Merge lp:~jameinel/juju-core/login-returns-env-tag into lp:~go-bot/juju-core/trunk

[John A Meinel]

various: change API.Login() to handle EnvironTag

This changes a bit of Login handling to allow us to pass in an
EnvironTag which will get validated against the running environment. We
also return EnvironTag as part of the Login response, since otherwise
the existing client doesn't have a good way of finding out that
information.

It then goes around and updates a bunch of places so that we can store
the EnvironTag in our .jenv and read it back out (and pass it in).

I went with a new error message (invalid environment requested), rather
than just ErrPerm, partially because I have already validated the Login
credentials. (Since one user is intended to have access to multiple
environments, it made sense to layer it that way). It does still return
the CodeUnauthorized.

It is still valid to pass in an EnvironTag of "". Eventually we may
change how Login works under that circumstance (for Multi Environment
support), but for now this gets us closer to where we want to be.

If we get to the point that Bootstrap actually stashes our api
information it could also stash the environment tag. However, in the
short term if it just connects to the API like everything else, it will
get the environment UUID cached, which will let us be a bit more
protected from accidentally connecting to the wrong environment.

This might have implications for CI, as I believe they try to re-use
things like CACerts so that they can use the same .jenv files across
mulitple bootstraps. If so, this will start causing the client to get
rejected because the actual environment has changed. Though I think that
is the behavior that we decided we wanted.

https://codereview.appspot.com/101760046/

[John A Meinel (jameinel)]

Reviewers: mp+221021_code.launchpad.net,

Message:
Please take a look.

Description:
various: change API.Login() to handle EnvironTag

This changes a bit of Login handling to allow us to pass in an
EnvironTag which will get validated against the running environment. We
also return EnvironTag as part of the Login response, since otherwise
the existing client doesn't have a good way of finding out that
information.

It then goes around and updates a bunch of places so that we can store
the EnvironTag in our .jenv and read it back out (and pass it in).

I went with a new error message (invalid environment requested), rather
than just ErrPerm, partially because I have already validated the Login
credentials. (Since one user is intended to have access to multiple
environments, it made sense to layer it that way). It does still return
the CodeUnauthorized.

It is still valid to pass in an EnvironTag of "". Eventually we may
change how Login works under that circumstance (for Multi Environment
support), but for now this gets us closer to where we want to be.

If we get to the point that Bootstrap actually stashes our api
information it could also stash the environment tag. However, in the
short term if it just connects to the API like everything else, it will
get the environment UUID cached, which will let us be a bit more
protected from accidentally connecting to the wrong environment.

This might have implications for CI, as I believe they try to re-use
things like CACerts so that they can use the same .jenv files across
mulitple bootstraps. If so, this will start causing the client to get
rejected because the actual environment has changed. Though I think that
is the behavior that we decided we wanted.

https://code.launchpad.net/~jameinel/juju-core/login-returns-env-tag/+merge/221021

(do not edit description out of merge proposal)

Please review this at https://codereview.appspot.com/101760046/

Affected files (+387, -40 lines):
   A [revision details]
   M environs/configstore/disk.go
   M environs/configstore/interface.go
   M environs/configstore/interface_test.go
   M juju/api.go
   M juju/apiconn_test.go
   M juju/mock_test.go
   M state/api/apiclient.go
   M state/api/apiclient_test.go
   M state/api/params/params.go
   M state/api/state.go
   M state/api/state_test.go
   M state/apiserver/admin.go
   M state/apiserver/common/errors.go
   M state/apiserver/login_test.go

[William Reade (fwereade)]

This looks good. In the absence of completed API versioning I'd actually
be happy to land this as is -- but I'd appreciate your thoughts on
consolidating the configstore and agentconfig bits...

https://codereview.appspot.com/101760046/diff/1/environs/configstore/disk.go
File environs/configstore/disk.go (right):

https://codereview.appspot.com/101760046/diff/1/environs/configstore/disk.go#newcode144
environs/configstore/disk.go:144: EnvironTag: info.EnvInfo.EnvironTag,
I think we want to *store* the uuid, not the tag -- the tags really are
just for the API, and I would prefer that we not let them leak into
users' worldviews. Tags coming back from the API are fine and good, but
no further.

https://codereview.appspot.com/101760046/diff/1/environs/configstore/interface_test.go
File environs/configstore/interface_test.go (right):

https://codereview.appspot.com/101760046/diff/1/environs/configstore/interface_test.go#newcode51
environs/configstore/interface_test.go:51: EnvironTag:
"environ-dead-beef",
this choice of "uuid" makes me unreasonably happy :)

https://codereview.appspot.com/101760046/diff/1/juju/api.go
File juju/api.go (right):

https://codereview.appspot.com/101760046/diff/1/juju/api.go#newcode358
juju/api.go:358: EnvironTag: apiInfo.EnvironTag,
I won't keep saying it, but this is the place to just extract the uuid
and store it.

https://codereview.appspot.com/101760046/diff/1/juju/api.go#newcode387
juju/api.go:387: _ = newEnvironTag
?

https://codereview.appspot.com/101760046/diff/1/state/apiserver/admin.go
File state/apiserver/admin.go (right):

https://codereview.appspot.com/101760046/diff/1/state/apiserver/admin.go#newcode142
state/apiserver/admin.go:142: // trigger an error for the Environment()
call?
Heh. You could, inside state, slip in and delete the document; but
Idon't think there's a way to do it here. (Stop the mongo? ;p)

https://codereview.appspot.com/101760046/diff/1/state/apiserver/login_test.go
File state/apiserver/login_test.go (right):

https://codereview.appspot.com/101760046/diff/1/state/apiserver/login_test.go#newcode530
state/apiserver/login_test.go:530: }
I guess we have enough tests that it accepts a missing environ tag
already?

I'm wondering whether we should be fixing this stuff for the agents as
well. It's less pressing, but still.

(FWIW, I feel that all this code to connect and store changes etc etc
really should be exactly the same on agent and client -- the only
interesting difference is the extra stuff that agents need to do to
change their passwords, and the client will need the same functionality
once we expose pass-word-changing there.)

https://codereview.appspot.com/101760046/

[lp:~jameinel/juju-core/login-returns-env-tag]

2801. By John A Meinel on 2014-05-27

clean up the code so that we only store EnvironUUID and just talk about EnvironTag in the api calls

2802. By John A Meinel on 2014-05-27

clarify in the comments that we are explicitly testing the case where EnvironTag is empty.

[John A Meinel (jameinel)]

Please take a look.

https://codereview.appspot.com/101760046/diff/1/environs/configstore/disk.go
File environs/configstore/disk.go (right):

https://codereview.appspot.com/101760046/diff/1/environs/configstore/disk.go#newcode144
environs/configstore/disk.go:144: EnvironTag: info.EnvInfo.EnvironTag,
On 2014/05/27 07:27:57, fwereade wrote:
> I think we want to *store* the uuid, not the tag -- the tags really
are just for
> the API, and I would prefer that we not let them leak into users'
worldviews.
> Tags coming back from the API are fine and good, but no further.

