 @@ role_policies = [
         scope_types=['system'],
         operations=[{'path': '/v3/roles/{role_id}',
                      'method': 'PATCH'}],
-        deprecated_rule=deprecated_update_domain_role),
+        deprecated_rule=deprecated_update_domain_role,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_domain_role',
         check_str=base.SYSTEM_ADMIN,
@@ -179,7 +176,9 @@ role_policies = [
         scope_types=['system'],
         operations=[{'path': '/v3/roles/{role_id}',
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_domain_role)
+        deprecated_rule=deprecated_delete_domain_role,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN)
 ]
 
 
diff --git a/keystone/common/policies/role_assignment.py b/keystone/common/policies/role_assignment.py
index 5dea3dc..c70f292 100644
--- a/keystone/common/policies/role_assignment.py
+++ b/keystone/common/policies/role_assignment.py
@@ -25,23 +25,18 @@ SYSTEM_READER_OR_PROJECT_DOMAIN_READER_OR_PROJECT_ADMIN = (
     '(role:admin and project_id:%(target.project.id)s)'
 )
 
-DEPRECATED_REASON = (
-    "The assignment API is now aware of system scope and default roles."
-)
-
 deprecated_list_role_assignments = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_role_assignments',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_list_role_assignments_for_tree = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_role_assignments_for_tree',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 
+DEPRECATED_REASON = (
+    "The assignment API is now aware of system scope and default roles."
+)
 
 role_assignment_policies = [
     policy.DocumentedRuleDefault(
@@ -53,7 +48,9 @@ role_assignment_policies = [
                      'method': 'GET'},
                     {'path': '/v3/role_assignments',
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_list_role_assignments),
+        deprecated_rule=deprecated_list_role_assignments,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_role_assignments_for_tree',
         check_str=SYSTEM_READER_OR_PROJECT_DOMAIN_READER_OR_PROJECT_ADMIN,
@@ -64,7 +61,9 @@ role_assignment_policies = [
                      'method': 'GET'},
                     {'path': '/v3/role_assignments?include_subtree',
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_list_role_assignments_for_tree),
+        deprecated_rule=deprecated_list_role_assignments_for_tree,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
 
 ]
 
diff --git a/keystone/common/policies/service.py b/keystone/common/policies/service.py
index 0287076..66d3aaa 100644
--- a/keystone/common/policies/service.py
+++ b/keystone/common/policies/service.py
@@ -15,41 +15,30 @@ from oslo_policy import policy
 
 from keystone.common.policies import base
 
-DEPRECATED_REASON = (
-    "The service API is now aware of system scope and default roles."
-)
-
 deprecated_get_service = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_service',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_list_service = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_services',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_update_service = policy.DeprecatedRule(
     name=base.IDENTITY % 'update_service',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_create_service = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_service',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_delete_service = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_service',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 
+DEPRECATED_REASON = (
+    "The service API is now aware of system scope and default roles."
+)
 
 service_policies = [
     policy.DocumentedRuleDefault(
@@ -59,7 +48,9 @@ service_policies = [
         description='Show service details.',
         operations=[{'path': '/v3/services/{service_id}',
                      'method': 'GET'}],
-        deprecated_rule=deprecated_get_service),
+        deprecated_rule=deprecated_get_service,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_services',
         check_str=base.SYSTEM_READER,
@@ -67,7 +58,9 @@ service_policies = [
         description='List services.',
         operations=[{'path': '/v3/services',
                      'method': 'GET'}],
-        deprecated_rule=deprecated_list_service),
+        deprecated_rule=deprecated_list_service,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'create_service',
         check_str=base.SYSTEM_ADMIN,
@@ -75,7 +68,9 @@ service_policies = [
         description='Create service.',
         operations=[{'path': '/v3/services',
                      'method': 'POST'}],
-        deprecated_rule=deprecated_create_service),
+        deprecated_rule=deprecated_create_service,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'update_service',
         check_str=base.SYSTEM_ADMIN,
@@ -83,7 +78,9 @@ service_policies = [
         description='Update service.',
         operations=[{'path': '/v3/services/{service_id}',
                      'method': 'PATCH'}],
-        deprecated_rule=deprecated_update_service),
+        deprecated_rule=deprecated_update_service,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_service',
         check_str=base.SYSTEM_ADMIN,
@@ -91,7 +88,9 @@ service_policies = [
         description='Delete service.',
         operations=[{'path': '/v3/services/{service_id}',
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_service)
+        deprecated_rule=deprecated_delete_service,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN)
 ]
 
 
diff --git a/keystone/common/policies/service_provider.py b/keystone/common/policies/service_provider.py
index 657368a..4d0e3cb 100644
--- a/keystone/common/policies/service_provider.py
+++ b/keystone/common/policies/service_provider.py
@@ -15,41 +15,30 @@ from oslo_policy import policy
 
