Merge lp:~vishvananda/nova/keystone-migration into lp:~hudson-openstack/nova/trunk

[Vish Ishaya]

Round 1 of changes for keystone integration.
 * Modified request context to allow it to hold all of the relevant data from the auth component.
 * Pulled out access to AuthManager from as many places as possible
 * Massive cleanup of unit tests
 * Made the openstack api fakes use fake Authentication by default

There are now only a few places that are using auth manager:
 * Authentication middleware for ec2 api (will move to stand-alone middleware)
 * Authentication middleware for os api (will be deprecated in favor of keystone)
 * Accounts and Users apis for os (will be switched to keystone or deprecated)
 * Ec2 admin api for users and projects (will be removed)
 * Nova-manage user and project commands (will be deprecated and removed with AuthManager)
 * Tests that test the above sections (will be converted or removed with their relevant section)
 * Tests for auth manager
 * Pipelib (authman can be removed once ec2 stand-alone middleware is in place)
 * xen_api (for getting images from old objectstore. I think this can be removed)

Vish

[Devin Carlen (devcamcar)]

I have a question about keystone and openstack in terms of semantics. Is there any value in making the terms across keystone/nova/swift consistent? Keystone has tenants, Nova has projects, and Swift has accounts. Gets a bit confusing.

I understand why the following change was made, though it seems like the key pair bits need a new place to live. Doesn't seem ideal to call the DB directly here:

205 - key_pairs = auth_manager.AuthManager.get_key_pairs(context)
206 + key_pairs = db.key_pair_get_all_by_user(context.elevated(),
207 + context.user_id)

I don't think you meant to leave this in:

305 + LOG.info(locals())

review: Needs Fixing

[Vish Ishaya (vishvananda)]

> I have a question about keystone and openstack in terms of semantics. Is
> there any value in making the terms across keystone/nova/swift consistent?
> Keystone has tenants, Nova has projects, and Swift has accounts. Gets a bit
> confusing.

If you look at the linked blueprint you will see that renaming projects to tenants is one of the later steps. I agree that naming should be consistent, but I'm trying to keep it a series of smaller patches.

>
> I understand why the following change was made, though it seems like the key
> pair bits need a new place to live. Doesn't seem ideal to call the DB directly
> here:
>
>
> 205 - key_pairs = auth_manager.AuthManager.get_key_pairs(context)
> 206 + key_pairs = db.key_pair_get_all_by_user(context.elevated(),
> 207 + context.user_id)
>

Agreeed. Key pairs don't really fit into any of the current apis we have defined. Neither do the private keys and cas used by the ec2 api and cloudpipe. We could probably move all of that into a crypto api, but that seems outside the scope of this change set. I added a todo in the code for now.

>
>
> I don't think you meant to leave this in:
>
> 305 + LOG.info(locals())

Thanks, fixed.

[lp:~vishvananda/nova/keystone-migration]

1313. By Vish Ishaya on 2011-07-25

fix for reviews

[Devin Carlen (devcamcar)]

lgtm

review: Approve

[lp:~vishvananda/nova/keystone-migration]

1314. By Vish Ishaya on 2011-07-28

merged trunk

1315. By Vish Ishaya on 2011-07-28

fix tests broken in the merge

1316. By Vish Ishaya on 2011-07-28

remove authman from images/s3.py and replace with flags

[Jason Kölker (jason-koelker)]

356 + if self.is_admin is None:
357 + if 'admin' in self.roles:
358 + self.is_admin = True
359 else:
360 self.is_admin = False

Could this be something like:

if not self.is_admin:
    self.is_admin = 'admin' in self.roles

That way if is_admin is passed in as False but the roles specify admin you get an admin context. Or is there a situation were and admin role should not force an admin context?

3465 + # TODO(vish): this shouldn't be used anywhere anymore and
3466 + # can probably be removed
3467 + from nova.auth.manager import AuthManager
3468 + manager = AuthManager()
3469 + access = manager.get_access_key(user_id, project_id)
3470 + secret = manager.get_user(user_id).secret

Could this just not use the s3_* flags as well?

[Vish Ishaya (vishvananda)]

> if not self.is_admin:
> self.is_admin = 'admin' in self.roles
>
> That way if is_admin is passed in as False but the roles specify admin you get
> an admin context. Or is there a situation were and admin role should not force
> an admin context?

I was thinking that the direct passing of is_admin should override what is set in roles

>
>
> 3465 + # TODO(vish): this shouldn't be used anywhere anymore and
> 3466 + # can probably be removed
> 3467 + from nova.auth.manager import AuthManager
> 3468 + manager = AuthManager()
> 3469 + access = manager.get_access_key(user_id, project_id)
> 3470 + secret = manager.get_user(user_id).secret
>
> Could this just not use the s3_* flags as well?

Anyone who is using this code would be using the old nova-objectstore which actually did check secret and access key per user. This should really be removed but I want to make sure from the xen guys that they aren't using for something i don't know about.

[Vish Ishaya (vishvananda)]

> Could this be something like:
>
> if not self.is_admin:
> self.is_admin = 'admin' in self.roles

I did switch it to your simpler logic however.

[lp:~vishvananda/nova/keystone-migration]

1317. By Vish Ishaya on 2011-07-28

simplify if statement

[Jason Kölker (jason-koelker)]

> > 3465 + # TODO(vish): this shouldn't be used anywhere anymore
> and
> > 3466 + # can probably be removed
> > 3467 + from nova.auth.manager import AuthManager
> > 3468 + manager = AuthManager()
> > 3469 + access = manager.get_access_key(user_id, project_id)
> > 3470 + secret = manager.get_user(user_id).secret
> >
> > Could this just not use the s3_* flags as well?
>
> Anyone who is using this code would be using the old nova-objectstore which
> actually did check secret and access key per user. This should really be
> removed but I want to make sure from the xen guys that they aren't using for
> something i don't know about.

Cools, I tracked it back through the xen plugin, and couldn't see an issue, but I think you're right to leave it as is for now, I'm far from an expert on how that all works.

review: Approve

[Kevin L. Mitchell (klmitch)]

While comparing our respective branches, I ran across another LOG.info() you probably didn't mean to leave in, in nova/compute/api.py on line 692...

[lp:~vishvananda/nova/keystone-migration]

1318. By Vish Ishaya on 2011-07-29

remove extra log statement

[Brian Lamar (blamar)]

There are a number of tests failing when merging with the current trunk, but they can be fixed by:

=== modified file 'nova/api/openstack/views/servers.py'
--- nova/api/openstack/views/servers.py 2011-07-28 21:59:25 +0000
+++ nova/api/openstack/views/servers.py 2011-07-29 16:04:20 +0000
@@ -231,4 +231,4 @@
         :param date_time: the datetime object to convert

         """
- return date_time.strftime(utils.TIME_FORMAT)
+ return date_time.strftime(utils.ISO_TIME_FORMAT)

After all tests pass, everything looks good to me. I've tested this functionally and all current tests pass.

review: Needs Fixing

[Vish Ishaya (vishvananda)]

Ok fixed by changing the call to use utils.isotime() which did the same thing.

On Jul 29, 2011, at 9:07 AM, Brian Lamar wrote:

> Review: Needs Fixing
> There are a number of tests failing when merging with the current trunk, but they can be fixed by:
>
> === modified file 'nova/api/openstack/views/servers.py'
> --- nova/api/openstack/views/servers.py 2011-07-28 21:59:25 +0000
> +++ nova/api/openstack/views/servers.py 2011-07-29 16:04:20 +0000
> @@ -231,4 +231,4 @@
> :param date_time: the datetime object to convert
>
> """
> - return date_time.strftime(utils.TIME_FORMAT)
> + return date_time.strftime(utils.ISO_TIME_FORMAT)
>
> After all tests pass, everything looks good to me. I've tested this functionally and all current tests pass.
> --
> https://code.launchpad.net/~vishvananda/nova/keystone-migration/+merge/68915
> You are the owner of lp:~vishvananda/nova/keystone-migration.

[lp:~vishvananda/nova/keystone-migration]

1319. By Vish Ishaya on 2011-07-29

merged trunk and fix time call

[Brian Lamar (blamar)]

Albeit with some delay, but I think we can get this pushed in now. Thanks Vish!

review: Approve

[OpenStack Infra (hudson-openstack)]

Attempt to merge into lp:nova failed due to conflicts:

text conflict in nova/tests/test_db_api.py

[Vish Ishaya (vishvananda)]

wow, code is moving fast. Remerged trunk. Trying again

[lp:~vishvananda/nova/keystone-migration]

1320. By Vish Ishaya on 2011-07-29

merged trunk

=== modified file 'nova/api/direct.py'
--- nova/api/direct.py	2011-06-07 19:17:34 +0000
+++ nova/api/direct.py	2011-07-29 19:38:29 +0000
@@ -107,7 +107,8 @@
     def process_request(self, request):
         os_user = request.headers['X-OpenStack-User']
         os_project = request.headers['X-OpenStack-Project']
-        context_ref = context.RequestContext(user=os_user, project=os_project)
+        context_ref = context.RequestContext(user_id=os_user,
+                                             project_id=os_project)
         request.environ['openstack.context'] = context_ref
 
 

=== modified file 'nova/api/ec2/__init__.py'
--- nova/api/ec2/__init__.py	2011-06-27 11:20:42 +0000
+++ nova/api/ec2/__init__.py	2011-07-29 19:38:29 +0000
@@ -66,7 +66,7 @@
         else:
             controller = None
             action = None
-        ctxt = request.environ.get('ec2.context', None)
+        ctxt = request.environ.get('nova.context', None)
         delta = utils.utcnow() - start
         seconds = delta.seconds
         microseconds = delta.microseconds
@@ -139,8 +139,7 @@
 
 
 class Authenticate(wsgi.Middleware):
-
-    """Authenticate an EC2 request and add 'ec2.context' to WSGI environ."""
+    """Authenticate an EC2 request and add 'nova.context' to WSGI environ."""
 
     @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
@@ -157,8 +156,9 @@
         auth_params.pop('Signature')
 
         # Authenticate the request.
+        authman = manager.AuthManager()
         try:
-            (user, project) = manager.AuthManager().authenticate(
+            (user, project) = authman.authenticate(
                     access,
                     signature,
                     auth_params,
@@ -174,14 +174,17 @@
         remote_address = req.remote_addr
         if FLAGS.use_forwarded_for:
             remote_address = req.headers.get('X-Forwarded-For', remote_address)
-        ctxt = context.RequestContext(user=user,
-                                      project=project,
+        roles = authman.get_active_roles(user, project)
+        ctxt = context.RequestContext(user_id=user.id,
+                                      project_id=project.id,
+                                      is_admin=user.is_admin(),
+                                      roles=roles,
                                       remote_address=remote_address)
-        req.environ['ec2.context'] = ctxt
+        req.environ['nova.context'] = ctxt
         uname = user.name
         pname = project.name
         msg = _('Authenticated Request For %(uname)s:%(pname)s)') % locals()
-        LOG.audit(msg, context=req.environ['ec2.context'])
+        LOG.audit(msg, context=req.environ['nova.context'])
         return self.application
 
 
@@ -228,7 +231,7 @@
     """Authorize an EC2 API request.
 
     Return a 401 if ec2.controller and ec2.action in WSGI environ may not be
-    executed in ec2.context.
+    executed in nova.context.
     """
 
     def __init__(self, application):
@@ -282,7 +285,7 @@
 
     @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
-        context = req.environ['ec2.context']
+        context = req.environ['nova.context']
         controller = req.environ['ec2.request'].controller.__class__.__name__
         action = req.environ['ec2.request'].action
         allowed_roles = self.action_roles[controller].get(action, ['none'])
@@ -295,28 +298,27 @@
 
     def _matches_any_role(self, context, roles):
         """Return True if any role in roles is allowed in context."""
-        if context.user.is_superuser():
+        if context.is_admin:
             return True
         if 'all' in roles:
             return True
         if 'none' in roles:
             return False
-        return any(context.project.has_role(context.user_id, role)
-                   for role in roles)
+        return any(role in context.roles for role in roles)
 
 
 class Executor(wsgi.Application):
 
     """Execute an EC2 API request.
 