Fine with me. I wasn't sure if bare UUIDs were better to store than
tags. I realized that in the API things are tags, and in State they are
IDs, but wasn't sure about user level stuff.

Done.

I ended up sticking with the api.State object has an EnvironTag()
method, and api.Info thinks of tags, but configstore.EnvironInfo uses
EnvironUUID.

https://codereview.appspot.com/101760046/diff/1/environs/configstore/interface_test.go
File environs/configstore/interface_test.go (right):

https://codereview.appspot.com/101760046/diff/1/environs/configstore/interface_test.go#newcode51
environs/configstore/interface_test.go:51: EnvironTag:
"environ-dead-beef",
On 2014/05/27 07:27:57, fwereade wrote:
> this choice of "uuid" makes me unreasonably happy :)

:)

https://codereview.appspot.com/101760046/diff/1/juju/api.go
File juju/api.go (right):

https://codereview.appspot.com/101760046/diff/1/juju/api.go#newcode358
juju/api.go:358: EnvironTag: apiInfo.EnvironTag,
On 2014/05/27 07:27:57, fwereade wrote:
> I won't keep saying it, but this is the place to just extract the uuid
and store
> it.

Done.

https://codereview.appspot.com/101760046/diff/1/juju/api.go#newcode358
juju/api.go:358: EnvironTag: apiInfo.EnvironTag,
On 2014/05/27 07:27:57, fwereade wrote:
> I won't keep saying it, but this is the place to just extract the uuid
and store
> it.

Done.

https://codereview.appspot.com/101760046/diff/1/juju/api.go#newcode387
juju/api.go:387: _ = newEnvironTag
On 2014/05/27 07:27:57, fwereade wrote:
> ?

temporary workaround for golang not allowing unused vars while
incrementally building code. removed.

https://codereview.appspot.com/101760046/diff/1/state/apiserver/admin.go
File state/apiserver/admin.go (right):

https://codereview.appspot.com/101760046/diff/1/state/apiserver/admin.go#newcode142
state/apiserver/admin.go:142: // trigger an error for the Environment()
call?
On 2014/05/27 07:27:58, fwereade wrote:
> Heh. You could, inside state, slip in and delete the document; but
Idon't think
> there's a way to do it here. (Stop the mongo? ;p)

Yeah, it is just one of those things where you "have" to propagate
errors, but I really don't like touching the stuff without actually
checking what it does.
Should this actually be returning some other error for the API? Is it
sane to just blat out whatever internal failure occured?

We don't really have concrete decisions around this sort of thing (that
I can tell).

https://codereview.appspot.com/101760046/diff/1/state/apiserver/login_test.go
File state/apiserver/login_test.go (right):

https://codereview.appspot.com/101760046/diff/1/state/apiserver/login_t...

[John A Meinel (jameinel)]

Please take a look.

https://codereview.appspot.com/101760046/

[Andrew Wilkins (axwalk)]

LGTM

https://codereview.appspot.com/101760046/diff/40001/juju/api.go
File juju/api.go (right):

https://codereview.appspot.com/101760046/diff/40001/juju/api.go#newcode271
juju/api.go:271: environUUID := ""
s/environUUID/environTag/

https://codereview.appspot.com/101760046/diff/40001/juju/apiconn_test.go
File juju/apiconn_test.go (right):

https://codereview.appspot.com/101760046/diff/40001/juju/apiconn_test.go#newcode283
juju/apiconn_test.go:283: // The local cache doesn't have an EnvironTag,
which the API does
I think this is testing something that is currently impossible. I
suppose it doesn't hurt to be cautious of bugs introduced in the server
though.

https://codereview.appspot.com/101760046/diff/40001/state/api/state_test.go
File state/api/state_test.go (right):

https://codereview.appspot.com/101760046/diff/40001/state/api/state_test.go#newcode105
state/api/state_test.go:105: c.Check(apistate.EnvironTag(), gc.Equals,
env.Tag())
An explicit test for Login with envtag=="" would be good here.

https://codereview.appspot.com/101760046/diff/40001/state/apiserver/admin.go
File state/apiserver/admin.go (right):

https://codereview.appspot.com/101760046/diff/40001/state/apiserver/admin.go#newcode138
state/apiserver/admin.go:138: if c.EnvironTag != "" {
Perhaps add a comment here, saying why we allow an unspecified
EnvironTag, lest someone thinks it's a bug and breaks it?

https://codereview.appspot.com/101760046/diff/40001/state/apiserver/login_test.go
File state/apiserver/login_test.go (right):

https://codereview.appspot.com/101760046/diff/40001/state/apiserver/login_test.go#newcode519
state/apiserver/login_test.go:519:
func (s *loginSuite) TestLoginAcceptsEmptyEnvironTag(c *gc.C) {
...
}

?

https://codereview.appspot.com/101760046/

[John A Meinel (jameinel)]

Thanks for your review. I've superseded this request with this one:
https://codereview.appspot.com/102920048/

However, hopefully I've managed to address/respond to all of the
comments you've made here.

https://codereview.appspot.com/101760046/diff/40001/juju/api.go
File juju/api.go (right):

https://codereview.appspot.com/101760046/diff/40001/juju/api.go#newcode271
juju/api.go:271: environUUID := ""
On 2014/05/29 03:59:25, axw wrote:
> s/environUUID/environTag/

Done.

https://codereview.appspot.com/101760046/diff/40001/juju/apiconn_test.go
File juju/apiconn_test.go (right):

https://codereview.appspot.com/101760046/diff/40001/juju/apiconn_test.go#newcode283
juju/apiconn_test.go:283: // The local cache doesn't have an EnvironTag,
which the API does
On 2014/05/29 03:59:25, axw wrote:
> I think this is testing something that is currently impossible. I
suppose it
> doesn't hurt to be cautious of bugs introduced in the server though.

It actually happens in the test suite. Specifically our test suite has a
lot of places where we have no machine-0 (and thus no API host ports).

https://codereview.appspot.com/101760046/diff/40001/state/api/state_test.go
File state/api/state_test.go (right):

https://codereview.appspot.com/101760046/diff/40001/state/api/state_test.go#newcode105
state/api/state_test.go:105: c.Check(apistate.EnvironTag(), gc.Equals,
env.Tag())
On 2014/05/29 03:59:25, axw wrote:
> An explicit test for Login with envtag=="" would be good here.

I believe I have that test in the follow up.

https://codereview.appspot.com/101760046/diff/40001/state/apiserver/admin.go
File state/apiserver/admin.go (right):

https://codereview.appspot.com/101760046/diff/40001/state/apiserver/admin.go#newcode138
state/apiserver/admin.go:138: if c.EnvironTag != "" {
On 2014/05/29 03:59:25, axw wrote:
> Perhaps add a comment here, saying why we allow an unspecified
EnvironTag, lest
> someone thinks it's a bug and breaks it?

This code is now moved, because the EnvironUUID is in the URL instead of
as a parameter to Login.