 from keystone.common.policies import base
 
-DEPRECATED_REASON = (
-    "The service provider API is now aware of system scope and default roles."
-)
-
 deprecated_get_sp = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_service_provider',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_list_sp = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_service_providers',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_update_sp = policy.DeprecatedRule(
     name=base.IDENTITY % 'update_service_provider',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_create_sp = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_service_provider',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_delete_sp = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_service_provider',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 
+DEPRECATED_REASON = (
+    "The service provider API is now aware of system scope and default roles."
+)
 
 service_provider_policies = [
     policy.DocumentedRuleDefault(
@@ -66,7 +55,9 @@ service_provider_policies = [
         operations=[{'path': ('/v3/OS-FEDERATION/service_providers/'
                               '{service_provider_id}'),
                      'method': 'PUT'}],
-        deprecated_rule=deprecated_create_sp),
+        deprecated_rule=deprecated_create_sp,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_service_providers',
         check_str=base.SYSTEM_READER,
@@ -82,7 +73,9 @@ service_provider_policies = [
                 'method': 'HEAD'
             }
         ],
-        deprecated_rule=deprecated_list_sp
+        deprecated_rule=deprecated_list_sp,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'get_service_provider',
@@ -101,7 +94,9 @@ service_provider_policies = [
                 'method': 'HEAD'
             }
         ],
-        deprecated_rule=deprecated_get_sp
+        deprecated_rule=deprecated_get_sp,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN
     ),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'update_service_provider',
@@ -111,7 +106,9 @@ service_provider_policies = [
         operations=[{'path': ('/v3/OS-FEDERATION/service_providers/'
                               '{service_provider_id}'),
                      'method': 'PATCH'}],
-        deprecated_rule=deprecated_update_sp),
+        deprecated_rule=deprecated_update_sp,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_service_provider',
         check_str=base.SYSTEM_ADMIN,
@@ -120,7 +117,9 @@ service_provider_policies = [
         operations=[{'path': ('/v3/OS-FEDERATION/service_providers/'
                               '{service_provider_id}'),
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_sp)
+        deprecated_rule=deprecated_delete_sp,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN)
 ]
 
 
diff --git a/keystone/common/policies/token.py b/keystone/common/policies/token.py
index cb321b0..9fa3c52 100644
--- a/keystone/common/policies/token.py
+++ b/keystone/common/policies/token.py
@@ -21,21 +21,15 @@ DEPRECATED_REASON = (
 
 deprecated_check_token = policy.DeprecatedRule(
     name=base.IDENTITY % 'check_token',
-    check_str=base.RULE_ADMIN_OR_TOKEN_SUBJECT,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_OR_TOKEN_SUBJECT
 )
 deprecated_validate_token = policy.DeprecatedRule(
     name=base.IDENTITY % 'validate_token',
-    check_str=base.RULE_SERVICE_ADMIN_OR_TOKEN_SUBJECT,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_SERVICE_ADMIN_OR_TOKEN_SUBJECT
 )
 deprecated_revoke_token = policy.DeprecatedRule(
     name=base.IDENTITY % 'revoke_token',
-    check_str=base.RULE_ADMIN_OR_TOKEN_SUBJECT,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_OR_TOKEN_SUBJECT
 )
 
 SYSTEM_ADMIN_OR_TOKEN_SUBJECT = (
@@ -58,7 +52,9 @@ token_policies = [
         description='Check a token.',
         operations=[{'path': '/v3/auth/tokens',
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_check_token),
+        deprecated_rule=deprecated_check_token,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'validate_token',
         check_str=SYSTEM_USER_OR_SERVICE_OR_TOKEN_SUBJECT,
@@ -66,7 +62,9 @@ token_policies = [
         description='Validate a token.',
         operations=[{'path': '/v3/auth/tokens',
                      'method': 'GET'}],
-        deprecated_rule=deprecated_validate_token),
+        deprecated_rule=deprecated_validate_token,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'revoke_token',
         check_str=SYSTEM_ADMIN_OR_TOKEN_SUBJECT,
@@ -74,7 +72,9 @@ token_policies = [
         description='Revoke a token.',
         operations=[{'path': '/v3/auth/tokens',
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_revoke_token)
+        deprecated_rule=deprecated_revoke_token,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN)
 ]
 
 
diff --git a/keystone/common/policies/trust.py b/keystone/common/policies/trust.py
index 7678106..82acb0a 100644
--- a/keystone/common/policies/trust.py
+++ b/keystone/common/policies/trust.py
@@ -24,39 +24,29 @@ SYSTEM_READER_OR_TRUSTOR = base.SYSTEM_READER + ' or ' + RULE_TRUSTOR
 SYSTEM_READER_OR_TRUSTEE = base.SYSTEM_READER + ' or ' + RULE_TRUSTEE
 SYSTEM_ADMIN_OR_TRUSTOR = base.SYSTEM_ADMIN + ' or ' + RULE_TRUSTOR
 