-    Executes 'ec2.action' upon 'ec2.controller', passing 'ec2.context' and
+    Executes 'ec2.action' upon 'ec2.controller', passing 'nova.context' and
     'ec2.action_args' (all variables in WSGI environ.)  Returns an XML
     response, or a 400 upon failure.
     """
 
     @webob.dec.wsgify(RequestClass=wsgi.Request)
     def __call__(self, req):
-        context = req.environ['ec2.context']
+        context = req.environ['nova.context']
         api_request = req.environ['ec2.request']
         result = None
         try:

=== modified file 'nova/api/openstack/auth.py'
--- nova/api/openstack/auth.py	2011-07-01 20:33:00 +0000
+++ nova/api/openstack/auth.py	2011-07-29 19:38:29 +0000
@@ -48,31 +48,35 @@
     def __call__(self, req):
         if not self.has_authentication(req):
             return self.authenticate(req)
-        user = self.get_user_by_authentication(req)
-        if not user:
+        user_id = self.get_user_by_authentication(req)
+        if not user_id:
             token = req.headers["X-Auth-Token"]
-            msg = _("%(user)s could not be found with token '%(token)s'")
+            msg = _("%(user_id)s could not be found with token '%(token)s'")
             LOG.warn(msg % locals())
             return faults.Fault(webob.exc.HTTPUnauthorized())
 
         try:
-            account = req.headers["X-Auth-Project-Id"]
+            project_id = req.headers["X-Auth-Project-Id"]
         except KeyError:
             # FIXME(usrleon): It needed only for compatibility
             # while osapi clients don't use this header
-            accounts = self.auth.get_projects(user=user)
-            if accounts:
-                account = accounts[0]
+            projects = self.auth.get_projects(user_id)
+            if projects:
+                project_id = projects[0].id
             else:
                 return faults.Fault(webob.exc.HTTPUnauthorized())
 
-        if not self.auth.is_admin(user) and \
-           not self.auth.is_project_member(user, account):
-            msg = _("%(user)s must be an admin or a member of %(account)s")
+        is_admin = self.auth.is_admin(user_id)
+        req.environ['nova.context'] = context.RequestContext(user_id,
+                                                             project_id,
+                                                             is_admin)
+        if not is_admin and not self.auth.is_project_member(user_id,
+                                                            project_id):
+            msg = _("%(user_id)s must be an admin or a "
+                    "member of %(project_id)s")
             LOG.warn(msg % locals())
             return faults.Fault(webob.exc.HTTPUnauthorized())
 
-        req.environ['nova.context'] = context.RequestContext(user, account)
         return self.application
 
     def has_authentication(self, req):
@@ -133,7 +137,7 @@
             if delta.days >= 2:
                 self.db.auth_token_destroy(ctxt, token['token_hash'])
             else:
-                return self.auth.get_user(token['user_id'])
+                return token['user_id']
         return None
 
     def _authorize_user(self, username, key, req):

=== modified file 'nova/api/openstack/create_instance_helper.py'
--- nova/api/openstack/create_instance_helper.py	2011-07-26 17:47:37 +0000
+++ nova/api/openstack/create_instance_helper.py	2011-07-29 19:38:29 +0000
@@ -20,6 +20,7 @@
 from webob import exc
 from xml.dom import minidom
 
+from nova import db
 from nova import exception
 from nova import flags
 from nova import log as logging
@@ -29,7 +30,6 @@
 
 from nova.compute import instance_types
 from nova.api.openstack import wsgi
-from nova.auth import manager as auth_manager
 
 
 LOG = logging.getLogger('nova.api.openstack.create_instance_helper')
@@ -80,7 +80,10 @@
 
         key_name = None
         key_data = None
-        key_pairs = auth_manager.AuthManager.get_key_pairs(context)
+        # TODO(vish): Key pair access should move into a common library
+        #             instead of being accessed directly from the db.
+        key_pairs = db.key_pair_get_all_by_user(context.elevated(),
+                                                context.user_id)
         if key_pairs:
             key_pair = key_pairs[0]
             key_name = key_pair['name']

=== modified file 'nova/api/openstack/views/servers.py'
--- nova/api/openstack/views/servers.py	2011-07-28 21:59:25 +0000
+++ nova/api/openstack/views/servers.py	2011-07-29 19:38:29 +0000
@@ -150,10 +150,8 @@
 
     def _build_detail(self, inst):
         response = super(ViewBuilderV11, self)._build_detail(inst)
-        response['server']['created'] = \
-            self._convert_timeformat(inst['created_at'])
-        response['server']['updated'] =  \
-            self._convert_timeformat(inst['updated_at'])
+        response['server']['created'] = utils.isotime(inst['created_at'])
+        response['server']['updated'] = utils.isotime(inst['updated_at'])
         if 'status' in response['server']:
             if response['server']['status'] == "ACTIVE":
                 response['server']['progress'] = 100
@@ -224,11 +222,3 @@
         """Create an url that refers to a specific flavor id."""
         return os.path.join(common.remove_version_from_href(self.base_url),
             "servers", str(server_id))
-
-    def _convert_timeformat(self, date_time):
-        """Converts the given time into the common time format
-
-        :param date_time: the datetime object to convert
-
-        """
-        return date_time.strftime(utils.TIME_FORMAT)

=== modified file 'nova/auth/manager.py'
--- nova/auth/manager.py	2011-06-03 18:34:54 +0000
+++ nova/auth/manager.py	2011-07-29 19:38:29 +0000
@@ -518,6 +518,14 @@
             return drv.get_user_roles(User.safe_id(user),
                                       Project.safe_id(project))
 
+    def get_active_roles(self, user, project=None):
+        """Get all active roles for context"""
+        if project:
+            roles = FLAGS.allowed_roles + ['projectmanager']
+        else:
+            roles = FLAGS.global_roles
+        return [role for role in roles if self.has_role(user, role, project)]
+
     def get_project(self, pid):
         """Get project object by id"""
         with self.driver() as drv:
@@ -730,10 +738,6 @@
         with self.driver() as drv:
             drv.modify_user(uid, access_key, secret_key, admin)
 
-    @staticmethod
-    def get_key_pairs(context):
-        return db.key_pair_get_all_by_user(context.elevated(), context.user_id)
-
     def get_credentials(self, user, project=None, use_dmz=True):
         """Get credential zip for user in project"""
         if not isinstance(user, User):
@@ -785,7 +789,7 @@
         return read_buffer
 
     def get_environment_rc(self, user, project=None, use_dmz=True):
-        """Get credential zip for user in project"""
+        """Get environment rc for user in project"""
         if not isinstance(user, User):
             user = self.get_user(user)
         if project is None:

=== modified file 'nova/cloudpipe/pipelib.py'
--- nova/cloudpipe/pipelib.py	2011-04-19 16:32:33 +0000
+++ nova/cloudpipe/pipelib.py	2011-07-29 19:38:29 +0000
@@ -96,8 +96,8 @@
     def launch_vpn_instance(self, project_id):
         LOG.debug(_("Launching VPN for %s") % (project_id))
         project = self.manager.get_project(project_id)
-        ctxt = context.RequestContext(user=project.project_manager,
-                                      project=project)
+        ctxt = context.RequestContext(user=project.project_manager_id,
+                                      project=project.id)
         key_name = self.setup_key_pair(ctxt)
         group_name = self.setup_security_group(ctxt)
 
@@ -112,11 +112,11 @@
             security_group=[group_name])
 
     def setup_security_group(self, context):
-        group_name = '%s%s' % (context.project.id, FLAGS.vpn_key_suffix)
-        if db.security_group_exists(context, context.project.id, group_name):
+        group_name = '%s%s' % (context.project_id, FLAGS.vpn_key_suffix)
+        if db.security_group_exists(context, context.project_id, group_name):
             return group_name
-        group = {'user_id': context.user.id,
-                 'project_id': context.project.id,
+        group = {'user_id': context.user_id,
+                 'project_id': context.project_id,
                  'name': group_name,
                  'description': 'Group for vpn'}
         group_ref = db.security_group_create(context, group)
@@ -137,12 +137,12 @@
         return group_name
 
     def setup_key_pair(self, context):
-        key_name = '%s%s' % (context.project.id, FLAGS.vpn_key_suffix)
+        key_name = '%s%s' % (context.project_id, FLAGS.vpn_key_suffix)
         try:
-            result = cloud._gen_key(context, context.user.id, key_name)
+            result = cloud._gen_key(context, context.user_id, key_name)
             private_key = result['private_key']
             try:
-                key_dir = os.path.join(FLAGS.keys_path, context.user.id)
+                key_dir = os.path.join(FLAGS.keys_path, context.user_id)
                 if not os.path.exists(key_dir):
                     os.makedirs(key_dir)
                 key_path = os.path.join(key_dir, '%s.pem' % key_name)

=== modified file 'nova/compute/api.py'
--- nova/compute/api.py	2011-07-26 17:13:41 +0000
+++ nova/compute/api.py	2011-07-29 19:38:29 +0000
@@ -689,7 +689,7 @@
                     raise
                 instances = None
         elif project_id or not context.is_admin:
-            if not context.project:
+            if not context.project_id:
                 instances = self.db.instance_get_all_by_user(
                     context, context.user_id)
             else:

=== modified file 'nova/context.py'
--- nova/context.py	2011-06-02 21:23:05 +0000
+++ nova/context.py	2011-07-29 19:38:29 +0000
@@ -18,9 +18,8 @@
 
 """RequestContext: context for requests that persist through all of nova."""
 
-import random
+import uuid
 
-from nova import exception
 from nova import utils
 
 
@@ -31,86 +30,51 @@
 
     """
 
-    def __init__(self, user, project, is_admin=None, read_deleted=False,
-                 remote_address=None, timestamp=None, request_id=None):
-        if hasattr(user, 'id'):
-            self._user = user
-            self.user_id = user.id
-        else:
-            self._user = None
-            self.user_id = user
-        if hasattr(project, 'id'):
-            self._project = project
-            self.project_id = project.id
-        else:
-            self._project = None
-            self.project_id = project
-        if is_admin is None:
-            if self.user_id and self.user:
-                self.is_admin = self.user.is_admin()
-            else:
-                self.is_admin = False
-        else:
-            self.is_admin = is_admin
+    def __init__(self, user_id, project_id, is_admin=None, read_deleted=False,
+                 roles=None, remote_address=None, timestamp=None,
+                 request_id=None):
+        self.user_id = user_id
+        self.project_id = project_id
+        self.roles = roles or []
+        self.is_admin = is_admin
+        if self.is_admin is None:
+            self.admin = 'admin' in self.roles
         self.read_deleted = read_deleted
         self.remote_address = remote_address
         if not timestamp:
             timestamp = utils.utcnow()
-        if isinstance(timestamp, str) or isinstance(timestamp, unicode):
-            timestamp = utils.parse_isotime(timestamp)
+        if isinstance(timestamp, basestring):
+            timestamp = utils.parse_strtime(timestamp)
         self.timestamp = timestamp
         if not request_id:
-            chars = 'ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-'
-            request_id = ''.join([random.choice(chars) for x in xrange(20)])
+            request_id = unicode(uuid.uuid4())
         self.request_id = request_id
 
-    @property
-    def user(self):
-        # NOTE(vish): Delay import of manager, so that we can import this
-        #             file from manager.
-        from nova.auth import manager
-        if not self._user:
-            try:
-                self._user = manager.AuthManager().get_user(self.user_id)
-            except exception.NotFound:
-                pass
-        return self._user
-
-    @property
-    def project(self):
-        # NOTE(vish): Delay import of manager, so that we can import this
-        #             file from manager.
-        from nova.auth import manager
-        if not self._project:
-            try:
-                auth_manager = manager.AuthManager()
-                self._project = auth_manager.get_project(self.project_id)
-            except exception.NotFound:
-                pass
-        return self._project
-
     def to_dict(self):
-        return {'user': self.user_id,
-                'project': self.project_id,
+        return {'user_id': self.user_id,
+                'project_id': self.project_id,
                 'is_admin': self.is_admin,
                 'read_deleted': self.read_deleted,
+                'roles': self.roles,
                 'remote_address': self.remote_address,
-                'timestamp': utils.isotime(self.timestamp),
+                'timestamp': utils.strtime(self.timestamp),
                 'request_id': self.request_id}
 