However, I added what is hopefully a good comment to
"validateEnvironUUID".

https://codereview.appspot.com/101760046/diff/40001/state/apiserver/login_test.go
File state/apiserver/login_test.go (right):

https://codereview.appspot.com/101760046/diff/40001/state/apiserver/login_test.go#newcode519
state/apiserver/login_test.go:519:
On 2014/05/29 03:59:25, axw wrote:
> func (s *loginSuite) TestLoginAcceptsEmptyEnvironTag(c *gc.C) {
> ...
> }

> ?

If you look, "TestLoginReportsEnvironTag" explicitly passes
EnvironTag:"" which is the test you're looking for. Would you prefer a
different name?

https://codereview.appspot.com/101760046/

[Andrew Wilkins (axwalk)]

https://codereview.appspot.com/101760046/diff/40001/state/apiserver/login_test.go
File state/apiserver/login_test.go (right):

https://codereview.appspot.com/101760046/diff/40001/state/apiserver/login_test.go#newcode519
state/apiserver/login_test.go:519:
On 2014/06/01 09:53:31, jameinel wrote:
> On 2014/05/29 03:59:25, axw wrote:
> > func (s *loginSuite) TestLoginAcceptsEmptyEnvironTag(c *gc.C) {
> > ...
> > }
> >
> > ?

> If you look, "TestLoginReportsEnvironTag" explicitly passes
EnvironTag:"" which
> is the test you're looking for. Would you prefer a different name?

Sorry, don't know how I missed that. That's fine.

https://codereview.appspot.com/101760046/

[John A Meinel (jameinel)]

np, William missed it as well. The naming probably leads reviews to think
about "what about this case" and there isn't an obviously named test doing
it.

On Sun, Jun 1, 2014 at 4:15 PM, Andrew Wilkins <<email address hidden>
> wrote:

>
>
> https://codereview.appspot.com/101760046/diff/40001/state/apiserver/login_test.go
> File state/apiserver/login_test.go (right):
>
>
> https://codereview.appspot.com/101760046/diff/40001/state/apiserver/login_test.go#newcode519
> state/apiserver/login_test.go:519:
> On 2014/06/01 09:53:31, jameinel wrote:
> > On 2014/05/29 03:59:25, axw wrote:
> > > func (s *loginSuite) TestLoginAcceptsEmptyEnvironTag(c *gc.C) {
> > > ...
> > > }
> > >
> > > ?
>
> > If you look, "TestLoginReportsEnvironTag" explicitly passes
> EnvironTag:"" which
> > is the test you're looking for. Would you prefer a different name?
>
>
> Sorry, don't know how I missed that. That's fine.
>
> https://codereview.appspot.com/101760046/
>
> --
>
> https://code.launchpad.net/~jameinel/juju-core/login-returns-env-tag/+merge/221021
> You are the owner of lp:~jameinel/juju-core/login-returns-env-tag.
>

Unmerged revisions

2802. By John A Meinel on 2014-05-27

clarify in the comments that we are explicitly testing the case where EnvironTag is empty.

2801. By John A Meinel on 2014-05-27

clean up the code so that we only store EnvironUUID and just talk about EnvironTag in the api calls

2800. By John A Meinel on 2014-05-27

Fix another edge case.

Our test suite doesn't always have APIHostPorts available, because we don't
always have a machine-0. In those cases, we can get an EnvironTag but not
have any addresses to connect to. We don't want to end up setting the
connection addresses to the empty list, and make it hard to actually
connect to the environment.
Add a test, move where we set addrs to only set it when they have changed.

2799. By John A Meinel on 2014-05-27

Fixup the APIServer tests now that Login takes the extra argument

2798. By John A Meinel on 2014-05-27

Test that Open and Login will pass the EnvironTag when requested.

2797. By John A Meinel on 2014-05-27

update another environs/configstore test for the new tag

2796. By John A Meinel on 2014-05-26

Thread the EnvironTag code through the testing mocks at least.
The 'juju' test suite is happy.

2795. By John A Meinel on 2014-05-26

Start working on threading EnvironTag through all the apis, not quite working yet.

2794. By John A Meinel on 2014-05-26

rename Environ to EnvironTag.

2793. By John A Meinel on 2014-05-26

Admin.Login accepts environ tags, and will give you a valid error when it doesn't know about the UUID you are requesting.

=== modified file 'environs/configstore/disk.go'
--- environs/configstore/disk.go	2014-05-13 04:50:10 +0000
+++ environs/configstore/disk.go	2014-05-27 09:53:17 +0000
@@ -32,6 +32,7 @@
 type EnvironInfoData struct {
 	User         string
 	Password     string
+	EnvironUUID  string                 `json:"environ-uuid,omitempty" yaml:"environ-uuid,omitempty"`
 	StateServers []string               `json:"state-servers" yaml:"state-servers"`
 	CACert       string                 `json:"ca-cert" yaml:"ca-cert"`
 	Config       map[string]interface{} `json:"bootstrap-config,omitempty" yaml:"bootstrap-config,omitempty"`
@@ -138,8 +139,9 @@
 // APIEndpoint implements EnvironInfo.APIEndpoint.
 func (info *environInfo) APIEndpoint() APIEndpoint {
 	return APIEndpoint{
-		Addresses: info.EnvInfo.StateServers,
-		CACert:    info.EnvInfo.CACert,
+		Addresses:   info.EnvInfo.StateServers,
+		CACert:      info.EnvInfo.CACert,
+		EnvironUUID: info.EnvInfo.EnvironUUID,
 	}
 }
 
@@ -155,6 +157,7 @@
 func (info *environInfo) SetAPIEndpoint(endpoint APIEndpoint) {
 	info.EnvInfo.StateServers = endpoint.Addresses
 	info.EnvInfo.CACert = endpoint.CACert
+	info.EnvInfo.EnvironUUID = endpoint.EnvironUUID
 }
 
 // SetAPICredentials implements EnvironInfo.SetAPICredentials.

=== modified file 'environs/configstore/interface.go'
--- environs/configstore/interface.go	2014-05-22 00:48:08 +0000
+++ environs/configstore/interface.go	2014-05-27 09:53:17 +0000
@@ -19,6 +19,10 @@
 	// CACert holds the CA certificate that
 	// signed the API server's key.
 	CACert string
+
+	// EnvironUUID holds the UUID for the environment we are connecting to.
+	// This may be empty if the environment has not been bootstrapped.
+	EnvironUUID string
 }
 
 // APICredentials hold credentials for connecting to an API endpoint.