-DEPRECATED_REASON = (
-    "The trust API is now aware of system scope and default roles."
-)
-
 deprecated_list_trusts = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_trusts',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_list_roles_for_trust = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_roles_for_trust',
-    check_str=RULE_TRUSTOR + ' or ' + RULE_TRUSTEE,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=RULE_TRUSTOR + ' or ' + RULE_TRUSTEE
 )
 deprecated_get_role_for_trust = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_role_for_trust',
-    check_str=RULE_TRUSTOR + ' or ' + RULE_TRUSTEE,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=RULE_TRUSTOR + ' or ' + RULE_TRUSTEE
 )
 deprecated_delete_trust = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_trust',
-    check_str=RULE_TRUSTOR,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=RULE_TRUSTOR
 )
 deprecated_get_trust = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_trust',
-    check_str=RULE_TRUSTOR + ' or ' + RULE_TRUSTEE,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.TRAIN
+    check_str=RULE_TRUSTOR + ' or ' + RULE_TRUSTEE
+)
+
+DEPRECATED_REASON = (
+    "The trust API is now aware of system scope and default roles."
 )
 
 trust_policies = [
@@ -79,7 +69,9 @@ trust_policies = [
                      'method': 'GET'},
                     {'path': '/v3/OS-TRUST/trusts',
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_list_trusts),
+        deprecated_rule=deprecated_list_trusts,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_trusts_for_trustor',
         check_str=SYSTEM_READER_OR_TRUSTOR,
@@ -111,7 +103,9 @@ trust_policies = [
                      'method': 'GET'},
                     {'path': '/v3/OS-TRUST/trusts/{trust_id}/roles',
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_list_roles_for_trust),
+        deprecated_rule=deprecated_list_roles_for_trust,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'get_role_for_trust',
         check_str=SYSTEM_READER_OR_TRUSTOR_OR_TRUSTEE,
@@ -121,7 +115,9 @@ trust_policies = [
                      'method': 'GET'},
                     {'path': '/v3/OS-TRUST/trusts/{trust_id}/roles/{role_id}',
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_get_role_for_trust),
+        deprecated_rule=deprecated_get_role_for_trust,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_trust',
         check_str=SYSTEM_ADMIN_OR_TRUSTOR,
@@ -129,7 +125,9 @@ trust_policies = [
         description='Revoke trust.',
         operations=[{'path': '/v3/OS-TRUST/trusts/{trust_id}',
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_trust),
+        deprecated_rule=deprecated_delete_trust,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'get_trust',
         check_str=SYSTEM_READER_OR_TRUSTOR_OR_TRUSTEE,
@@ -139,7 +137,9 @@ trust_policies = [
                      'method': 'GET'},
                     {'path': '/v3/OS-TRUST/trusts/{trust_id}',
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_get_trust)
+        deprecated_rule=deprecated_get_trust,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.TRAIN)
 ]
 
 
diff --git a/keystone/common/policies/user.py b/keystone/common/policies/user.py
index 0534f70..75a0062 100644
--- a/keystone/common/policies/user.py
+++ b/keystone/common/policies/user.py
@@ -36,33 +36,23 @@ DEPRECATED_REASON = (
 
 deprecated_get_user = policy.DeprecatedRule(
     name=base.IDENTITY % 'get_user',
-    check_str=base.RULE_ADMIN_OR_OWNER,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_OR_OWNER
 )
 deprecated_list_users = policy.DeprecatedRule(
     name=base.IDENTITY % 'list_users',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_create_user = policy.DeprecatedRule(
     name=base.IDENTITY % 'create_user',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_update_user = policy.DeprecatedRule(
     name=base.IDENTITY % 'update_user',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 deprecated_delete_user = policy.DeprecatedRule(
     name=base.IDENTITY % 'delete_user',
-    check_str=base.RULE_ADMIN_REQUIRED,
-    deprecated_reason=DEPRECATED_REASON,
-    deprecated_since=versionutils.deprecated.STEIN
+    check_str=base.RULE_ADMIN_REQUIRED
 )
 