     @classmethod
     def from_dict(cls, values):
         return cls(**values)
 
-    def elevated(self, read_deleted=False):
+    def elevated(self, read_deleted=None):
         """Return a version of this context with admin flag set."""
-        return RequestContext(self.user_id,
-                              self.project_id,
-                              True,
-                              read_deleted,
-                              self.remote_address,
-                              self.timestamp,
-                              self.request_id)
+        rd = self.read_deleted if read_deleted is None else read_deleted
+        return RequestContext(user_id=self.user_id,
+                              project_id=self.project_id,
+                              is_admin=True,
+                              read_deleted=rd,
+                              roles=self.roles,
+                              remote_address=self.remote_address,
+                              timestamp=self.timestamp,
+                              request_id=self.request_id)
 
 
 def get_admin_context(read_deleted=False):

=== modified file 'nova/db/sqlalchemy/api.py'
--- nova/db/sqlalchemy/api.py	2011-07-26 17:03:55 +0000
+++ nova/db/sqlalchemy/api.py	2011-07-29 19:38:29 +0000
@@ -62,7 +62,7 @@
 def authorize_project_context(context, project_id):
     """Ensures a request has permission to access the given project."""
     if is_user_context(context):
-        if not context.project:
+        if not context.project_id:
             raise exception.NotAuthorized()
         elif context.project_id != project_id:
             raise exception.NotAuthorized()
@@ -71,7 +71,7 @@
 def authorize_user_context(context, user_id):
     """Ensures a request has permission to access the given user."""
     if is_user_context(context):
-        if not context.user:
+        if not context.user_id:
             raise exception.NotAuthorized()
         elif context.user_id != user_id:
             raise exception.NotAuthorized()

=== modified file 'nova/db/sqlalchemy/models.py'
--- nova/db/sqlalchemy/models.py	2011-07-22 21:47:37 +0000
+++ nova/db/sqlalchemy/models.py	2011-07-29 19:38:29 +0000
@@ -177,14 +177,6 @@
     user_id = Column(String(255))
     project_id = Column(String(255))
 
-    @property
-    def user(self):
-        return auth.manager.AuthManager().get_user(self.user_id)
-
-    @property
-    def project(self):
-        return auth.manager.AuthManager().get_project(self.project_id)
-
     image_ref = Column(String(255))
     kernel_id = Column(String(255))
     ramdisk_id = Column(String(255))
@@ -465,14 +457,6 @@
         'Instance.deleted == False)',
                              backref='security_groups')
 
-    @property
-    def user(self):
-        return auth.manager.AuthManager().get_user(self.user_id)
-
-    @property
-    def project(self):
-        return auth.manager.AuthManager().get_project(self.project_id)
-
 
 class SecurityGroupIngressRule(BASE, NovaBase):
     """Represents a rule in a security group."""

=== modified file 'nova/image/s3.py'
--- nova/image/s3.py	2011-07-20 17:45:55 +0000
+++ nova/image/s3.py	2011-07-29 19:38:29 +0000
@@ -34,7 +34,6 @@
 from nova import image
 from nova import log as logging
 from nova import utils
-from nova.auth import manager
 from nova.image import service
 from nova.api.ec2 import ec2utils
 
@@ -43,6 +42,10 @@
 FLAGS = flags.FLAGS
 flags.DEFINE_string('image_decryption_dir', '/tmp',
                     'parent dir for tempdir used for image decryption')
+flags.DEFINE_string('s3_access_key', 'notchecked',
+                    'access key to use for s3 server for images')
+flags.DEFINE_string('s3_secret_key', 'notchecked',
+                    'secret key to use for s3 server for images')
 
 
 class S3ImageService(service.BaseImageService):
@@ -82,11 +85,10 @@
 
     @staticmethod
     def _conn(context):
-        # TODO(vish): is there a better way to get creds to sign
-        #             for the user?
-        access = manager.AuthManager().get_access_key(context.user,
-                                                      context.project)
-        secret = str(context.user.secret)
+        # NOTE(vish): access and secret keys for s3 server are not
+        #             checked in nova-objectstore
+        access = FLAGS.s3_access_key
+        secret = FLAGS.s3_secret_key
         calling = boto.s3.connection.OrdinaryCallingFormat()
         return boto.s3.connection.S3Connection(aws_access_key_id=access,
                                                aws_secret_access_key=secret,

=== modified file 'nova/log.py'
--- nova/log.py	2011-07-27 18:00:37 +0000
+++ nova/log.py	2011-07-29 19:38:29 +0000
@@ -43,8 +43,8 @@
 FLAGS = flags.FLAGS
 flags.DEFINE_string('logging_context_format_string',
                     '%(asctime)s %(levelname)s %(name)s '
-                    '[%(request_id)s %(user)s '
-                    '%(project)s] %(message)s',
+                    '[%(request_id)s %(user_id)s '
+                    '%(project_id)s] %(message)s',
                     'format string to use for log messages with context')
 flags.DEFINE_string('logging_default_format_string',
                     '%(asctime)s %(levelname)s %(name)s [-] '

=== modified file 'nova/tests/api/openstack/contrib/test_floating_ips.py'
--- nova/tests/api/openstack/contrib/test_floating_ips.py	2011-07-06 20:28:10 +0000
+++ nova/tests/api/openstack/contrib/test_floating_ips.py	2011-07-29 19:38:29 +0000
@@ -74,12 +74,8 @@
     def setUp(self):
         super(FloatingIpTest, self).setUp()
         self.controller = FloatingIPController()
-        self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.reset_fake_data()
-        fakes.FakeAuthDatabase.data = {}
         fakes.stub_out_networking(self.stubs)
         fakes.stub_out_rate_limiting(self.stubs)
-        fakes.stub_out_auth(self.stubs)
         self.stubs.Set(network.api.API, "get_floating_ip",
                        network_api_get_floating_ip)
         self.stubs.Set(network.api.API, "list_floating_ips",
@@ -96,7 +92,6 @@
         self._create_floating_ip()
 
     def tearDown(self):
-        self.stubs.UnsetAll()
         self._delete_floating_ip()
         super(FloatingIpTest, self).tearDown()
 

=== modified file 'nova/tests/api/openstack/contrib/test_multinic_xs.py'
--- nova/tests/api/openstack/contrib/test_multinic_xs.py	2011-07-12 01:40:45 +0000
+++ nova/tests/api/openstack/contrib/test_multinic_xs.py	2011-07-29 19:38:29 +0000
@@ -42,22 +42,14 @@
 class FixedIpTest(test.TestCase):
     def setUp(self):
         super(FixedIpTest, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.reset_fake_data()
-        fakes.FakeAuthDatabase.data = {}
         fakes.stub_out_networking(self.stubs)
         fakes.stub_out_rate_limiting(self.stubs)
-        fakes.stub_out_auth(self.stubs)
         self.stubs.Set(compute.api.API, "add_fixed_ip",
                        compute_api_add_fixed_ip)
         self.stubs.Set(compute.api.API, "remove_fixed_ip",
                        compute_api_remove_fixed_ip)
         self.context = context.get_admin_context()
 
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        super(FixedIpTest, self).tearDown()
-
     def test_add_fixed_ip(self):
         global last_add_fixed_ip
         last_add_fixed_ip = (None, None)

=== modified file 'nova/tests/api/openstack/fakes.py'
--- nova/tests/api/openstack/fakes.py	2011-06-28 22:05:41 +0000
+++ nova/tests/api/openstack/fakes.py	2011-07-29 19:38:29 +0000
@@ -29,6 +29,7 @@
 from nova import context
 from nova import exception as exc
 from nova import utils
+from nova import wsgi
 import nova.api.openstack.auth
 from nova.api import openstack
 from nova.api.openstack import auth
@@ -40,14 +41,13 @@
 from nova.image import glance
 from nova.image import service
 from nova.tests import fake_flags
-from nova.wsgi import Router
 
 
 class Context(object):
     pass
 
 
-class FakeRouter(Router):
+class FakeRouter(wsgi.Router):
     def __init__(self):
         pass
 
@@ -68,21 +68,30 @@
 
 @webob.dec.wsgify
 def fake_wsgi(self, req):
-    req.environ['nova.context'] = context.RequestContext(1, 1)
     return self.application
 
 
-def wsgi_app(inner_app10=None, inner_app11=None):
+def wsgi_app(inner_app10=None, inner_app11=None, fake_auth=True):
     if not inner_app10:
         inner_app10 = openstack.APIRouterV10()
     if not inner_app11:
         inner_app11 = openstack.APIRouterV11()
+
+    if fake_auth:
+        ctxt = context.RequestContext('fake', 'fake')
+        api10 = openstack.FaultWrapper(wsgi.InjectContext(ctxt,
+              limits.RateLimitingMiddleware(inner_app10)))
+        api11 = openstack.FaultWrapper(wsgi.InjectContext(ctxt,
+              limits.RateLimitingMiddleware(
+                  extensions.ExtensionMiddleware(inner_app11))))
+    else:
+        api10 = openstack.FaultWrapper(auth.AuthMiddleware(
+              limits.RateLimitingMiddleware(inner_app10)))
+        api11 = openstack.FaultWrapper(auth.AuthMiddleware(
+              limits.RateLimitingMiddleware(
+                  extensions.ExtensionMiddleware(inner_app11))))
+        Auth = auth
     mapper = urlmap.URLMap()
-    api10 = openstack.FaultWrapper(auth.AuthMiddleware(
-              limits.RateLimitingMiddleware(inner_app10)))
-    api11 = openstack.FaultWrapper(auth.AuthMiddleware(
-              limits.RateLimitingMiddleware(
-                  extensions.ExtensionMiddleware(inner_app11))))
     mapper['/v1.0'] = api10
     mapper['/v1.1'] = api11
     mapper['/'] = openstack.FaultWrapper(versions.Versions())
@@ -359,17 +368,18 @@
             if admin is not None:
                 user.admin = admin
 
-    def is_admin(self, user):
+    def is_admin(self, user_id):
+        user = self.get_user(user_id)
         return user.admin
 
-    def is_project_member(self, user, project):
+    def is_project_member(self, user_id, project):
         if not isinstance(project, Project):
             try:
                 project = self.get_project(project)
             except exc.NotFound:
                 raise webob.exc.HTTPUnauthorized()
-        return ((user.id in project.member_ids) or
-                (user.id == project.project_manager_id))
+        return ((user_id in project.member_ids) or
+                (user_id == project.project_manager_id))
 
     def create_project(self, name, manager_user, description=None,
                        member_users=None):
@@ -396,13 +406,13 @@
         else:
             raise exc.NotFound
 
-    def get_projects(self, user=None):
-        if not user:
+    def get_projects(self, user_id=None):
+        if not user_id:
             return FakeAuthManager.projects.values()
         else:
             return [p for p in FakeAuthManager.projects.values()
-                    if (user.id in p.member_ids) or
-                       (user.id == p.project_manager_id)]
+                    if (user_id in p.member_ids) or
+                       (user_id == p.project_manager_id)]
 
 
 class FakeRateLimiter(object):

=== modified file 'nova/tests/api/openstack/test_accounts.py'
--- nova/tests/api/openstack/test_accounts.py	2011-03-16 19:15:57 +0000
+++ nova/tests/api/openstack/test_accounts.py	2011-07-29 19:38:29 +0000
@@ -16,7 +16,6 @@
 
 import json
 
-import stubout
 import webob
 
 from nova import flags
@@ -41,7 +40,7 @@
 class AccountsTest(test.TestCase):
     def setUp(self):
         super(AccountsTest, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
+        self.flags(allow_admin_api=True)
         self.stubs.Set(accounts.Controller, '__init__',
                        fake_init)
         self.stubs.Set(accounts.Controller, '_check_admin',
@@ -52,8 +51,6 @@
         fakes.stub_out_rate_limiting(self.stubs)
         fakes.stub_out_auth(self.stubs)
 
-        self.allow_admin = FLAGS.allow_admin_api
-        FLAGS.allow_admin_api = True
         fakemgr = fakes.FakeAuthManager()
         joeuser = User('id1', 'guy1', 'acc1', 'secret1', False)
         superuser = User('id2', 'guy2', 'acc2', 'secret2', True)
@@ -62,11 +59,6 @@
         fakemgr.create_project('test1', joeuser)
         fakemgr.create_project('test2', superuser)
 
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        FLAGS.allow_admin_api = self.allow_admin
-        super(AccountsTest, self).tearDown()
-
     def test_get_account(self):
         req = webob.Request.blank('/v1.0/accounts/test1')
         res = req.get_response(fakes.wsgi_app())

=== modified file 'nova/tests/api/openstack/test_adminapi.py'
--- nova/tests/api/openstack/test_adminapi.py	2011-03-15 20:49:19 +0000
+++ nova/tests/api/openstack/test_adminapi.py	2011-07-29 19:38:29 +0000
@@ -16,14 +16,10 @@
 #    under the License.
 