=== modified file 'environs/configstore/interface_test.go'
--- environs/configstore/interface_test.go	2014-05-20 04:27:02 +0000
+++ environs/configstore/interface_test.go	2014-05-27 09:53:17 +0000
@@ -46,8 +46,9 @@
 	c.Assert(err, gc.IsNil)
 
 	expectEndpoint := configstore.APIEndpoint{
-		Addresses: []string{"example.com"},
-		CACert:    "a cert",
+		Addresses:   []string{"example.com"},
+		CACert:      "a cert",
+		EnvironUUID: "dead-beef",
 	}
 	info.SetAPIEndpoint(expectEndpoint)
 	c.Assert(info.APIEndpoint(), gc.DeepEquals, expectEndpoint)
@@ -75,8 +76,9 @@
 	info.SetAPICredentials(expectCreds)
 
 	expectEndpoint := configstore.APIEndpoint{
-		Addresses: []string{"example.com"},
-		CACert:    "a cert",
+		Addresses:   []string{"example.invalid"},
+		CACert:      "a cert",
+		EnvironUUID: "dead-beef",
 	}
 	info.SetAPIEndpoint(expectEndpoint)
 

=== modified file 'juju/api.go'
--- juju/api.go	2014-05-13 04:30:48 +0000
+++ juju/api.go	2014-05-27 09:53:17 +0000
@@ -32,6 +32,7 @@
 type apiState interface {
 	Close() error
 	APIHostPorts() [][]instance.HostPort
+	EnvironTag() string
 }
 
 type apiOpenFunc func(*api.Info, api.DialOpts) (apiState, error)
@@ -212,7 +213,7 @@
 
 	st := val0.(apiState)
 	// Even though we are about to update API addresses based on
-	// APIHostPorts in cacheChangedAPIAddresses, we first cache the
+	// APIHostPorts in cacheChangedAPIInfo, we first cache the
 	// addresses based on the provider lookup. This is because older API
 	// servers didn't return their HostPort information on Login, and we
 	// still want to cache our connection information to them.
@@ -231,7 +232,7 @@
 		}
 	}
 	// Update API addresses if they've changed. Error is non-fatal.
-	if localerr := cacheChangedAPIAddresses(info, st); localerr != nil {
+	if localerr := cacheChangedAPIInfo(info, st); localerr != nil {
 		logger.Warningf("cannot failed to cache API addresses: %v", localerr)
 	}
 	return st, nil
@@ -267,11 +268,16 @@
 		return nil, &infoConnectError{fmt.Errorf("no cached addresses")}
 	}
 	logger.Infof("connecting to API addresses: %v", endpoint.Addresses)
+	environUUID := ""
+	if endpoint.EnvironUUID != "" {
+		environUUID = names.EnvironTag(endpoint.EnvironUUID)
+	}
 	apiInfo := &api.Info{
-		Addrs:    endpoint.Addresses,
-		CACert:   endpoint.CACert,
-		Tag:      names.UserTag(info.APICredentials().User),
-		Password: info.APICredentials().Password,
+		Addrs:      endpoint.Addresses,
+		CACert:     endpoint.CACert,
+		Tag:        names.UserTag(info.APICredentials().User),
+		Password:   info.APICredentials().Password,
+		EnvironTag: environUUID,
 	}
 	st, err := apiOpen(apiInfo, api.DefaultDialOpts())
 	if err != nil {
@@ -344,9 +350,18 @@
 // with the provided apiInfo, assuming we've just successfully
 // connected to the API server.
 func cacheAPIInfo(info configstore.EnvironInfo, apiInfo *api.Info) error {
+	environUUID := ""
+	if apiInfo.EnvironTag != "" {
+		var err error
+		_, environUUID, err = names.ParseTag(apiInfo.Tag, names.EnvironTagKind)
+		if err != nil {
+			return fmt.Errorf("invalid API environment tag: %v", err)
+		}
+	}
 	info.SetAPIEndpoint(configstore.APIEndpoint{
-		Addresses: apiInfo.Addrs,
-		CACert:    string(apiInfo.CACert),
+		Addresses:   apiInfo.Addrs,
+		CACert:      string(apiInfo.CACert),
+		EnvironUUID: environUUID,
 	})
 	_, username, err := names.ParseTag(apiInfo.Tag, names.UserTagKind)
 	if err != nil {
@@ -359,9 +374,10 @@
 	return info.Write()
 }
 
-// cacheChangedAPIAddresses updates the local environment settings (.jenv file)
-// with the provided API server addresses if they have changed.
-func cacheChangedAPIAddresses(info configstore.EnvironInfo, st apiState) error {
+// cacheChangedAPIInfo updates the local environment settings (.jenv file)
+// with the provided API server addresses if they have changed. It will also
+// save the environment tag if it is available.
+func cacheChangedAPIInfo(info configstore.EnvironInfo, st apiState) error {
 	var addrs []string
 	for _, serverHostPorts := range st.APIHostPorts() {
 		for _, hostPort := range serverHostPorts {
@@ -373,11 +389,23 @@
 		}
 	}
 	endpoint := info.APIEndpoint()
-	if len(addrs) == 0 || !addrsChanged(endpoint.Addresses, addrs) {
+	newEnvironTag := st.EnvironTag()
+	changed := false
+	if newEnvironTag != "" {
+		_, environUUID, err := names.ParseTag(newEnvironTag, names.EnvironTagKind)
+		if err == nil && endpoint.EnvironUUID != environUUID {
+			changed = true
+			endpoint.EnvironUUID = environUUID
+		}
+	}
+	if len(addrs) != 0 && addrsChanged(endpoint.Addresses, addrs) {
+		logger.Debugf("API addresses changed from %q to %q", endpoint.Addresses, addrs)
+		changed = true
+		endpoint.Addresses = addrs
+	}
+	if !changed {
 		return nil
 	}
-	logger.Debugf("API addresses changed from %q to %q", endpoint.Addresses, addrs)
-	endpoint.Addresses = addrs
 	info.SetAPIEndpoint(endpoint)
 	if err := info.Write(); err != nil {
 		return err

=== modified file 'juju/apiconn_test.go'
--- juju/apiconn_test.go	2014-05-16 01:33:13 +0000
+++ juju/apiconn_test.go	2014-05-27 09:53:17 +0000
@@ -123,11 +123,13 @@
 		apiHostPorts: [][]instance.HostPort{
 			instance.AddressesWithPort([]instance.Address{instance.NewAddress("0.1.2.3", instance.NetworkUnknown)}, 1234),
 		},
+		environTag: "environment-fake-uuid",
 	}
 	apiOpen := func(apiInfo *api.Info, opts api.DialOpts) (juju.APIState, error) {
 		c.Check(apiInfo.Tag, gc.Equals, "user-foo")
 		c.Check(string(apiInfo.CACert), gc.Equals, "certificated")
 		c.Check(apiInfo.Password, gc.Equals, "foopass")
+		c.Check(apiInfo.EnvironTag, gc.Equals, "environment-fake-uuid")
 		c.Check(opts, gc.DeepEquals, api.DefaultDialOpts())
 		called++
 		return expectState, nil
@@ -143,7 +145,9 @@
 	c.Assert(mockStore.written, jc.IsTrue)
 	info, err := store.ReadInfo("noconfig")
 	c.Assert(err, gc.IsNil)
-	c.Assert(info.APIEndpoint().Addresses, gc.DeepEquals, []string{"0.1.2.3:1234"})
+	ep := info.APIEndpoint()
+	c.Assert(ep.Addresses, gc.DeepEquals, []string{"0.1.2.3:1234"})
+	c.Check(ep.EnvironUUID, gc.Equals, "fake-uuid")
 	mockStore.written = false
 