 user_policies = [
@@ -75,7 +65,9 @@ user_policies = [
                      'method': 'GET'},
                     {'path': '/v3/users/{user_id}',
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_get_user),
+        deprecated_rule=deprecated_get_user,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_users',
         check_str=SYSTEM_READER_OR_DOMAIN_READER,
@@ -85,7 +77,9 @@ user_policies = [
                      'method': 'GET'},
                     {'path': '/v3/users',
                      'method': 'HEAD'}],
-        deprecated_rule=deprecated_list_users),
+        deprecated_rule=deprecated_list_users,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'list_projects_for_user',
         check_str='',
@@ -117,7 +111,9 @@ user_policies = [
         description='Create a user.',
         operations=[{'path': '/v3/users',
                      'method': 'POST'}],
-        deprecated_rule=deprecated_create_user),
+        deprecated_rule=deprecated_create_user,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'update_user',
         check_str=SYSTEM_ADMIN_OR_DOMAIN_ADMIN,
@@ -125,7 +121,9 @@ user_policies = [
         description='Update a user, including administrative password resets.',
         operations=[{'path': '/v3/users/{user_id}',
                      'method': 'PATCH'}],
-        deprecated_rule=deprecated_update_user),
+        deprecated_rule=deprecated_update_user,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN),
     policy.DocumentedRuleDefault(
         name=base.IDENTITY % 'delete_user',
         check_str=SYSTEM_ADMIN_OR_DOMAIN_ADMIN,
@@ -133,7 +131,9 @@ user_policies = [
         description='Delete a user.',
         operations=[{'path': '/v3/users/{user_id}',
                      'method': 'DELETE'}],
-        deprecated_rule=deprecated_delete_user)
+        deprecated_rule=deprecated_delete_user,
+        deprecated_reason=DEPRECATED_REASON,
+        deprecated_since=versionutils.deprecated.STEIN)
 ]
 
 
diff --git a/keystone/common/rbac_enforcer/enforcer.py b/keystone/common/rbac_enforcer/enforcer.py
index 7add048..ca6a8e7 100644
--- a/keystone/common/rbac_enforcer/enforcer.py
+++ b/keystone/common/rbac_enforcer/enforcer.py
@@ -14,7 +14,6 @@ import functools
 
 import flask
 from oslo_log import log
-from oslo_policy import opts
 from oslo_policy import policy as common_policy
 from oslo_utils import strutils
 
@@ -40,13 +39,6 @@ _POSSIBLE_TARGET_ACTIONS = frozenset([
 _ENFORCEMENT_CHECK_ATTR = 'keystone:RBAC:enforcement_called'
 
 
-# TODO(gmann): Remove setting the default value of config policy_file
-# once oslo_policy change the default value to 'policy.yaml'.
-# https://github.com/openstack/oslo.policy/blob/a626ad12fe5a3abd49d70e3e5b95589d279ab578/oslo_policy/opts.py#L49
-DEFAULT_POLICY_FILE = 'policy.yaml'
-opts.set_defaults(CONF, DEFAULT_POLICY_FILE)
-
-
 class RBACEnforcer(object):
     """Enforce RBAC on API calls."""
 
diff --git a/keystone/common/sql/contract_repo/versions/079_contract_update_local_id_limit.py b/keystone/common/sql/contract_repo/versions/079_contract_update_local_id_limit.py
deleted file mode 100644
index 2b09cbc..0000000
--- a/keystone/common/sql/contract_repo/versions/079_contract_update_local_id_limit.py
+++ /dev/null
@@ -1,18 +0,0 @@
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
-# This is a placeholder for Ussuri backports. Do not use this number for new
-# Victoria work. New Victoria work starts after all the placeholders.
-
-
-def upgrade(migrate_engine):
-    pass
diff --git a/keystone/common/sql/core.py b/keystone/common/sql/core.py
index 7670c47..ed84e58 100644
--- a/keystone/common/sql/core.py
+++ b/keystone/common/sql/core.py
@@ -119,11 +119,6 @@ ModelBase.__init__ = initialize_decorator(ModelBase.__init__)
 class JsonBlob(sql_types.TypeDecorator):
 
     impl = sql.Text
-    # NOTE(ralonsoh): set to True as any other TypeDecorator in SQLAlchemy
-    # https://docs.sqlalchemy.org/en/14/core/custom_types.html# \
-    #   sqlalchemy.types.TypeDecorator.cache_ok
-    cache_ok = True
-    """This type is safe to cache."""
 
     def process_bind_param(self, value, dialect):
         return jsonutils.dumps(value)
@@ -149,11 +144,6 @@ class DateTimeInt(sql_types.TypeDecorator):
 
     impl = sql.BigInteger
     epoch = datetime.datetime.fromtimestamp(0, tz=pytz.UTC)
-    # NOTE(ralonsoh): set to True as any other TypeDecorator in SQLAlchemy
-    # https://docs.sqlalchemy.org/en/14/core/custom_types.html# \
-    #   sqlalchemy.types.TypeDecorator.cache_ok
-    cache_ok = True
-    """This type is safe to cache."""
 