 
-import stubout
 import webob
-from paste import urlmap
 
 from nova import flags
 from nova import test
-from nova.api import openstack
-from nova.api.openstack import auth
 from nova.tests.api.openstack import fakes
 
 FLAGS = flags.FLAGS
@@ -33,21 +29,12 @@
 
     def setUp(self):
         super(AdminAPITest, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.reset_fake_data()
-        fakes.FakeAuthDatabase.data = {}
         fakes.stub_out_networking(self.stubs)
         fakes.stub_out_rate_limiting(self.stubs)
-        fakes.stub_out_auth(self.stubs)
         self.allow_admin = FLAGS.allow_admin_api
 
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        FLAGS.allow_admin_api = self.allow_admin
-        super(AdminAPITest, self).tearDown()
-
     def test_admin_enabled(self):
-        FLAGS.allow_admin_api = True
+        self.flags(allow_admin_api=True)
         # We should still be able to access public operations.
         req = webob.Request.blank('/v1.0/flavors')
         res = req.get_response(fakes.wsgi_app())
@@ -55,7 +42,7 @@
         # TODO: Confirm admin operations are available.
 
     def test_admin_disabled(self):
-        FLAGS.allow_admin_api = False
+        self.flags(allow_admin_api=False)
         # We should still be able to access public operations.
         req = webob.Request.blank('/v1.0/flavors')
         res = req.get_response(fakes.wsgi_app())

=== modified file 'nova/tests/api/openstack/test_auth.py'
--- nova/tests/api/openstack/test_auth.py	2011-06-08 17:58:59 +0000
+++ nova/tests/api/openstack/test_auth.py	2011-07-29 19:38:29 +0000
@@ -17,14 +17,12 @@
 
 import datetime
 
-import stubout
 import webob
 import webob.dec
 
 import nova.api
 import nova.api.openstack.auth
 import nova.auth.manager
-from nova import auth
 from nova import context
 from nova import db
 from nova import test
@@ -35,7 +33,6 @@
 
     def setUp(self):
         super(Test, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
         self.stubs.Set(nova.api.openstack.auth.AuthMiddleware,
             '__init__', fakes.fake_auth_init)
         self.stubs.Set(context, 'RequestContext', fakes.FakeRequestContext)
@@ -45,7 +42,6 @@
         fakes.stub_out_networking(self.stubs)
 
     def tearDown(self):
-        self.stubs.UnsetAll()
         fakes.fake_data_store = {}
         super(Test, self).tearDown()
 
@@ -57,7 +53,7 @@
         req = webob.Request.blank('/v1.0/')
         req.headers['X-Auth-User'] = 'user1'
         req.headers['X-Auth-Key'] = 'user1_key'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '204 No Content')
         self.assertEqual(len(result.headers['X-Auth-Token']), 40)
         self.assertEqual(result.headers['X-CDN-Management-Url'],
@@ -73,7 +69,7 @@
         req = webob.Request.blank('/v1.0/', {'HTTP_HOST': 'foo'})
         req.headers['X-Auth-User'] = 'user1'
         req.headers['X-Auth-Key'] = 'user1_key'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '204 No Content')
         self.assertEqual(len(result.headers['X-Auth-Token']), 40)
         self.assertEqual(result.headers['X-Server-Management-Url'],
@@ -86,7 +82,7 @@
         self.stubs.Set(nova.api.openstack, 'APIRouterV10', fakes.FakeRouter)
         req = webob.Request.blank('/v1.0/fake')
         req.headers['X-Auth-Token'] = token
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '200 OK')
         self.assertEqual(result.headers['X-Test-Success'], 'True')
 
@@ -110,7 +106,7 @@
 
         req = webob.Request.blank('/v1.0/')
         req.headers['X-Auth-Token'] = 'token_hash'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '401 Unauthorized')
         self.assertEqual(self.destroy_called, True)
 
@@ -124,7 +120,7 @@
         req = webob.Request.blank('/v1.0/', {'HTTP_HOST': 'foo'})
         req.headers['X-Auth-User'] = 'user1'
         req.headers['X-Auth-Key'] = 'user1_key'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '204 No Content')
 
         token = result.headers['X-Auth-Token']
@@ -132,7 +128,7 @@
         req = webob.Request.blank('/v1.0/fake')
         req.headers['X-Auth-Token'] = token
         req.headers['X-Auth-Project-Id'] = 'user2_project'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '200 OK')
         self.assertEqual(result.headers['X-Test-Success'], 'True')
 
@@ -140,7 +136,7 @@
         req = webob.Request.blank('/v1.0/')
         req.headers['X-Auth-User'] = 'unknown_user'
         req.headers['X-Auth-Key'] = 'unknown_user_key'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '401 Unauthorized')
 
     def test_bad_user_good_key(self):
@@ -151,18 +147,18 @@
         req = webob.Request.blank('/v1.0/')
         req.headers['X-Auth-User'] = 'unknown_user'
         req.headers['X-Auth-Key'] = 'user1_key'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '401 Unauthorized')
 
     def test_no_user(self):
         req = webob.Request.blank('/v1.0/')
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '401 Unauthorized')
 
     def test_bad_token(self):
         req = webob.Request.blank('/v1.0/')
         req.headers['X-Auth-Token'] = 'unknown_token'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '401 Unauthorized')
 
     def test_bad_project(self):
@@ -177,7 +173,7 @@
         req = webob.Request.blank('/v1.0/', {'HTTP_HOST': 'foo'})
         req.headers['X-Auth-User'] = 'user1'
         req.headers['X-Auth-Key'] = 'user1_key'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '204 No Content')
 
         token = result.headers['X-Auth-Token']
@@ -185,7 +181,7 @@
         req = webob.Request.blank('/v1.0/fake')
         req.headers['X-Auth-Token'] = token
         req.headers['X-Auth-Project-Id'] = 'user2_project'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '401 Unauthorized')
 
     def test_not_existing_project(self):
@@ -197,7 +193,7 @@
         req = webob.Request.blank('/v1.0/', {'HTTP_HOST': 'foo'})
         req.headers['X-Auth-User'] = 'user1'
         req.headers['X-Auth-Key'] = 'user1_key'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '204 No Content')
 
         token = result.headers['X-Auth-Token']
@@ -205,7 +201,7 @@
         req = webob.Request.blank('/v1.0/fake')
         req.headers['X-Auth-Token'] = token
         req.headers['X-Auth-Project-Id'] = 'unknown_project'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '401 Unauthorized')
 
 
@@ -226,20 +222,19 @@
 
         req = webob.Request.blank('/v1.0/')
         req.headers['X-Auth-Token'] = 'test_token_hash'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '401 Unauthorized')
 
     def test_token_doesnotexist(self):
         req = webob.Request.blank('/v1.0/')
         req.headers['X-Auth-Token'] = 'nonexistant_token_hash'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '401 Unauthorized')
 
 
 class TestLimiter(test.TestCase):
     def setUp(self):
         super(TestLimiter, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
         self.stubs.Set(nova.api.openstack.auth.AuthMiddleware,
             '__init__', fakes.fake_auth_init)
         self.stubs.Set(context, 'RequestContext', fakes.FakeRequestContext)
@@ -248,7 +243,6 @@
         fakes.stub_out_networking(self.stubs)
 
     def tearDown(self):
-        self.stubs.UnsetAll()
         fakes.fake_data_store = {}
         super(TestLimiter, self).tearDown()
 
@@ -261,7 +255,7 @@
         req = webob.Request.blank('/v1.0/')
         req.headers['X-Auth-User'] = 'user1'
         req.headers['X-Auth-Key'] = 'user1_key'
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(len(result.headers['X-Auth-Token']), 40)
 
         token = result.headers['X-Auth-Token']
@@ -269,6 +263,6 @@
         req = webob.Request.blank('/v1.0/fake')
         req.method = 'POST'
         req.headers['X-Auth-Token'] = token
-        result = req.get_response(fakes.wsgi_app())
+        result = req.get_response(fakes.wsgi_app(fake_auth=False))
         self.assertEqual(result.status, '200 OK')
         self.assertEqual(result.headers['X-Test-Success'], 'True')

=== modified file 'nova/tests/api/openstack/test_extensions.py'
--- nova/tests/api/openstack/test_extensions.py	2011-07-28 16:01:38 +0000
+++ nova/tests/api/openstack/test_extensions.py	2011-07-29 19:38:29 +0000
@@ -17,13 +17,12 @@
 
 import json
 import os.path
-import stubout
-import unittest
 import webob
 from xml.etree import ElementTree
 
 from nova import context
 from nova import flags
+from nova import test
 from nova.api import openstack
 from nova.api.openstack import extensions
 from nova.api.openstack import flavors
@@ -80,11 +79,12 @@
         return request_extensions
 
 
-class ExtensionControllerTest(unittest.TestCase):
+class ExtensionControllerTest(test.TestCase):
 
     def setUp(self):
-        FLAGS.osapi_extensions_path = os.path.join(
-            os.path.dirname(__file__), "extensions")
+        super(ExtensionControllerTest, self).setUp()
+        ext_path = os.path.join(os.path.dirname(__file__), "extensions")
+        self.flags(osapi_extensions_path=ext_path)
 
     def test_list_extensions_json(self):
         app = openstack.APIRouterV11()
@@ -176,7 +176,12 @@
             'The Fox In Socks Extension')
 
 
-class ResourceExtensionTest(unittest.TestCase):
+class ResourceExtensionTest(test.TestCase):
+
+    def setUp(self):
+        super(ResourceExtensionTest, self).setUp()
+        ext_path = os.path.join(os.path.dirname(__file__), "extensions")
+        self.flags(osapi_extensions_path=ext_path)
 
     def test_no_extension_present(self):
         manager = StubExtensionManager(None)
@@ -214,13 +219,14 @@
         return "THIRD"
 
 
-class ExtensionManagerTest(unittest.TestCase):
+class ExtensionManagerTest(test.TestCase):
 
     response_body = "Try to say this Mr. Knox, sir..."
 
     def setUp(self):
-        FLAGS.osapi_extensions_path = os.path.join(os.path.dirname(__file__),
-                                                    "extensions")
+        super(ExtensionManagerTest, self).setUp()
+        ext_path = os.path.join(os.path.dirname(__file__), "extensions")
+        self.flags(osapi_extensions_path=ext_path)
 
     def test_get_resources(self):
         app = openstack.APIRouterV11()
@@ -239,11 +245,12 @@
         self.assertTrue('THIRD' not in ext_mgr.extensions)
 
 
-class ActionExtensionTest(unittest.TestCase):
+class ActionExtensionTest(test.TestCase):
 
     def setUp(self):
-        FLAGS.osapi_extensions_path = os.path.join(os.path.dirname(__file__),
-                                                    "extensions")
+        super(ActionExtensionTest, self).setUp()
+        ext_path = os.path.join(os.path.dirname(__file__), "extensions")
+        self.flags(osapi_extensions_path=ext_path)
 
     def _send_server_action_request(self, url, body):
         app = openstack.APIRouterV11()
@@ -277,19 +284,12 @@
         self.assertEqual(404, response.status_int)
 