 	// If APIHostPorts haven't changed, then the store won't be updated.
@@ -185,6 +189,8 @@
 		c.Check(apiInfo.Tag, gc.Equals, "user-admin")
 		c.Check(string(apiInfo.CACert), gc.Not(gc.Equals), "")
 		c.Check(apiInfo.Password, gc.Equals, "adminpass")
+		// EnvironTag wasn't in regular Config
+		c.Check(apiInfo.EnvironTag, gc.Equals, "")
 		c.Check(opts, gc.DeepEquals, api.DefaultDialOpts())
 		called++
 		return expectState, nil
@@ -202,6 +208,9 @@
 	c.Assert(ep.Addresses, gc.HasLen, 1)
 	c.Check(ep.Addresses[0], gc.Matches, `127\.0\.0\.1:\d+`)
 	c.Check(ep.CACert, gc.Not(gc.Equals), "")
+	// Old servers won't hand back EnvironTag, so it should stay empty in
+	// the cache
+	c.Check(ep.EnvironUUID, gc.Equals, "")
 	creds := info.APICredentials()
 	c.Check(creds.User, gc.Equals, "admin")
 	c.Check(creds.Password, gc.Equals, "adminpass")
@@ -227,6 +236,128 @@
 	c.Assert(st, gc.IsNil)
 }
 
+func (s *NewAPIClientSuite) TestWithInfoNoEnvironTag(c *gc.C) {
+	store := newConfigStore("noconfig", &environInfo{
+		creds: configstore.APICredentials{
+			User:     "foo",
+			Password: "foopass",
+		},
+		endpoint: configstore.APIEndpoint{
+			Addresses: []string{"foo.invalid"},
+			CACert:    "certificated",
+		},
+	})
+
+	called := 0
+	expectState := &mockAPIState{
+		apiHostPorts: [][]instance.HostPort{
+			instance.AddressesWithPort([]instance.Address{instance.NewAddress("0.1.2.3", instance.NetworkUnknown)}, 1234),
+		},
+		environTag: "environment-fake-uuid",
+	}
+	apiOpen := func(apiInfo *api.Info, opts api.DialOpts) (juju.APIState, error) {
+		c.Check(apiInfo.Tag, gc.Equals, "user-foo")
+		c.Check(string(apiInfo.CACert), gc.Equals, "certificated")
+		c.Check(apiInfo.Password, gc.Equals, "foopass")
+		c.Check(apiInfo.EnvironTag, gc.Equals, "")
+		c.Check(opts, gc.DeepEquals, api.DefaultDialOpts())
+		called++
+		return expectState, nil
+	}
+
+	// Give NewAPIFromStore a store interface that can report when the
+	// config was written to, to check if the cache is updated.
+	mockStore := &storageWithWriteNotify{store: store}
+	st, err := juju.NewAPIFromStore("noconfig", mockStore, apiOpen)
+	c.Assert(err, gc.IsNil)
+	c.Assert(st, gc.Equals, expectState)
+	c.Assert(called, gc.Equals, 1)
+	c.Assert(mockStore.written, jc.IsTrue)
+	info, err := store.ReadInfo("noconfig")
+	c.Assert(err, gc.IsNil)
+	c.Assert(info.APIEndpoint().Addresses, gc.DeepEquals, []string{"0.1.2.3:1234"})
+	c.Check(info.APIEndpoint().EnvironUUID, gc.Equals, "fake-uuid")
+}
+
+func (s *NewAPIClientSuite) TestWithInfoNoAPIHostports(c *gc.C) {
+	// The local cache doesn't have an EnvironTag, which the API does
+	// return. However, the API doesn't have apiHostPorts, we don't want to
+	// override the local cache with bad endpoints.
+	store := newConfigStore("noconfig", &environInfo{
+		creds: configstore.APICredentials{
+			User:     "foo",
+			Password: "foopass",
+		},
+		endpoint: configstore.APIEndpoint{
+			Addresses: []string{"foo.invalid"},
+			CACert:    "certificated",
+		},
+	})
+
+	called := 0
+	expectState := &mockAPIState{
+		apiHostPorts: [][]instance.HostPort{},
+		environTag:   "environment-fake-uuid",
+	}
+	apiOpen := func(apiInfo *api.Info, opts api.DialOpts) (juju.APIState, error) {
+		c.Check(apiInfo.Tag, gc.Equals, "user-foo")
+		c.Check(string(apiInfo.CACert), gc.Equals, "certificated")
+		c.Check(apiInfo.Password, gc.Equals, "foopass")
+		c.Check(apiInfo.EnvironTag, gc.Equals, "")
+		c.Check(opts, gc.DeepEquals, api.DefaultDialOpts())
+		called++
+		return expectState, nil
+	}
+
+	mockStore := &storageWithWriteNotify{store: store}
+	st, err := juju.NewAPIFromStore("noconfig", mockStore, apiOpen)
+	c.Assert(err, gc.IsNil)
+	c.Assert(st, gc.Equals, expectState)
+	c.Assert(called, gc.Equals, 1)
+	c.Assert(mockStore.written, jc.IsTrue)
+	info, err := store.ReadInfo("noconfig")
+	c.Assert(err, gc.IsNil)
+	ep := info.APIEndpoint()
+	// We should have cached the environ tag, but not disturbed the
+	// Addresses
+	c.Check(ep.Addresses, gc.HasLen, 1)
+	c.Check(ep.Addresses[0], gc.Matches, `foo\.invalid`)
+	c.Check(ep.EnvironUUID, gc.Equals, "fake-uuid")
+}
+
+func (s *NewAPIClientSuite) TestNoEnvironTagDoesntOverwriteCached(c *gc.C) {
+	store := newConfigStore("noconfig", dummyStoreInfo)
+	called := 0
+	// State returns a new set of APIHostPorts but not a new EnvironTag. We
+	// shouldn't override the cached value with environ tag of "".
+	expectState := &mockAPIState{
+		apiHostPorts: [][]instance.HostPort{
+			instance.AddressesWithPort([]instance.Address{instance.NewAddress("0.1.2.3", instance.NetworkUnknown)}, 1234),
+		},
+	}
+	apiOpen := func(apiInfo *api.Info, opts api.DialOpts) (juju.APIState, error) {
+		c.Check(apiInfo.Tag, gc.Equals, "user-foo")
+		c.Check(string(apiInfo.CACert), gc.Equals, "certificated")
+		c.Check(apiInfo.Password, gc.Equals, "foopass")
+		c.Check(apiInfo.EnvironTag, gc.Equals, "environment-fake-uuid")
+		c.Check(opts, gc.DeepEquals, api.DefaultDialOpts())
+		called++
+		return expectState, nil
+	}
+
+	mockStore := &storageWithWriteNotify{store: store}
+	st, err := juju.NewAPIFromStore("noconfig", mockStore, apiOpen)
+	c.Assert(err, gc.IsNil)
+	c.Assert(st, gc.Equals, expectState)
+	c.Assert(called, gc.Equals, 1)
+	c.Assert(mockStore.written, jc.IsTrue)
+	info, err := store.ReadInfo("noconfig")
+	c.Assert(err, gc.IsNil)
+	ep := info.APIEndpoint()
+	c.Assert(ep.Addresses, gc.DeepEquals, []string{"0.1.2.3:1234"})
+	c.Check(ep.EnvironUUID, gc.Equals, "fake-uuid")
+}
+
 func (s *NewAPIClientSuite) TestWithInfoAPIOpenError(c *gc.C) {
 	store := newConfigStore("noconfig", &environInfo{
 		endpoint: configstore.APIEndpoint{
@@ -584,8 +715,9 @@
 		Password: "foopass",
 	},
 	endpoint: configstore.APIEndpoint{
-		Addresses: []string{"foo.invalid"},
-		CACert:    "certificated",
+		Addresses:   []string{"foo.invalid"},
+		CACert:      "certificated",
+		EnvironUUID: "fake-uuid",
 	},
 }
 