     def process_bind_param(self, value, dialect):
         if value is None:
diff --git a/keystone/common/sql/data_migration_repo/versions/079_migrate_update_local_id_limit.py b/keystone/common/sql/data_migration_repo/versions/079_migrate_update_local_id_limit.py
deleted file mode 100644
index 2b09cbc..0000000
--- a/keystone/common/sql/data_migration_repo/versions/079_migrate_update_local_id_limit.py
+++ /dev/null
@@ -1,18 +0,0 @@
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
-# This is a placeholder for Ussuri backports. Do not use this number for new
-# Victoria work. New Victoria work starts after all the placeholders.
-
-
-def upgrade(migrate_engine):
-    pass
diff --git a/keystone/common/sql/expand_repo/versions/079_expand_update_local_id_limit.py b/keystone/common/sql/expand_repo/versions/079_expand_update_local_id_limit.py
deleted file mode 100644
index 20db838..0000000
--- a/keystone/common/sql/expand_repo/versions/079_expand_update_local_id_limit.py
+++ /dev/null
@@ -1,24 +0,0 @@
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
-import sqlalchemy as sql
-
-
-def upgrade(migrate_engine):
-
-    meta = sql.MetaData()
-    meta.bind = migrate_engine
-
-    id_mapping_table = sql.Table(
-        'id_mapping', meta, autoload=True
-    )
-    id_mapping_table.c.local_id.alter(type=sql.String(255))
diff --git a/keystone/common/utils.py b/keystone/common/utils.py
index 7c3e7ae..1314085 100644
--- a/keystone/common/utils.py
+++ b/keystone/common/utils.py
@@ -16,7 +16,7 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import collections.abc
+import collections
 import grp
 import hashlib
 import itertools
@@ -81,7 +81,7 @@ def flatten_dict(d, parent_key=''):
     items = []
     for k, v in d.items():
         new_key = parent_key + '.' + k if parent_key else k
-        if isinstance(v, collections.abc.MutableMapping):
+        if isinstance(v, collections.MutableMapping):
             items.extend(list(flatten_dict(v, new_key).items()))
         else:
             items.append((new_key, v))
diff --git a/keystone/conf/__init__.py b/keystone/conf/__init__.py
index 5de0ec1..77c26a1 100644
--- a/keystone/conf/__init__.py
+++ b/keystone/conf/__init__.py
@@ -18,7 +18,6 @@ from oslo_log import log
 from oslo_log import versionutils
 import oslo_messaging
 from oslo_middleware import cors
-from oslo_policy import opts as policy_opts
 from osprofiler import opts as profiler
 
 from keystone.conf import application_credential
@@ -186,12 +185,6 @@ def set_external_opts_defaults():
     # configure OSprofiler options
     profiler.set_defaults(CONF, enabled=False, trace_sqlalchemy=False)
 