 
-class RequestExtensionTest(unittest.TestCase):
+class RequestExtensionTest(test.TestCase):
 
     def setUp(self):
         super(RequestExtensionTest, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.reset_fake_data()
-        fakes.FakeAuthDatabase.data = {}
-        fakes.stub_out_auth(self.stubs)
-        self.context = context.get_admin_context()
-
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        super(RequestExtensionTest, self).tearDown()
+        ext_path = os.path.join(os.path.dirname(__file__), "extensions")
+        self.flags(osapi_extensions_path=ext_path)
 
     def test_get_resources_with_stub_mgr(self):
 
@@ -327,7 +327,7 @@
         self.assertEqual("Pig Bands!", response_data['big_bands'])
 
 
-class ExtensionsXMLSerializerTest(unittest.TestCase):
+class ExtensionsXMLSerializerTest(test.TestCase):
 
     def test_serialize_extenstion(self):
         serializer = extensions.ExtensionsXMLSerializer()

=== modified file 'nova/tests/api/openstack/test_flavors.py'
--- nova/tests/api/openstack/test_flavors.py	2011-07-20 21:06:36 +0000
+++ nova/tests/api/openstack/test_flavors.py	2011-07-29 19:38:29 +0000
@@ -16,7 +16,6 @@
 #    under the License.
 
 import json
-import stubout
 import webob
 import xml.dom.minidom as minidom
 
@@ -56,12 +55,8 @@
 class FlavorsTest(test.TestCase):
     def setUp(self):
         super(FlavorsTest, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.reset_fake_data()
-        fakes.FakeAuthDatabase.data = {}
         fakes.stub_out_networking(self.stubs)
         fakes.stub_out_rate_limiting(self.stubs)
-        fakes.stub_out_auth(self.stubs)
         self.stubs.Set(nova.db.api, "instance_type_get_all",
                        return_instance_types)
         self.stubs.Set(nova.db.api, "instance_type_get_by_flavor_id",

=== renamed file 'nova/tests/api/openstack/extensions/test_flavors_extra_specs.py' => 'nova/tests/api/openstack/test_flavors_extra_specs.py'
--- nova/tests/api/openstack/extensions/test_flavors_extra_specs.py	2011-06-27 00:02:18 +0000
+++ nova/tests/api/openstack/test_flavors_extra_specs.py	2011-07-29 19:38:29 +0000
@@ -17,14 +17,13 @@
 
 import json
 import stubout
-import unittest
 import webob
 import os.path
 
 
 from nova import flags
+from nova import test
 from nova.api import openstack
-from nova.api.openstack import auth
 from nova.api.openstack import extensions
 from nova.tests.api.openstack import fakes
 import nova.wsgi
@@ -40,10 +39,6 @@
     return stub_flavor_extra_specs()
 
 
-def return_flavor_extra_specs(context, flavor_id):
-    return stub_flavor_extra_specs()
-
-
 def return_empty_flavor_extra_specs(context, flavor_id):
     return {}
 
@@ -62,30 +57,17 @@
     return specs
 
 
-class FlavorsExtraSpecsTest(unittest.TestCase):
+class FlavorsExtraSpecsTest(test.TestCase):
 
     def setUp(self):
         super(FlavorsExtraSpecsTest, self).setUp()
-        FLAGS.osapi_extensions_path = os.path.join(os.path.dirname(__file__),
-                                                    "extensions")
-        self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.auth_data = {}
-        fakes.FakeAuthDatabase.data = {}
-        fakes.stub_out_auth(self.stubs)
         fakes.stub_out_key_pair_funcs(self.stubs)
-        self.mware = auth.AuthMiddleware(
-                      extensions.ExtensionMiddleware(
-                      openstack.APIRouterV11()))
-
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        super(FlavorsExtraSpecsTest, self).tearDown()
 
     def test_index(self):
         self.stubs.Set(nova.db.api, 'instance_type_extra_specs_get',
                        return_flavor_extra_specs)
-        request = webob.Request.blank('/flavors/1/os-extra_specs')
-        res = request.get_response(self.mware)
+        request = webob.Request.blank('/v1.1/flavors/1/os-extra_specs')
+        res = request.get_response(fakes.wsgi_app())
         self.assertEqual(200, res.status_int)
         res_dict = json.loads(res.body)
         self.assertEqual('application/json', res.headers['Content-Type'])
@@ -94,8 +76,8 @@
     def test_index_no_data(self):
         self.stubs.Set(nova.db.api, 'instance_type_extra_specs_get',
                        return_empty_flavor_extra_specs)
-        req = webob.Request.blank('/flavors/1/os-extra_specs')
-        res = req.get_response(self.mware)
+        req = webob.Request.blank('/v1.1/flavors/1/os-extra_specs')
+        res = req.get_response(fakes.wsgi_app())
         res_dict = json.loads(res.body)
         self.assertEqual(200, res.status_int)
         self.assertEqual('application/json', res.headers['Content-Type'])
@@ -104,8 +86,8 @@
     def test_show(self):
         self.stubs.Set(nova.db.api, 'instance_type_extra_specs_get',
                        return_flavor_extra_specs)
-        req = webob.Request.blank('/flavors/1/os-extra_specs/key5')
-        res = req.get_response(self.mware)
+        req = webob.Request.blank('/v1.1/flavors/1/os-extra_specs/key5')
+        res = req.get_response(fakes.wsgi_app())
         self.assertEqual(200, res.status_int)
         res_dict = json.loads(res.body)
         self.assertEqual('application/json', res.headers['Content-Type'])
@@ -114,28 +96,28 @@
     def test_show_spec_not_found(self):
         self.stubs.Set(nova.db.api, 'instance_type_extra_specs_get',
                        return_empty_flavor_extra_specs)
-        req = webob.Request.blank('/flavors/1/os-extra_specs/key6')
-        res = req.get_response(self.mware)
+        req = webob.Request.blank('/v1.1/flavors/1/os-extra_specs/key6')
+        res = req.get_response(fakes.wsgi_app())
         res_dict = json.loads(res.body)
         self.assertEqual(404, res.status_int)
 
     def test_delete(self):
         self.stubs.Set(nova.db.api, 'instance_type_extra_specs_delete',
                        delete_flavor_extra_specs)
-        req = webob.Request.blank('/flavors/1/os-extra_specs/key5')
+        req = webob.Request.blank('/v1.1/flavors/1/os-extra_specs/key5')
         req.method = 'DELETE'
-        res = req.get_response(self.mware)
+        res = req.get_response(fakes.wsgi_app())
         self.assertEqual(200, res.status_int)
 
     def test_create(self):
         self.stubs.Set(nova.db.api,
                        'instance_type_extra_specs_update_or_create',
                        return_create_flavor_extra_specs)
-        req = webob.Request.blank('/flavors/1/os-extra_specs')
+        req = webob.Request.blank('/v1.1/flavors/1/os-extra_specs')
         req.method = 'POST'
         req.body = '{"extra_specs": {"key1": "value1"}}'
         req.headers["content-type"] = "application/json"
-        res = req.get_response(self.mware)
+        res = req.get_response(fakes.wsgi_app())
         res_dict = json.loads(res.body)
         self.assertEqual(200, res.status_int)
         self.assertEqual('application/json', res.headers['Content-Type'])
@@ -145,21 +127,21 @@
         self.stubs.Set(nova.db.api,
                        'instance_type_extra_specs_update_or_create',
                        return_create_flavor_extra_specs)
-        req = webob.Request.blank('/flavors/1/os-extra_specs')
+        req = webob.Request.blank('/v1.1/flavors/1/os-extra_specs')
         req.method = 'POST'
         req.headers["content-type"] = "application/json"
-        res = req.get_response(self.mware)
+        res = req.get_response(fakes.wsgi_app())
         self.assertEqual(400, res.status_int)
 
     def test_update_item(self):
         self.stubs.Set(nova.db.api,
                        'instance_type_extra_specs_update_or_create',
                        return_create_flavor_extra_specs)
-        req = webob.Request.blank('/flavors/1/os-extra_specs/key1')
+        req = webob.Request.blank('/v1.1/flavors/1/os-extra_specs/key1')
         req.method = 'PUT'
         req.body = '{"key1": "value1"}'
         req.headers["content-type"] = "application/json"
-        res = req.get_response(self.mware)
+        res = req.get_response(fakes.wsgi_app())
         self.assertEqual(200, res.status_int)
         self.assertEqual('application/json', res.headers['Content-Type'])
         res_dict = json.loads(res.body)
@@ -169,30 +151,30 @@
         self.stubs.Set(nova.db.api,
                        'instance_type_extra_specs_update_or_create',
                        return_create_flavor_extra_specs)
-        req = webob.Request.blank('/flavors/1/os-extra_specs/key1')
+        req = webob.Request.blank('/v1.1/flavors/1/os-extra_specs/key1')
         req.method = 'PUT'
         req.headers["content-type"] = "application/json"
-        res = req.get_response(self.mware)
+        res = req.get_response(fakes.wsgi_app())
         self.assertEqual(400, res.status_int)
 
     def test_update_item_too_many_keys(self):
         self.stubs.Set(nova.db.api,
                        'instance_type_extra_specs_update_or_create',
                        return_create_flavor_extra_specs)
-        req = webob.Request.blank('/flavors/1/os-extra_specs/key1')
+        req = webob.Request.blank('/v1.1/flavors/1/os-extra_specs/key1')
         req.method = 'PUT'
         req.body = '{"key1": "value1", "key2": "value2"}'
         req.headers["content-type"] = "application/json"
-        res = req.get_response(self.mware)
+        res = req.get_response(fakes.wsgi_app())
         self.assertEqual(400, res.status_int)
 
     def test_update_item_body_uri_mismatch(self):
         self.stubs.Set(nova.db.api,
                        'instance_type_extra_specs_update_or_create',
                        return_create_flavor_extra_specs)
-        req = webob.Request.blank('/flavors/1/os-extra_specs/bad')
+        req = webob.Request.blank('/v1.1/flavors/1/os-extra_specs/bad')
         req.method = 'PUT'
         req.body = '{"key1": "value1"}'
         req.headers["content-type"] = "application/json"
-        res = req.get_response(self.mware)
+        res = req.get_response(fakes.wsgi_app())
         self.assertEqual(400, res.status_int)

=== modified file 'nova/tests/api/openstack/test_image_metadata.py'
--- nova/tests/api/openstack/test_image_metadata.py	2011-07-26 13:22:41 +0000
+++ nova/tests/api/openstack/test_image_metadata.py	2011-07-29 19:38:29 +0000
@@ -16,8 +16,6 @@
 #    under the License.
 
 import json
-import stubout
-import unittest
 import webob
 
 
@@ -84,23 +82,13 @@
 
     def setUp(self):
         super(ImageMetaDataTest, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
-        self.orig_image_service = FLAGS.image_service
-        FLAGS.image_service = 'nova.image.glance.GlanceImageService'
-        fakes.FakeAuthManager.auth_data = {}
-        fakes.FakeAuthDatabase.data = {}
-        fakes.stub_out_auth(self.stubs)
+        self.flags(image_service='nova.image.glance.GlanceImageService')
         # NOTE(dprince) max out properties/metadata in image 3 for testing
         img3 = self.IMAGE_FIXTURES[2]
         for num in range(FLAGS.quota_metadata_items):
             img3['properties']['key%i' % num] = "blah"
         fakes.stub_out_glance(self.stubs, self.IMAGE_FIXTURES)
 
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        FLAGS.image_service = self.orig_image_service
-        super(ImageMetaDataTest, self).tearDown()
-
     def test_index(self):
         req = webob.Request.blank('/v1.1/images/1/metadata')
         res = req.get_response(fakes.wsgi_app())