@@ -631,12 +763,15 @@
 		apiHostPorts: [][]instance.HostPort{
 			instance.AddressesWithPort([]instance.Address{instance.NewAddress("0.1.2.3", instance.NetworkUnknown)}, 1234),
 		},
+		environTag: "environment-fake-uuid",
 	}
 	apiOpen := func(apiInfo *api.Info, opts api.DialOpts) (juju.APIState, error) {
 		c.Check(apiInfo.Tag, gc.Equals, "user-admin")
 		c.Check(string(apiInfo.CACert), gc.Equals, coretesting.CACert)
 		c.Check(apiInfo.Password, gc.Equals, coretesting.DefaultMongoPassword)
 		c.Check(opts, gc.DeepEquals, api.DefaultDialOpts())
+		// we didn't know about it when connecting
+		c.Check(apiInfo.EnvironTag, gc.Equals, "")
 		called++
 		return expectState, nil
 	}
@@ -644,6 +779,7 @@
 	c.Assert(err, gc.IsNil)
 	c.Assert(called, gc.Equals, 1)
 	c.Check(endpoint.Addresses, gc.DeepEquals, []string{"0.1.2.3:1234"})
+	c.Check(endpoint.EnvironUUID, gc.Equals, "fake-uuid")
 }
 
 func (s *APIEndpointForEnvSuite) TestAPIEndpointRefresh(c *gc.C) {

=== modified file 'juju/mock_test.go'
--- juju/mock_test.go	2014-03-31 12:24:52 +0000
+++ juju/mock_test.go	2014-05-27 09:53:17 +0000
@@ -10,6 +10,7 @@
 	close func(juju.APIState) error
 
 	apiHostPorts [][]instance.HostPort
+	environTag   string
 }
 
 func (s *mockAPIState) Close() error {
@@ -23,6 +24,10 @@
 	return s.apiHostPorts
 }
 
+func (s *mockAPIState) EnvironTag() string {
+	return s.environTag
+}
+
 func panicAPIOpen(apiInfo *api.Info, opts api.DialOpts) (juju.APIState, error) {
 	panic("api.Open called unexpectedly")
 }

=== modified file 'state/api/apiclient.go'
--- state/api/apiclient.go	2014-04-30 23:18:40 +0000
+++ state/api/apiclient.go	2014-05-27 09:53:17 +0000
@@ -35,6 +35,9 @@
 	// addr is the address used to connect to the API server.
 	addr string
 
+	// environTag holds the environment tag once we're connected
+	environTag string
+
 	// hostPorts is the API server addresses returned from Login,
 	// which the client may cache and use for failover.
 	hostPorts [][]instance.HostPort
@@ -80,6 +83,10 @@
 	// Nonce holds the nonce used when provisioning the machine. Used
 	// only by the machine agent.
 	Nonce string `yaml:",omitempty"`
+
+	// Environ holds the environ tag for the environment we are trying to
+	// connect to.
+	EnvironTag string
 }
 
 // DialOpts holds configuration parameters that control the
@@ -155,7 +162,7 @@
 		certPool:   pool,
 	}
 	if info.Tag != "" || info.Password != "" {
-		if err := st.Login(info.Tag, info.Password, info.Nonce); err != nil {
+		if err := st.Login(info.Tag, info.Password, info.Nonce, info.EnvironTag); err != nil {
 			conn.Close()
 			return nil, err
 		}
@@ -261,6 +268,12 @@
 	return s.addr
 }
 
+// EnvironTag returns the Environment Tag describing the environment we are
+// connected to.
+func (s *State) EnvironTag() string {
+	return s.environTag
+}
+
 // APIHostPorts returns addresses that may be used to connect
 // to the API server, including the address used to connect.
 //

=== modified file 'state/api/apiclient_test.go'
--- state/api/apiclient_test.go	2014-04-02 09:43:39 +0000
+++ state/api/apiclient_test.go	2014-05-27 09:53:17 +0000
@@ -11,6 +11,7 @@
 
 	jujutesting "launchpad.net/juju-core/juju/testing"
 	"launchpad.net/juju-core/state/api"
+	"launchpad.net/juju-core/state/api/params"
 	"launchpad.net/juju-core/utils/parallel"
 )
 
@@ -79,6 +80,27 @@
 	c.Assert(err, gc.ErrorMatches, `timed out connecting to "wss://.*/"`)
 }
 
+func (s *apiclientSuite) TestOpenPassesEnvironTag(c *gc.C) {
+	info := s.APIInfo(c)
+	environTag := info.EnvironTag
+	env, err := s.State.Environment()
+	c.Assert(err, gc.IsNil)
+	c.ExpectFailure("JujuConnSuite.APIInfo() uses APIConn which doesn't know about EnvironTag")
+	c.Check(environTag, gc.Equals, env.Tag())
+	c.Assert(environTag, gc.Not(gc.Equals), "")
+	// We start by ensuring we have an invalid tag, and Open should fail.
+	info.EnvironTag = "environ-bad-tag"
+	_, err = api.Open(info, api.DialOpts{})
+	c.Check(err, gc.ErrorMatches, "invalid environment requested")
+	c.Check(params.ErrCode(err), gc.Equals, params.CodeUnauthorized)
+	c.Assert(err, gc.IsNil)
+	// Now set it to the right tag, and we should succeed.
+	info.EnvironTag = env.Tag()
+	st, err := api.Open(info, api.DialOpts{})
+	c.Assert(err, gc.IsNil)
+	st.Close()
+}
+
 func (s *apiclientSuite) TestDialWebsocketStopped(c *gc.C) {
 	stopped := make(chan struct{})
 	f := api.NewWebsocketDialer(nil, api.DialOpts{})

=== modified file 'state/api/params/params.go'
--- state/api/params/params.go	2014-05-27 08:30:44 +0000
+++ state/api/params/params.go	2014-05-27 09:53:17 +0000
@@ -293,9 +293,10 @@
 
 // Creds holds credentials for identifying an entity.
 type Creds struct {
-	AuthTag  string
-	Password string
-	Nonce    string
+	AuthTag    string
+	Password   string
+	Nonce      string
+	EnvironTag string `json:",omitempty"`
 }
 
 // GetAnnotationsResults holds annotations associated with an entity.
@@ -719,7 +720,8 @@
 