-    # TODO(gmann): Remove setting the default value of config policy_file
-    # once oslo_policy change the default value to 'policy.yaml'.
-    # https://github.com/openstack/oslo.policy/blob/a626ad12fe5a3abd49d70e3e5b95589d279ab578/oslo_policy/opts.py#L49
-    DEFAULT_POLICY_FILE = 'policy.yaml'
-    policy_opts.set_defaults(cfg.CONF, DEFAULT_POLICY_FILE)
-
     # Oslo.cache is always enabled by default for request-local caching
     # TODO(morganfainberg): Fix this to not use internal interface when
     # oslo.cache has proper interface to set defaults added. This is
diff --git a/keystone/conf/memcache.py b/keystone/conf/memcache.py
index b4b8c8b..97dc2c9 100644
--- a/keystone/conf/memcache.py
+++ b/keystone/conf/memcache.py
@@ -19,12 +19,6 @@ from keystone.conf import utils
 dead_retry = cfg.IntOpt(
     'dead_retry',
     default=5 * 60,
-    deprecated_for_removal=True,
-    deprecated_reason='This option has no effect. '
-                      'Configure ``keystone.conf [cache] '
-                      'memcache_dead_retry`` option to set the '
-                      'dead_retry of memcached instead. ',
-    deprecated_since='Y',
     help=utils.fmt("""
 Number of seconds memcached server is considered dead before it is tried again.
 This is used by the key value store system.
@@ -34,7 +28,7 @@ socket_timeout = cfg.IntOpt(
     'socket_timeout',
     default=3,
     deprecated_for_removal=True,
-    deprecated_reason='This option has no effect. '
+    deprecated_reason='This option is duplicated with oslo.cache. '
                       'Configure ``keystone.conf [cache] '
                       'memcache_socket_timeout`` option to set the '
                       'socket_timeout of memcached instead. ',
@@ -47,12 +41,6 @@ store system.
 pool_maxsize = cfg.IntOpt(
     'pool_maxsize',
     default=10,
-    deprecated_for_removal=True,
-    deprecated_reason='This option has no effect. '
-                      'Configure ``keystone.conf [cache] '
-                      'memcache_pool_maxsize`` option to set the '
-                      'pool_maxsize of memcached instead. ',
-    deprecated_since='Y',
     help=utils.fmt("""
 Max total number of open connections to every memcached server. This is used by
 the key value store system.
@@ -61,12 +49,6 @@ the key value store system.
 pool_unused_timeout = cfg.IntOpt(
     'pool_unused_timeout',
     default=60,
-    deprecated_for_removal=True,
-    deprecated_reason='This option has no effect. '
-                      'Configure ``keystone.conf [cache] '
-                      'memcache_pool_unused_timeout`` option to set the '
-                      'pool_unused_timeout of memcached instead. ',
-    deprecated_since='Y',
     help=utils.fmt("""
 Number of seconds a connection to memcached is held unused in the pool before
 it is closed. This is used by the key value store system.
@@ -75,12 +57,6 @@ it is closed. This is used by the key value store system.
 pool_connection_get_timeout = cfg.IntOpt(
     'pool_connection_get_timeout',
     default=10,
-    deprecated_for_removal=True,
-    deprecated_reason='This option has no effect. '
-                      'Configure ``keystone.conf [cache] '
-                      'memcache_pool_connection_get_timeout`` option to set '
-                      'the connection_get_timeout of memcached instead. ',
-    deprecated_since='Y',
     help=utils.fmt("""
 Number of seconds that an operation will wait to get a memcache client
 connection. This is used by the key value store system.
diff --git a/keystone/federation/idp.py b/keystone/federation/idp.py
index 2f1a4fe..fd464f5 100644
--- a/keystone/federation/idp.py
+++ b/keystone/federation/idp.py
@@ -366,11 +366,7 @@ class SAMLGenerator(object):
 
         """
         canonicalization_method = xmldsig.CanonicalizationMethod()
-        # TODO(stephenfin): Drop when we remove support for pysaml < 7.1.0
-        if hasattr(xmldsig, 'TRANSFORM_C14N'):  # >= 7.1.0
-            canonicalization_method.algorithm = xmldsig.TRANSFORM_C14N
-        else:  # < 7.1.0
-            canonicalization_method.algorithm = xmldsig.ALG_EXC_C14N
+        canonicalization_method.algorithm = xmldsig.ALG_EXC_C14N
         signature_method = xmldsig.SignatureMethod(
             algorithm=xmldsig.SIG_RSA_SHA1)
 
@@ -378,11 +374,7 @@ class SAMLGenerator(object):
         envelope_transform = xmldsig.Transform(
             algorithm=xmldsig.TRANSFORM_ENVELOPED)
 
-        # TODO(stephenfin): Drop when we remove support for pysaml < 7.1.0
-        if hasattr(xmldsig, 'TRANSFORM_C14N'):  # >= 7.1.0
-            c14_transform = xmldsig.Transform(algorithm=xmldsig.TRANSFORM_C14N)
-        else:  # < 7.1.0
-            c14_transform = xmldsig.Transform(algorithm=xmldsig.ALG_EXC_C14N)
+        c14_transform = xmldsig.Transform(algorithm=xmldsig.ALG_EXC_C14N)
         transforms.transform = [envelope_transform, c14_transform]
 
         digest_method = xmldsig.DigestMethod(algorithm=xmldsig.DIGEST_SHA1)
diff --git a/keystone/identity/mapping_backends/sql.py b/keystone/identity/mapping_backends/sql.py
index 6fadd6a..676d144 100644
--- a/keystone/identity/mapping_backends/sql.py
+++ b/keystone/identity/mapping_backends/sql.py
@@ -21,7 +21,7 @@ class IDMapping(sql.ModelBase, sql.ModelDictMixin):
     __tablename__ = 'id_mapping'
     public_id = sql.Column(sql.String(64), primary_key=True)
     domain_id = sql.Column(sql.String(64), nullable=False)
-    local_id = sql.Column(sql.String(255), nullable=False)
+    local_id = sql.Column(sql.String(64), nullable=False)
     # NOTE(henry-nash): Postgres requires a name to be defined for an Enum
     entity_type = sql.Column(
         sql.Enum(identity_mapping.EntityType.USER,
diff --git a/keystone/identity/shadow_backends/sql.py b/keystone/identity/shadow_backends/sql.py
index 3e04b33..1d817c0 100644
--- a/keystone/identity/shadow_backends/sql.py
+++ b/keystone/identity/shadow_backends/sql.py
@@ -98,8 +98,7 @@ class ShadowUsers(base.ShadowUsersDriverBase):
             x for x in hints.filters if x['name'] not in ('idp_id',
                                                           'protocol_id',
                                                           'unique_id')]
-        if statements:
-            query = query.filter(sqlalchemy.and_(*statements))
+        query = query.filter(sqlalchemy.and_(*statements))
         return query
 