=== modified file 'nova/tests/api/openstack/test_images.py'
--- nova/tests/api/openstack/test_images.py	2011-07-25 17:28:22 +0000
+++ nova/tests/api/openstack/test_images.py	2011-07-29 19:38:29 +0000
@@ -155,7 +155,7 @@
         fakes.stub_out_compute_api_snapshot(self.stubs)
         service_class = 'nova.image.glance.GlanceImageService'
         self.service = utils.import_object(service_class)
-        self.context = context.RequestContext(1, None)
+        self.context = context.RequestContext('fake', 'fake')
         self.service.delete_all()
         self.sent_to_glance = {}
         fakes.stub_out_glance_add_image(self.stubs, self.sent_to_glance)
@@ -168,7 +168,7 @@
         """Ensure instance_id is persisted as an image-property"""
         fixture = {'name': 'test image',
                    'is_public': False,
-                   'properties': {'instance_id': '42', 'user_id': '1'}}
+                   'properties': {'instance_id': '42', 'user_id': 'fake'}}
 
         image_id = self.service.create(self.context, fixture)['id']
         expected = fixture
@@ -178,7 +178,7 @@
         expected = {'id': image_id,
                     'name': 'test image',
                     'is_public': False,
-                    'properties': {'instance_id': '42', 'user_id': '1'}}
+                    'properties': {'instance_id': '42', 'user_id': 'fake'}}
         self.assertDictMatch(image_meta, expected)
 
         image_metas = self.service.detail(self.context)
@@ -331,11 +331,8 @@
         self.orig_image_service = FLAGS.image_service
         FLAGS.image_service = 'nova.image.glance.GlanceImageService'
         self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.reset_fake_data()
-        fakes.FakeAuthDatabase.data = {}
         fakes.stub_out_networking(self.stubs)
         fakes.stub_out_rate_limiting(self.stubs)
-        fakes.stub_out_auth(self.stubs)
         fakes.stub_out_key_pair_funcs(self.stubs)
         self.fixtures = self._make_image_fixtures()
         fakes.stub_out_glance(self.stubs, initial_fixtures=self.fixtures)
@@ -352,7 +349,7 @@
         """Determine if this fixture is applicable for given user id."""
         is_public = fixture["is_public"]
         try:
-            uid = int(fixture["properties"]["user_id"])
+            uid = fixture["properties"]["user_id"]
         except KeyError:
             uid = None
         return uid == user_id or is_public
@@ -424,7 +421,7 @@
                 },
                 "metadata": {
                     "instance_ref": "http://localhost/v1.1/servers/42",
-                    "user_id": "1",
+                    "user_id": "fake",
                 },
                 "links": [{
                     "rel": "self",
@@ -559,7 +556,7 @@
         fixtures = copy.copy(self.fixtures)
 
         for image in fixtures:
-            if not self._applicable_fixture(image, 1):
+            if not self._applicable_fixture(image, "fake"):
                 fixtures.remove(image)
                 continue
 
@@ -666,7 +663,7 @@
             'name': 'queued snapshot',
             'metadata': {
                 u'instance_ref': u'http://localhost/v1.1/servers/42',
-                u'user_id': u'1',
+                u'user_id': u'fake',
             },
             'updated': self.NOW_API_FORMAT,
             'created': self.NOW_API_FORMAT,
@@ -696,7 +693,7 @@
             'name': 'saving snapshot',
             'metadata': {
                 u'instance_ref': u'http://localhost/v1.1/servers/42',
-                u'user_id': u'1',
+                u'user_id': u'fake',
             },
             'updated': self.NOW_API_FORMAT,
             'created': self.NOW_API_FORMAT,
@@ -727,7 +724,7 @@
             'name': 'active snapshot',
             'metadata': {
                 u'instance_ref': u'http://localhost/v1.1/servers/42',
-                u'user_id': u'1',
+                u'user_id': u'fake',
             },
             'updated': self.NOW_API_FORMAT,
             'created': self.NOW_API_FORMAT,
@@ -757,7 +754,7 @@
             'name': 'killed snapshot',
             'metadata': {
                 u'instance_ref': u'http://localhost/v1.1/servers/42',
-                u'user_id': u'1',
+                u'user_id': u'fake',
             },
             'updated': self.NOW_API_FORMAT,
             'created': self.NOW_API_FORMAT,
@@ -1259,7 +1256,7 @@
 
         # Snapshot for User 1
         server_ref = 'http://localhost/v1.1/servers/42'
-        snapshot_properties = {'instance_ref': server_ref, 'user_id': '1'}
+        snapshot_properties = {'instance_ref': server_ref, 'user_id': 'fake'}
         for status in ('queued', 'saving', 'active', 'killed'):
             add_fixture(id=image_id, name='%s snapshot' % status,
                         is_public=False, status=status,
@@ -1267,7 +1264,7 @@
             image_id += 1
 
         # Snapshot for User 2
-        other_snapshot_properties = {'instance_id': '43', 'user_id': '2'}
+        other_snapshot_properties = {'instance_id': '43', 'user_id': 'other'}
         add_fixture(id=image_id, name='someone elses snapshot',
                     is_public=False, status='active',
                     properties=other_snapshot_properties)

=== modified file 'nova/tests/api/openstack/test_server_metadata.py'
--- nova/tests/api/openstack/test_server_metadata.py	2011-06-24 12:01:51 +0000
+++ nova/tests/api/openstack/test_server_metadata.py	2011-07-29 19:38:29 +0000
@@ -16,14 +16,12 @@
 #    under the License.
 
 import json
-import stubout
-import unittest
 import webob
 
 
 from nova import exception
 from nova import flags
-from nova.api import openstack
+from nova import test
 from nova.tests.api.openstack import fakes
 import nova.wsgi
 
@@ -76,21 +74,13 @@
     raise exception.InstanceNotFound()
 
 
-class ServerMetaDataTest(unittest.TestCase):
+class ServerMetaDataTest(test.TestCase):
 
     def setUp(self):
         super(ServerMetaDataTest, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.auth_data = {}
-        fakes.FakeAuthDatabase.data = {}
-        fakes.stub_out_auth(self.stubs)
         fakes.stub_out_key_pair_funcs(self.stubs)
         self.stubs.Set(nova.db.api, 'instance_get', return_server)
 
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        super(ServerMetaDataTest, self).tearDown()
-
     def test_index(self):
         self.stubs.Set(nova.db.api, 'instance_metadata_get',
                        return_server_metadata)

=== modified file 'nova/tests/api/openstack/test_servers.py'
--- nova/tests/api/openstack/test_servers.py	2011-07-29 19:24:00 +0000
+++ nova/tests/api/openstack/test_servers.py	2011-07-29 19:38:29 +0000
@@ -21,7 +21,6 @@
 import unittest
 from xml.dom import minidom
 
-import stubout
 import webob
 
 from nova import context
@@ -104,8 +103,8 @@
     return _return_server
 
 
-def return_servers(context, user_id=1):
-    return [stub_instance(i, user_id) for i in xrange(5)]
+def return_servers(context, *args, **kwargs):
+    return [stub_instance(i, 'fake', 'fake') for i in xrange(5)]
 
 
 def return_servers_by_reservation(context, reservation_id=""):
@@ -148,10 +147,10 @@
     return None
 
 
-def stub_instance(id, user_id=1, private_address=None, public_addresses=None,
-                  host=None, power_state=0, reservation_id="",
-                  uuid=FAKE_UUID, image_ref="10", flavor_id="1",
-                  interfaces=None):
+def stub_instance(id, user_id='fake', project_id='fake', private_address=None,
+                  public_addresses=None, host=None, power_state=0,
+                  reservation_id="", uuid=FAKE_UUID, image_ref="10",
+                  flavor_id="1", interfaces=None):
     metadata = []
     metadata.append(InstanceMetadata(key='seq', value=id))
 
@@ -177,7 +176,7 @@
         "updated_at": datetime.datetime(2010, 11, 11, 11, 0, 0),
         "admin_pass": "",
         "user_id": user_id,
-        "project_id": "",
+        "project_id": project_id,
         "image_ref": image_ref,
         "kernel_id": "",
         "ramdisk_id": "",
@@ -236,12 +235,8 @@
     def setUp(self):
         self.maxDiff = None
         super(ServersTest, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.reset_fake_data()
-        fakes.FakeAuthDatabase.data = {}
         fakes.stub_out_networking(self.stubs)
         fakes.stub_out_rate_limiting(self.stubs)
-        fakes.stub_out_auth(self.stubs)
         fakes.stub_out_key_pair_funcs(self.stubs)
         fakes.stub_out_image_service(self.stubs)
         self.stubs.Set(utils, 'gen_uuid', fake_gen_uuid)
@@ -249,7 +244,7 @@
         self.stubs.Set(nova.db.api, 'instance_get', return_server_by_id)
         self.stubs.Set(nova.db, 'instance_get_by_uuid',
                        return_server_by_uuid)
-        self.stubs.Set(nova.db.api, 'instance_get_all_by_user',
+        self.stubs.Set(nova.db.api, 'instance_get_all_by_project',
                        return_servers)
         self.stubs.Set(nova.db.api, 'instance_add_security_group',
                        return_security_group)
@@ -264,15 +259,9 @@
         self.stubs.Set(nova.compute.API, 'resume', fake_compute_api)
         self.stubs.Set(nova.compute.API, "get_diagnostics", fake_compute_api)
         self.stubs.Set(nova.compute.API, "get_actions", fake_compute_api)
-        self.allow_admin = FLAGS.allow_admin_api
 
         self.webreq = common.webob_factory('/v1.0/servers')
 
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        FLAGS.allow_admin_api = self.allow_admin
-        super(ServersTest, self).tearDown()
-
     def test_get_server_by_id(self):
         req = webob.Request.blank('/v1.0/servers/1')
         res = req.get_response(fakes.wsgi_app())
@@ -972,6 +961,7 @@
         res = req.get_response(fakes.wsgi_app())
         res_dict = json.loads(res.body)
 
+        self.assertEqual(len(res_dict['servers']), 5)
         i = 0
         for s in res_dict['servers']:
             self.assertEqual(s['id'], i)
@@ -1035,6 +1025,7 @@
         res = req.get_response(fakes.wsgi_app())
         res_dict = json.loads(res.body)
 
+        self.assertEqual(len(res_dict['servers']), 5)
         for i, s in enumerate(res_dict['servers']):
             self.assertEqual(s['id'], i)
             self.assertEqual(s['name'], 'server%d' % i)
@@ -1197,7 +1188,7 @@
     def test_create_instance_via_zones(self):
         """Server generated ReservationID"""
         self._setup_for_create_instance()
-        FLAGS.allow_admin_api = True
+        self.flags(allow_admin_api=True)
 
         body = dict(server=dict(
             name='server_test', imageId=3, flavorId=2,
@@ -1219,7 +1210,7 @@
     def test_create_instance_via_zones_with_resid(self):
         """User supplied ReservationID"""
         self._setup_for_create_instance()
-        FLAGS.allow_admin_api = True
+        self.flags(allow_admin_api=True)
 
         body = dict(server=dict(
             name='server_test', imageId=3, flavorId=2,
@@ -1728,10 +1719,11 @@
         instances - 2 on one host and 3 on another.
         '''
 
-        def return_servers_with_host(context, user_id=1):
-            return [stub_instance(i, 1, None, None, i % 2) for i in xrange(5)]
+        def return_servers_with_host(context, *args, **kwargs):
+            return [stub_instance(i, 'fake', 'fake', None, None, i % 2)
+                    for i in xrange(5)]
 