 // LoginResult holds the result of a Login call.
 type LoginResult struct {
-	Servers [][]instance.HostPort
+	Servers    [][]instance.HostPort
+	EnvironTag string
 }
 
 // EnsureAvailability contains arguments for

=== modified file 'state/api/state.go'
--- state/api/state.go	2014-04-16 12:55:56 +0000
+++ state/api/state.go	2014-05-27 09:53:17 +0000
@@ -27,12 +27,13 @@
 // Subsequent requests on the state will act as that entity.  This
 // method is usually called automatically by Open. The machine nonce
 // should be empty unless logging in as a machine agent.
-func (st *State) Login(tag, password, nonce string) error {
+func (st *State) Login(tag, password, nonce, environTag string) error {
 	var result params.LoginResult
 	err := st.Call("Admin", "", "Login", &params.Creds{
-		AuthTag:  tag,
-		Password: password,
-		Nonce:    nonce,
+		AuthTag:    tag,
+		Password:   password,
+		Nonce:      nonce,
+		EnvironTag: environTag,
 	}, &result)
 	if err == nil {
 		st.authTag = tag
@@ -42,6 +43,7 @@
 			return err
 		}
 		st.hostPorts = hostPorts
+		st.environTag = result.EnvironTag
 	}
 	return err
 }

=== modified file 'state/api/state_test.go'
--- state/api/state_test.go	2014-05-20 04:27:02 +0000
+++ state/api/state_test.go	2014-05-27 09:53:17 +0000
@@ -11,6 +11,7 @@
 	"launchpad.net/juju-core/instance"
 	jujutesting "launchpad.net/juju-core/juju/testing"
 	"launchpad.net/juju-core/state/api"
+	"launchpad.net/juju-core/state/api/params"
 	coretesting "launchpad.net/juju-core/testing"
 )
 
@@ -54,10 +55,56 @@
 	s.State.SetAPIHostPorts([][]instance.HostPort{badServer})
 	apistate, err := api.Open(info, api.DialOpts{})
 	c.Assert(err, gc.IsNil)
+	defer apistate.Close()
 	hostports := apistate.APIHostPorts()
 	c.Check(hostports, gc.DeepEquals, [][]instance.HostPort{serverhostports, badServer})
 }
 
+func (s *stateSuite) TestLoginSetsEnvironTag(c *gc.C) {
+	env, err := s.State.Environment()
+	c.Assert(err, gc.IsNil)
+	info := s.APIInfo(c)
+	tag := info.Tag
+	password := info.Password
+	info.Tag = ""
+	info.Password = ""
+	apistate, err := api.Open(info, api.DialOpts{})
+	c.Assert(err, gc.IsNil)
+	defer apistate.Close()
+	// We haven't called Login yet, so the EnvironTag shouldn't be set.
+	c.Check(apistate.EnvironTag(), gc.Equals, "")
+	err = apistate.Login(tag, password, "", "")
+	c.Assert(err, gc.IsNil)
+	// Now that we've logged in, EnvironTag should be updated correctly.
+	c.Check(apistate.EnvironTag(), gc.Equals, env.Tag())
+}
+
+func (s *stateSuite) TestLoginPassesEnvironTag(c *gc.C) {
+	env, err := s.State.Environment()
+	c.Assert(err, gc.IsNil)
+	info := s.APIInfo(c)
+	tag := info.Tag
+	password := info.Password
+	info.Tag = ""
+	info.Password = ""
+	apistate, err := api.Open(info, api.DialOpts{})
+	c.Assert(err, gc.IsNil)
+	defer apistate.Close()
+	// Not set yet.
+	c.Check(apistate.EnvironTag(), gc.Equals, "")
+	// We intentionally pass in an invalid environ tag, and notice that
+	// Login is refused. We then pass in the right tag, to make sure we
+	// have the right information
+	err = apistate.Login(tag, password, "", "environment-not-uuid")
+	c.Check(err, gc.ErrorMatches, "invalid environment requested")
+	c.Check(params.ErrCode(err), gc.Equals, params.CodeUnauthorized)
+	c.Check(apistate.EnvironTag(), gc.Equals, "")
+	err = apistate.Login(tag, password, "", env.Tag())
+	c.Assert(err, gc.IsNil)
+	// Now that we've logged in, EnvironTag should be updated correctly.
+	c.Check(apistate.EnvironTag(), gc.Equals, env.Tag())
+}
+
 func (s *stateSuite) TestAPIHostPortsMovesConnectedValueFirst(c *gc.C) {
 	hostportslist := s.APIState.APIHostPorts()
 	c.Check(hostportslist, gc.HasLen, 1)
@@ -91,6 +138,7 @@
 	s.State.SetAPIHostPorts(current)
 	apistate, err := api.Open(info, api.DialOpts{})
 	c.Assert(err, gc.IsNil)
+	defer apistate.Close()
 	hostports := apistate.APIHostPorts()
 	// We should have rotate the server we connected to as the first item,
 	// and the address of that server as the first address

=== modified file 'state/apiserver/admin.go'
--- state/apiserver/admin.go	2014-05-20 08:02:01 +0000
+++ state/apiserver/admin.go	2014-05-27 09:53:17 +0000
@@ -105,8 +105,16 @@
 	}
 	logger.Debugf("hostPorts: %v", hostPorts)
 
+	environ, err := a.root.srv.state.Environment()
+	if err != nil {
+		return params.LoginResult{}, err
+	}
+
 	a.root.rpcConn.Serve(newRoot, serverError)
-	return params.LoginResult{hostPorts}, nil
+	return params.LoginResult{
+		Servers:    hostPorts,
+		EnvironTag: environ.Tag(),
+	}, nil
 }
 
 var doCheckCreds = checkCreds
@@ -127,6 +135,18 @@
 	if err != nil || !entity.PasswordValid(c.Password) {
 		return nil, common.ErrBadCreds
 	}
+	if c.EnvironTag != "" {
+		env, err := st.Environment()
+		if err != nil {
+			// TODO: There is no test for this case, how do we even
+			// trigger an error for the Environment() call?
+			logger.Warningf("got error asking for state.Environment(): %v", err)
+			return nil, err
+		}
+		if env.Tag() != c.EnvironTag {
+			return nil, common.ErrInvalidEnviron
+		}
+	}
 	// Check if a machine agent is logging in with the right Nonce
 	if err := checkForValidMachineAgent(entity, c); err != nil {
 		return nil, err

=== modified file 'state/apiserver/common/errors.go'
--- state/apiserver/common/errors.go	2014-05-13 04:30:48 +0000
+++ state/apiserver/common/errors.go	2014-05-27 09:53:17 +0000
@@ -47,6 +47,7 @@
 var (
 	ErrBadId          = stderrors.New("id not found")
 	ErrBadCreds       = stderrors.New("invalid entity name or password")
+	ErrInvalidEnviron = stderrors.New("invalid environment requested")
 	ErrPerm           = stderrors.New("permission denied")
 	ErrNotLoggedIn    = stderrors.New("not logged in")
 	ErrUnknownWatcher = stderrors.New("unknown watcher id")
@@ -63,6 +64,7 @@
 	state.ErrUnitHasSubordinates: params.CodeUnitHasSubordinates,
 	ErrBadId:                     params.CodeNotFound,
 	ErrBadCreds:                  params.CodeUnauthorized,
+	ErrInvalidEnviron:            params.CodeUnauthorized,
 	ErrPerm:                      params.CodeUnauthorized,
 	ErrNotLoggedIn:               params.CodeUnauthorized,
 	ErrUnknownWatcher:            params.CodeNotFound,