     def get_federated_users(self, hints):
diff --git a/keystone/locale/en_GB/LC_MESSAGES/keystone.po b/keystone/locale/en_GB/LC_MESSAGES/keystone.po
index 191ed55..5e6cdf8 100644
--- a/keystone/locale/en_GB/LC_MESSAGES/keystone.po
+++ b/keystone/locale/en_GB/LC_MESSAGES/keystone.po
@@ -12,11 +12,11 @@ msgid ""
 msgstr ""
 "Project-Id-Version: keystone VERSION\n"
 "Report-Msgid-Bugs-To: https://bugs.launchpad.net/openstack-i18n/\n"
-"POT-Creation-Date: 2021-01-08 19:57+0000\n"
+"POT-Creation-Date: 2020-06-18 11:23+0000\n"
 "MIME-Version: 1.0\n"
 "Content-Type: text/plain; charset=UTF-8\n"
 "Content-Transfer-Encoding: 8bit\n"
-"PO-Revision-Date: 2020-10-28 02:12+0000\n"
+"PO-Revision-Date: 2020-06-15 05:35+0000\n"
 "Last-Translator: Andi Chandler <[e-mail]>\n"
 "Language: en_GB\n"
 "Plural-Forms: nplurals=2; plural=(n != 1);\n"
@@ -1384,14 +1384,6 @@ msgstr ""
 
 #, python-format
 msgid ""
-"Unable to create additional credentials, maximum of %(limit)d already "
-"exceeded for user."
-msgstr ""
-"Unable to create additional credentials, maximum of %(limit)d already "
-"exceeded for user."
-
-#, python-format
-msgid ""
 "Unable to delete immutable %(type)s resource: `%(resource_id)s. Set resource "
 "option \"immutable\" to false first."
 msgstr ""
@@ -1500,10 +1492,6 @@ msgstr ""
 "%(group_id)s, Project: %(project_id)s, Domain: %(domain_id)s."
 
 #, python-format
-msgid "Unexpected evaluation type \"%(eval_type)s\""
-msgstr "Unexpected evaluation type \"%(eval_type)s\""
-
-#, python-format
 msgid "Unexpected status requested for JSON Home response, %s"
 msgstr "Unexpected status requested for JSON Home response, %s"
 
diff --git a/keystone/models/revoke_model.py b/keystone/models/revoke_model.py
index 63425f1..6841559 100644
--- a/keystone/models/revoke_model.py
+++ b/keystone/models/revoke_model.py
@@ -170,7 +170,7 @@ def matches(event, token_values):
     # rest of the logic.
 
     # The token has two attributes that can match the domain_id.
-    if event.domain_id is not None and event.domain_id not in (
+    if event.domain_id is not None and event.domain_id not in(
             token_values['identity_domain_id'],
             token_values['assignment_domain_id'],):
         return False
diff --git a/keystone/tests/unit/assignment/test_backends.py b/keystone/tests/unit/assignment/test_backends.py
index 4add564..cdf8966 100644
--- a/keystone/tests/unit/assignment/test_backends.py
+++ b/keystone/tests/unit/assignment/test_backends.py
@@ -3694,9 +3694,9 @@ class ImpliedRoleTests(AssignmentTestHelperMixin):
         expected_implied_role_ref = {
             'prior_role_id': prior_role_ref['id'],
             'implied_role_id': implied_role_ref['id']}
-        self.assertLessEqual(
-            expected_implied_role_ref.items(),
-            implied_role.items())
+        self.assertDictContainsSubset(
+            expected_implied_role_ref,
+            implied_role)
 