-        self.stubs.Set(nova.db.api, 'instance_get_all_by_user',
+        self.stubs.Set(nova.db.api, 'instance_get_all_by_project',
             return_servers_with_host)
 
         req = webob.Request.blank('/v1.0/servers/detail')
@@ -1751,7 +1743,7 @@
             self.assertEqual(s['flavorId'], 1)
 
     def test_server_pause(self):
-        FLAGS.allow_admin_api = True
+        self.flags(allow_admin_api=True)
         body = dict(server=dict(
             name='server_test', imageId=2, flavorId=2, metadata={},
             personality={}))
@@ -1763,7 +1755,7 @@
         self.assertEqual(res.status_int, 202)
 
     def test_server_unpause(self):
-        FLAGS.allow_admin_api = True
+        self.flags(allow_admin_api=True)
         body = dict(server=dict(
             name='server_test', imageId=2, flavorId=2, metadata={},
             personality={}))
@@ -1775,7 +1767,7 @@
         self.assertEqual(res.status_int, 202)
 
     def test_server_suspend(self):
-        FLAGS.allow_admin_api = True
+        self.flags(allow_admin_api=True)
         body = dict(server=dict(
             name='server_test', imageId=2, flavorId=2, metadata={},
             personality={}))
@@ -1787,7 +1779,7 @@
         self.assertEqual(res.status_int, 202)
 
     def test_server_resume(self):
-        FLAGS.allow_admin_api = True
+        self.flags(allow_admin_api=True)
         body = dict(server=dict(
             name='server_test', imageId=2, flavorId=2, metadata={},
             personality={}))
@@ -1799,7 +1791,7 @@
         self.assertEqual(res.status_int, 202)
 
     def test_server_reset_network(self):
-        FLAGS.allow_admin_api = True
+        self.flags(allow_admin_api=True)
         body = dict(server=dict(
             name='server_test', imageId=2, flavorId=2, metadata={},
             personality={}))
@@ -1811,7 +1803,7 @@
         self.assertEqual(res.status_int, 202)
 
     def test_server_inject_network_info(self):
-        FLAGS.allow_admin_api = True
+        self.flags(allow_admin_api=True)
         body = dict(server=dict(
             name='server_test', imageId=2, flavorId=2, metadata={},
             personality={}))
@@ -2102,7 +2094,7 @@
         self.assertEqual(self.server_delete_called, True)
 
     def test_rescue_accepted(self):
-        FLAGS.allow_admin_api = True
+        self.flags(allow_admin_api=True)
         body = {}
 
         self.called = False
@@ -2121,7 +2113,7 @@
         self.assertEqual(res.status_int, 202)
 
     def test_rescue_raises_handled(self):
-        FLAGS.allow_admin_api = True
+        self.flags(allow_admin_api=True)
         body = {}
 
         def rescue_mock(*args, **kwargs):
@@ -2883,18 +2875,8 @@
 
     def setUp(self):
         super(TestServerInstanceCreation, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.auth_data = {}
-        fakes.FakeAuthDatabase.data = {}
-        fakes.stub_out_auth(self.stubs)
         fakes.stub_out_image_service(self.stubs)
         fakes.stub_out_key_pair_funcs(self.stubs)
-        self.allow_admin = FLAGS.allow_admin_api
-
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        FLAGS.allow_admin_api = self.allow_admin
-        super(TestServerInstanceCreation, self).tearDown()
 
     def _setup_mock_compute_api_for_personality(self):
 

=== modified file 'nova/tests/api/openstack/test_shared_ip_groups.py'
--- nova/tests/api/openstack/test_shared_ip_groups.py	2011-03-28 18:02:53 +0000
+++ nova/tests/api/openstack/test_shared_ip_groups.py	2011-07-29 19:38:29 +0000
@@ -15,26 +15,13 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import stubout
 import webob
 
 from nova import test
-from nova.api.openstack import shared_ip_groups
 from nova.tests.api.openstack import fakes
 
 
 class SharedIpGroupsTest(test.TestCase):
-    def setUp(self):
-        super(SharedIpGroupsTest, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.reset_fake_data()
-        fakes.FakeAuthDatabase.data = {}
-        fakes.stub_out_auth(self.stubs)
-
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        super(SharedIpGroupsTest, self).tearDown()
-
     def test_get_shared_ip_groups(self):
         req = webob.Request.blank('/v1.0/shared_ip_groups')
         res = req.get_response(fakes.wsgi_app())

=== modified file 'nova/tests/api/openstack/test_users.py'
--- nova/tests/api/openstack/test_users.py	2011-03-16 19:15:57 +0000
+++ nova/tests/api/openstack/test_users.py	2011-07-29 19:38:29 +0000
@@ -15,7 +15,6 @@
 
 import json
 
-import stubout
 import webob
 
 from nova import flags
@@ -41,7 +40,7 @@
 class UsersTest(test.TestCase):
     def setUp(self):
         super(UsersTest, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
+        self.flags(allow_admin_api=True)
         self.stubs.Set(users.Controller, '__init__',
                        fake_init)
         self.stubs.Set(users.Controller, '_check_admin',
@@ -58,16 +57,10 @@
         fakes.stub_out_auth(self.stubs)
 
         self.allow_admin = FLAGS.allow_admin_api
-        FLAGS.allow_admin_api = True
         fakemgr = fakes.FakeAuthManager()
         fakemgr.add_user(User('id1', 'guy1', 'acc1', 'secret1', False))
         fakemgr.add_user(User('id2', 'guy2', 'acc2', 'secret2', True))
 
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        FLAGS.allow_admin_api = self.allow_admin
-        super(UsersTest, self).tearDown()
-
     def test_get_user_list(self):
         req = webob.Request.blank('/v1.0/users')
         res = req.get_response(fakes.wsgi_app())

=== modified file 'nova/tests/api/openstack/test_zones.py'
--- nova/tests/api/openstack/test_zones.py	2011-06-20 14:45:21 +0000
+++ nova/tests/api/openstack/test_zones.py	2011-07-29 19:38:29 +0000
@@ -95,31 +95,15 @@
 class ZonesTest(test.TestCase):
     def setUp(self):
         super(ZonesTest, self).setUp()
-        self.stubs = stubout.StubOutForTesting()
-        fakes.FakeAuthManager.reset_fake_data()
-        fakes.FakeAuthDatabase.data = {}
+        self.flags(allow_admin_api=True)
         fakes.stub_out_networking(self.stubs)
         fakes.stub_out_rate_limiting(self.stubs)
-        fakes.stub_out_auth(self.stubs)
-
-        self.allow_admin = FLAGS.allow_admin_api
-        FLAGS.allow_admin_api = True
 
         self.stubs.Set(nova.db, 'zone_get', zone_get)
         self.stubs.Set(nova.db, 'zone_update', zone_update)
         self.stubs.Set(nova.db, 'zone_create', zone_create)
         self.stubs.Set(nova.db, 'zone_delete', zone_delete)
 
-        self.old_zone_name = FLAGS.zone_name
-        self.old_zone_capabilities = FLAGS.zone_capabilities
-
-    def tearDown(self):
-        self.stubs.UnsetAll()
-        FLAGS.allow_admin_api = self.allow_admin
-        FLAGS.zone_name = self.old_zone_name
-        FLAGS.zone_capabilities = self.old_zone_capabilities
-        super(ZonesTest, self).tearDown()
-
     def test_get_zone_list_scheduler(self):
         self.stubs.Set(api, '_call_scheduler', zone_get_all_scheduler)
         req = webob.Request.blank('/v1.0/zones')
@@ -190,8 +174,8 @@
         self.assertFalse('username' in res_dict['zone'])
 
     def test_zone_info(self):
-        FLAGS.zone_name = 'darksecret'
-        FLAGS.zone_capabilities = ['cap1=a;b', 'cap2=c;d']
+        caps = ['cap1=a;b', 'cap2=c;d']
+        self.flags(zone_name='darksecret', zone_capabilities=caps)
         self.stubs.Set(api, '_call_scheduler', zone_capabilities)
 
         body = dict(zone=dict(username='zeb', password='sneaky'))
@@ -205,7 +189,8 @@
         self.assertEqual(res_dict['zone']['cap2'], 'c;d')
 
     def test_zone_select(self):
-        FLAGS.build_plan_encryption_key = 'c286696d887c9aa0611bbb3e2025a45a'
+        key = 'c286696d887c9aa0611bbb3e2025a45a'
+        self.flags(build_plan_encryption_key=key)
         self.stubs.Set(api, 'select', zone_select)
 
         req = webob.Request.blank('/v1.0/zones/select')

=== modified file 'nova/tests/hyperv_unittest.py'
--- nova/tests/hyperv_unittest.py	2011-03-18 13:56:05 +0000
+++ nova/tests/hyperv_unittest.py	2011-07-29 19:38:29 +0000
@@ -23,7 +23,6 @@
 from nova import db
 from nova import flags
 from nova import test
-from nova.auth import manager
 from nova.virt import hyperv
 
 FLAGS = flags.FLAGS
@@ -34,11 +33,9 @@
     """Test cases for the Hyper-V driver"""
     def setUp(self):
         super(HyperVTestCase, self).setUp()
-        self.manager = manager.AuthManager()
-        self.user = self.manager.create_user('fake', 'fake', 'fake',
-                                             admin=True)
-        self.project = self.manager.create_project('fake', 'fake', 'fake')
-        self.context = context.RequestContext(self.user, self.project)
+        self.user_id = 'fake'
+        self.project_id = 'fake'
+        self.context = context.RequestContext(self.user_id, self.project_id)
 
     def test_create_destroy(self):
         """Create a VM and destroy it"""

=== modified file 'nova/tests/scheduler/test_scheduler.py'
--- nova/tests/scheduler/test_scheduler.py	2011-06-30 19:20:59 +0000
+++ nova/tests/scheduler/test_scheduler.py	2011-07-29 19:38:29 +0000
@@ -23,7 +23,6 @@
 import mox
 import novaclient.exceptions
 import stubout
-import webob
 
 from mox import IgnoreArg
 from nova import context
@@ -34,12 +33,10 @@
 from nova import test
 from nova import rpc
 from nova import utils
-from nova.auth import manager as auth_manager
 from nova.scheduler import api
 from nova.scheduler import manager
 from nova.scheduler import driver
 from nova.compute import power_state
-from nova.db.sqlalchemy import models
 
 
 FLAGS = flags.FLAGS
@@ -250,23 +247,17 @@
                    volume_driver='nova.volume.driver.FakeISCSIDriver',
                    scheduler_driver='nova.scheduler.simple.SimpleScheduler')
         self.scheduler = manager.SchedulerManager()
-        self.manager = auth_manager.AuthManager()
-        self.user = self.manager.create_user('fake', 'fake', 'fake')
-        self.project = self.manager.create_project('fake', 'fake', 'fake')
         self.context = context.get_admin_context()
-
-    def tearDown(self):
-        self.manager.delete_user(self.user)
-        self.manager.delete_project(self.project)
-        super(SimpleDriverTestCase, self).tearDown()
+        self.user_id = 'fake'
+        self.project_id = 'fake'
 
     def _create_instance(self, **kwargs):
         """Create a test instance"""
         inst = {}
         inst['image_id'] = 1
         inst['reservation_id'] = 'r-fakeres'
-        inst['user_id'] = self.user.id
-        inst['project_id'] = self.project.id
+        inst['user_id'] = self.user_id
+        inst['project_id'] = self.project_id
         inst['instance_type_id'] = '1'
         inst['vcpus'] = kwargs.get('vcpus', 1)
         inst['ami_launch_index'] = 0

=== modified file 'nova/tests/test_access.py'
--- nova/tests/test_access.py	2011-01-12 19:20:05 +0000
+++ nova/tests/test_access.py	2011-07-29 19:38:29 +0000
@@ -16,7 +16,6 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-import unittest
 import webob
 
 from nova import context
@@ -41,7 +40,7 @@
 class AccessTestCase(test.TestCase):
     def _env_for(self, ctxt, action):
         env = {}
-        env['ec2.context'] = ctxt
+        env['nova.context'] = ctxt
         env['ec2.request'] = FakeApiRequest(action)
         return env
 
@@ -93,7 +92,11 @@
         super(AccessTestCase, self).tearDown()
 
     def response_status(self, user, methodName):
-        ctxt = context.RequestContext(user, self.project)
+        roles = manager.AuthManager().get_active_roles(user, self.project)
+        ctxt = context.RequestContext(user.id,
+                                      self.project.id,
+                                      is_admin=user.is_admin(),
+                                      roles=roles)
         environ = self._env_for(ctxt, methodName)
         req = webob.Request.blank('/', environ)
         resp = req.get_response(self.mw)
@@ -105,30 +108,26 @@
     def shouldDeny(self, user, methodName):
         self.assertEqual(401, self.response_status(user, methodName))
 