=== modified file 'state/apiserver/login_test.go'
--- state/apiserver/login_test.go	2014-04-17 13:14:49 +0000
+++ state/apiserver/login_test.go	2014-05-27 09:53:17 +0000
@@ -33,6 +33,7 @@
 	tag      string
 	password string
 	err      string
+	envtag   string
 	code     string
 }{{
 	tag:      "user-admin",
@@ -48,6 +49,12 @@
 	tag:      "bar",
 	password: "password",
 	err:      `"bar" is not a valid tag`,
+}, {
+	tag:      "user-admin",
+	password: "dummy-secret",
+	envtag:   "environment-bad-uuid",
+	err:      "invalid environment requested",
+	code:     params.CodeUnauthorized,
 }}
 
 func (s *loginSuite) setupServer(c *gc.C) (*api.Info, func()) {
@@ -59,11 +66,14 @@
 		"", "",
 	)
 	c.Assert(err, gc.IsNil)
+	env, err := s.State.Environment()
+	c.Assert(err, gc.IsNil)
 	info := &api.Info{
-		Tag:      "",
-		Password: "",
-		Addrs:    []string{srv.Addr()},
-		CACert:   coretesting.CACert,
+		Tag:        "",
+		Password:   "",
+		EnvironTag: env.Tag(),
+		Addrs:      []string{srv.Addr()},
+		CACert:     coretesting.CACert,
 	}
 	return info, func() {
 		err := srv.Stop()
@@ -111,7 +121,7 @@
 			c.Assert(err, gc.ErrorMatches, `unknown object type "Machiner"`)
 
 			// Since these are user login tests, the nonce is empty.
-			err = st.Login(t.tag, t.password, "")
+			err = st.Login(t.tag, t.password, "", t.envtag)
 			c.Assert(err, gc.ErrorMatches, t.err)
 			c.Assert(params.ErrCode(err), gc.Equals, t.code)
 
@@ -139,7 +149,7 @@
 	c.Assert(err, gc.ErrorMatches, `unknown object type "Client"`)
 
 	// Since these are user login tests, the nonce is empty.
-	err = st.Login("user-inactive", "password", "")
+	err = st.Login("user-inactive", "password", "", info.EnvironTag)
 	c.Assert(err, gc.ErrorMatches, "invalid entity name or password")
 
 	_, err = st.Client().Status([]string{})
@@ -177,12 +187,12 @@
 
 	c.Assert(tw.Log, jc.LogMatches, []string{
 		`<- \[[0-9A-F]+\] <unknown> {"RequestId":1,"Type":"Admin","Request":"Login","Params":` +
-			`{"AuthTag":"machine-0","Password":"[^"]*","Nonce":"fake_nonce"}` +
+			`{"AuthTag":"machine-0","Password":"[^"]*","Nonce":"fake_nonce","EnvironTag":"environ[^"]*"}` +
 			`}`,
 		// Now that we are logged in, we see the entity's tag
 		// [0-9.umns] is to handle timestamps that are ns, us, ms, or s
 		// long, though we expect it to be in the 'ms' range.
-		`-> \[[0-9A-F]+\] machine-0 [0-9.]+[umn]?s {"RequestId":1,"Response":{"Servers":\[\]}} Admin\[""\].Login`,
+		`-> \[[0-9A-F]+\] machine-0 [0-9.]+[umn]?s {"RequestId":1,"Response":.*} Admin\[""\].Login`,
 		`<- \[[0-9A-F]+\] machine-0 {"RequestId":2,"Type":"Machiner","Request":"Life","Params":{"Entities":\[{"Tag":"machine-0"}\]}}`,
 		`-> \[[0-9A-F]+\] machine-0 [0-9.umns]+ {"RequestId":2,"Response":{"Results":\[{"Life":"alive","Error":null}\]}} Machiner\[""\]\.Life`,
 	})
@@ -461,3 +471,67 @@
 		c.Check(err, gc.IsNil)
 	}
 }
+
+func (s *loginSuite) TestLoginReportsEnvironTag(c *gc.C) {
+	info, cleanup := s.setupServer(c)
+	defer cleanup()
+	// If we call api.Open without giving a username and password, then it
+	// won't call Login, so we can call it ourselves.
+	// We Login without passing an EnvironTag, to show that it still lets
+	// us in, and that we can find out the real EnvironTag from the
+	// response.
+	st, err := api.Open(info, fastDialOpts)
+	c.Assert(err, gc.IsNil)
+	var result params.LoginResult
+	creds := &params.Creds{
+		AuthTag:    "user-admin",
+		Password:   "dummy-secret",
+		EnvironTag: "",
+	}
+	err = st.Call("Admin", "", "Login", creds, &result)
+	c.Assert(err, gc.IsNil)
+	env, err := s.State.Environment()
+	c.Assert(err, gc.IsNil)
+	c.Assert(result.EnvironTag, gc.Equals, env.Tag())
+}
+
+func (s *loginSuite) TestLoginAcceptsEnvironTag(c *gc.C) {
+	info, cleanup := s.setupServer(c)
+	defer cleanup()
+	// We open the API without logging in, and then do a direct login
+	// passing in the EnvironTag. The server should let us in, and we
+	// should be able to check from the response that we are, indeed, in
+	// the right environment.
+	st, err := api.Open(info, fastDialOpts)
+	c.Assert(err, gc.IsNil)
+	env, err := s.State.Environment()
+	c.Assert(err, gc.IsNil)
+	var result params.LoginResult
+	creds := &params.Creds{
+		AuthTag:    "user-admin",
+		Password:   "dummy-secret",
+		EnvironTag: env.Tag(),
+	}
+	err = st.Call("Admin", "", "Login", creds, &result)
+	c.Assert(err, gc.IsNil)
+	c.Assert(result.EnvironTag, gc.Equals, env.Tag())
+}
+
+func (s *loginSuite) TestLoginRefusesBadEnvironTag(c *gc.C) {
+	info, cleanup := s.setupServer(c)
+	defer cleanup()
+	// This time, we pass in an environment tag that doesn't actually match
+	// the environment. The login should be rejected with an appropriate
+	// error response.
+	st, err := api.Open(info, fastDialOpts)
+	c.Assert(err, gc.IsNil)
+	var result params.LoginResult
+	creds := &params.Creds{
+		AuthTag:    "user-admin",
+		Password:   "dummy-secret",
+		EnvironTag: "environment-not-my-uuid",
+	}
+	err = st.Call("Admin", "", "Login", creds, &result)
+	c.Assert(err, gc.ErrorMatches, "invalid environment requested")
+	c.Assert(params.ErrCode(err), gc.Equals, params.CodeUnauthorized)
+}