         PROVIDERS.role_api.delete_implied_role(
             prior_role_ref['id'],
diff --git a/keystone/tests/unit/catalog/test_backends.py b/keystone/tests/unit/catalog/test_backends.py
index 513e5c3..b2989de 100644
--- a/keystone/tests/unit/catalog/test_backends.py
+++ b/keystone/tests/unit/catalog/test_backends.py
@@ -111,23 +111,20 @@ class CatalogTests(object):
         PROVIDERS.catalog_api.get_region(region_id)
         # update the region bypassing catalog_api
         PROVIDERS.catalog_api.driver.update_region(region_id, updated_region)
-        self.assertLessEqual(
-            new_region.items(),
-            PROVIDERS.catalog_api.get_region(region_id).items()
+        self.assertDictContainsSubset(
+            new_region, PROVIDERS.catalog_api.get_region(region_id)
         )
         PROVIDERS.catalog_api.get_region.invalidate(
             PROVIDERS.catalog_api, region_id
         )
-        self.assertLessEqual(
-            updated_region.items(),
-            PROVIDERS.catalog_api.get_region(region_id).items()
+        self.assertDictContainsSubset(
+            updated_region, PROVIDERS.catalog_api.get_region(region_id)
         )
         # delete the region
         PROVIDERS.catalog_api.driver.delete_region(region_id)
         # still get the old region
-        self.assertLessEqual(
-            updated_region.items(),
-            PROVIDERS.catalog_api.get_region(region_id).items()
+        self.assertDictContainsSubset(
+            updated_region, PROVIDERS.catalog_api.get_region(region_id)
         )
         PROVIDERS.catalog_api.get_region.invalidate(
             PROVIDERS.catalog_api, region_id
@@ -345,23 +342,20 @@ class CatalogTests(object):
         PROVIDERS.catalog_api.driver.update_service(
             service_id, updated_service
         )
-        self.assertLessEqual(
-            new_service.items(),
-            PROVIDERS.catalog_api.get_service(service_id).items()
+        self.assertDictContainsSubset(
+            new_service, PROVIDERS.catalog_api.get_service(service_id)
         )
         PROVIDERS.catalog_api.get_service.invalidate(
             PROVIDERS.catalog_api, service_id
         )
-        self.assertLessEqual(
-            updated_service.items(),
-            PROVIDERS.catalog_api.get_service(service_id).items()
+        self.assertDictContainsSubset(
+            updated_service, PROVIDERS.catalog_api.get_service(service_id)
         )
 
         # delete bypassing catalog api
         PROVIDERS.catalog_api.driver.delete_service(service_id)
-        self.assertLessEqual(
-            updated_service.items(),
-            PROVIDERS.catalog_api.get_service(service_id).items()
+        self.assertDictContainsSubset(
+            updated_service, PROVIDERS.catalog_api.get_service(service_id)
         )
         PROVIDERS.catalog_api.get_service.invalidate(
             PROVIDERS.catalog_api, service_id
@@ -422,12 +416,12 @@ class CatalogTests(object):
         PROVIDERS.catalog_api.get_endpoint(endpoint['id'])
         # delete the service bypassing catalog api
         PROVIDERS.catalog_api.driver.delete_service(service['id'])
-        self.assertLessEqual(
-            endpoint.items(),
-            PROVIDERS.catalog_api.get_endpoint(endpoint['id']).items())
-        self.assertLessEqual(
-            service.items(),
-            PROVIDERS.catalog_api.get_service(service['id']).items())
+        self.assertDictContainsSubset(endpoint,
+                                      PROVIDERS.catalog_api.
+                                      get_endpoint(endpoint['id']))
+        self.assertDictContainsSubset(service,
+                                      PROVIDERS.catalog_api.
+                                      get_service(service['id']))
         PROVIDERS.catalog_api.get_endpoint.invalidate(
             PROVIDERS.catalog_api, endpoint['id']
         )
diff --git a/keystone/tests/unit/common/test_notifications.py b/keystone/tests/unit/common/test_notifications.py
index 2fa9f26..308cc01 100644
--- a/keystone/tests/unit/common/test_notifications.py
+++ b/keystone/tests/unit/common/test_notifications.py
@@ -1045,7 +1045,7 @@ class TestEventCallbacks(test_v3.RestfulTestCase):
         Foo()
         project_ref = unit.new_project_ref(domain_id=self.domain_id)
         PROVIDERS.resource_api.create_project(project_ref['id'], project_ref)
-        self.assertCountEqual(['cb1', 'cb0'], callback_called)
+        self.assertItemsEqual(['cb1', 'cb0'], callback_called)
 
     def test_invalid_event_callbacks(self):
         @notifications.listener
diff --git a/keystone/tests/unit/config_files/backend_ldap_sql.conf b/keystone/tests/unit/config_files/backend_ldap_sql.conf
index c50d8dd..96a0ffa 100644
--- a/keystone/tests/unit/config_files/backend_ldap_sql.conf
+++ b/keystone/tests/unit/config_files/backend_ldap_sql.conf
@@ -5,7 +5,7 @@
 #connection = mysql+pymysql://keystone:keystone@localhost/keystone?charset=utf8
 #To Test PostgreSQL:
 #connection = postgresql://keystone:keystone@localhost/keystone?client_encoding=utf8
-connection_recycle_time = 200
+idle_timeout = 200
 
 [ldap]
 url = fake://memory
diff --git a/keystone/tests/unit/config_files/backend_multi_ldap_sql.conf b/keystone/tests/unit/config_files/backend_multi_ldap_sql.conf