-    def test_001_allow_all(self):
+    def test_allow_all(self):
         users = [self.testadmin, self.testpmsys, self.testnet, self.testsys]
         for user in users:
             self.shouldAllow(user, '_allow_all')
 
-    def test_002_allow_none(self):
+    def test_allow_none(self):
         self.shouldAllow(self.testadmin, '_allow_none')
         users = [self.testpmsys, self.testnet, self.testsys]
         for user in users:
             self.shouldDeny(user, '_allow_none')
 
-    def test_003_allow_project_manager(self):
+    def test_allow_project_manager(self):
         for user in [self.testadmin, self.testpmsys]:
             self.shouldAllow(user, '_allow_project_manager')
         for user in [self.testnet, self.testsys]:
             self.shouldDeny(user, '_allow_project_manager')
 
-    def test_004_allow_sys_and_net(self):
+    def test_allow_sys_and_net(self):
         for user in [self.testadmin, self.testnet, self.testsys]:
             self.shouldAllow(user, '_allow_sys_and_net')
         # denied because it doesn't have the per project sysadmin
         for user in [self.testpmsys]:
             self.shouldDeny(user, '_allow_sys_and_net')
-
-if __name__ == "__main__":
-    # TODO: Implement use_fake as an option
-    unittest.main()

=== modified file 'nova/tests/test_adminapi.py'
--- nova/tests/test_adminapi.py	2011-07-26 23:29:50 +0000
+++ nova/tests/test_adminapi.py	2011-07-29 19:38:29 +0000
@@ -25,7 +25,6 @@
 from nova import rpc
 from nova import test
 from nova import utils
-from nova.auth import manager
 from nova.api.ec2 import admin
 from nova.image import fake
 
@@ -51,11 +50,11 @@
         self.volume = self.start_service('volume')
         self.image_service = utils.import_object(FLAGS.image_service)
 
-        self.manager = manager.AuthManager()
-        self.user = self.manager.create_user('admin', 'admin', 'admin', True)
-        self.project = self.manager.create_project('proj', 'admin', 'proj')
-        self.context = context.RequestContext(user=self.user,
-                                              project=self.project)
+        self.user_id = 'admin'
+        self.project_id = 'admin'
+        self.context = context.RequestContext(self.user_id,
+                                              self.project_id,
+                                              True)
 
         def fake_show(meh, context, id):
             return {'id': 1, 'properties': {'kernel_id': 1, 'ramdisk_id': 1,
@@ -73,11 +72,6 @@
 
         self.stubs.Set(rpc, 'cast', finish_cast)
 
-    def tearDown(self):
-        self.manager.delete_project(self.project)
-        self.manager.delete_user(self.user)
-        super(AdminApiTestCase, self).tearDown()
-
     def test_block_external_ips(self):
         """Make sure provider firewall rules are created."""
         result = self.api.block_external_addresses(self.context, '1.1.1.1/32')

=== modified file 'nova/tests/test_api.py'
--- nova/tests/test_api.py	2011-07-26 20:49:46 +0000
+++ nova/tests/test_api.py	2011-07-29 19:38:29 +0000
@@ -30,11 +30,11 @@
 from nova import context
 from nova import exception
 from nova import test
+from nova import wsgi
 from nova.api import ec2
 from nova.api.ec2 import apirequest
 from nova.api.ec2 import cloud
 from nova.api.ec2 import ec2utils
-from nova.auth import manager
 
 
 class FakeHttplibSocket(object):
@@ -192,10 +192,13 @@
     """Unit test for the cloud controller on an EC2 API"""
     def setUp(self):
         super(ApiEc2TestCase, self).setUp()
-        self.manager = manager.AuthManager()
         self.host = '127.0.0.1'
-        self.app = ec2.Authenticate(ec2.Requestify(ec2.Executor(),
-                       'nova.api.ec2.cloud.CloudController'))
+        # NOTE(vish): skipping the Authorizer
+        roles = ['sysadmin', 'netadmin']
+        ctxt = context.RequestContext('fake', 'fake', roles=roles)
+        self.app = wsgi.InjectContext(ctxt,
+                ec2.Requestify(ec2.Authorizer(ec2.Executor()),
+                               'nova.api.ec2.cloud.CloudController'))
 
     def expect_http(self, host=None, is_secure=False, api_version=None):
         """Returns a new EC2 connection"""
@@ -246,39 +249,25 @@
         self.expect_http(api_version='2010-10-30')
         self.mox.ReplayAll()
 
-        user = self.manager.create_user('fake', 'fake', 'fake')
-        project = self.manager.create_project('fake', 'fake', 'fake')
-
         # Any request should be fine
         self.ec2.get_all_instances()
         self.assertTrue(self.ec2.APIVersion in self.http.getresponsebody(),
                        'The version in the xmlns of the response does '
                        'not match the API version given in the request.')
 
-        self.manager.delete_project(project)
-        self.manager.delete_user(user)
-
     def test_describe_instances(self):
         """Test that, after creating a user and a project, the describe
         instances call to the API works properly"""
         self.expect_http()
         self.mox.ReplayAll()
-        user = self.manager.create_user('fake', 'fake', 'fake')
-        project = self.manager.create_project('fake', 'fake', 'fake')
         self.assertEqual(self.ec2.get_all_instances(), [])
-        self.manager.delete_project(project)
-        self.manager.delete_user(user)
 
     def test_terminate_invalid_instance(self):
         """Attempt to terminate an invalid instance"""
         self.expect_http()
         self.mox.ReplayAll()
-        user = self.manager.create_user('fake', 'fake', 'fake')
-        project = self.manager.create_project('fake', 'fake', 'fake')
         self.assertRaises(EC2ResponseError, self.ec2.terminate_instances,
                             "i-00000005")
-        self.manager.delete_project(project)
-        self.manager.delete_user(user)
 
     def test_get_all_key_pairs(self):
         """Test that, after creating a user and project and generating
@@ -287,16 +276,12 @@
         self.mox.ReplayAll()
         keyname = "".join(random.choice("sdiuisudfsdcnpaqwertasd") \
                           for x in range(random.randint(4, 8)))
-        user = self.manager.create_user('fake', 'fake', 'fake')
-        project = self.manager.create_project('fake', 'fake', 'fake')
         # NOTE(vish): create depends on pool, so call helper directly
-        cloud._gen_key(context.get_admin_context(), user.id, keyname)
+        cloud._gen_key(context.get_admin_context(), 'fake', keyname)
 
         rv = self.ec2.get_all_key_pairs()
         results = [k for k in rv if k.name == keyname]
         self.assertEquals(len(results), 1)
-        self.manager.delete_project(project)
-        self.manager.delete_user(user)
 
     def test_create_duplicate_key_pair(self):
         """Test that, after successfully generating a keypair,
@@ -305,8 +290,6 @@
         self.mox.ReplayAll()
         keyname = "".join(random.choice("sdiuisudfsdcnpaqwertasd") \
                           for x in range(random.randint(4, 8)))
-        user = self.manager.create_user('fake', 'fake', 'fake')
-        project = self.manager.create_project('fake', 'fake', 'fake')
         # NOTE(vish): create depends on pool, so call helper directly
         self.ec2.create_key_pair('test')
 
@@ -325,27 +308,16 @@
         """Test that we can retrieve security groups"""
         self.expect_http()
         self.mox.ReplayAll()
-        user = self.manager.create_user('fake', 'fake', 'fake', admin=True)
-        project = self.manager.create_project('fake', 'fake', 'fake')
 
         rv = self.ec2.get_all_security_groups()
 
         self.assertEquals(len(rv), 1)
         self.assertEquals(rv[0].name, 'default')
 
-        self.manager.delete_project(project)
-        self.manager.delete_user(user)
-
     def test_create_delete_security_group(self):
         """Test that we can create a security group"""
         self.expect_http()
         self.mox.ReplayAll()
-        user = self.manager.create_user('fake', 'fake', 'fake', admin=True)
-        project = self.manager.create_project('fake', 'fake', 'fake')
-
-        # At the moment, you need both of these to actually be netadmin
-        self.manager.add_role('fake', 'netadmin')
-        project.add_role('fake', 'netadmin')
 
         security_group_name = "".join(random.choice("sdiuisudfsdcnpaqwertasd")
                                       for x in range(random.randint(4, 8)))
@@ -364,9 +336,6 @@
 
         self.ec2.delete_security_group(security_group_name)
 
-        self.manager.delete_project(project)
-        self.manager.delete_user(user)
-
     def test_authorize_revoke_security_group_cidr(self):
         """
         Test that we can add and remove CIDR based rules
@@ -374,12 +343,6 @@
         """
         self.expect_http()
         self.mox.ReplayAll()
-        user = self.manager.create_user('fake', 'fake', 'fake')
-        project = self.manager.create_project('fake', 'fake', 'fake')
-
-        # At the moment, you need both of these to actually be netadmin
-        self.manager.add_role('fake', 'netadmin')
-        project.add_role('fake', 'netadmin')
 
         security_group_name = "".join(random.choice("sdiuisudfsdcnpaqwertasd")
                                       for x in range(random.randint(4, 8)))
@@ -426,9 +389,6 @@
         self.assertEqual(len(rv), 1)
         self.assertEqual(rv[0].name, 'default')
 
-        self.manager.delete_project(project)
-        self.manager.delete_user(user)
-
         return
 
     def test_authorize_revoke_security_group_cidr_v6(self):
@@ -438,12 +398,6 @@
         """
         self.expect_http()
         self.mox.ReplayAll()
-        user = self.manager.create_user('fake', 'fake', 'fake')
-        project = self.manager.create_project('fake', 'fake', 'fake')
-
-        # At the moment, you need both of these to actually be netadmin
-        self.manager.add_role('fake', 'netadmin')
-        project.add_role('fake', 'netadmin')
 
         security_group_name = "".join(random.choice("sdiuisudfsdcnpaqwertasd")
                                       for x in range(random.randint(4, 8)))
@@ -489,9 +443,6 @@
         self.assertEqual(len(rv), 1)
         self.assertEqual(rv[0].name, 'default')
 
-        self.manager.delete_project(project)
-        self.manager.delete_user(user)
-
         return
 
     def test_authorize_revoke_security_group_foreign_group(self):
@@ -501,12 +452,6 @@
         """
         self.expect_http()
         self.mox.ReplayAll()
-        user = self.manager.create_user('fake', 'fake', 'fake', admin=True)
-        project = self.manager.create_project('fake', 'fake', 'fake')
-
-        # At the moment, you need both of these to actually be netadmin
-        self.manager.add_role('fake', 'netadmin')
-        project.add_role('fake', 'netadmin')
 
         rand_string = 'sdiuisudfsdcnpaqwertasd'
         security_group_name = "".join(random.choice(rand_string)
@@ -560,8 +505,3 @@
         self.mox.ReplayAll()
 
         self.ec2.delete_security_group(security_group_name)
-
-        self.manager.delete_project(project)
-        self.manager.delete_user(user)
-
-        return

=== modified file 'nova/tests/test_auth.py'
--- nova/tests/test_auth.py	2011-06-28 14:52:22 +0000
+++ nova/tests/test_auth.py	2011-07-29 19:38:29 +0000
@@ -102,7 +102,7 @@
             self.assertEqual('classified', u.secret)
             self.assertEqual('private-party', u.access)
 
-    def test_004_signature_is_valid(self):
+    def test_signature_is_valid(self):
         with user_generator(self.manager, name='admin', secret='admin',
                             access='admin'):
             with project_generator(self.manager, name="admin",
@@ -141,15 +141,14 @@
                         '127.0.0.1',
                         '/services/Cloud'))
 
-    def test_005_can_get_credentials(self):
-        return
-        credentials = self.manager.get_user('test1').get_credentials()
-        self.assertEqual(credentials,
-        'export EC2_ACCESS_KEY="access"\n' +
-        'export EC2_SECRET_KEY="secret"\n' +
-        'export EC2_URL="http://127.0.0.1:8773/services/Cloud"\n' +
-        'export S3_URL="http://127.0.0.1:3333/"\n' +
-        'export EC2_USER_ID="test1"\n')
+    def test_can_get_credentials(self):
+        st = {'access': 'access', 'secret': 'secret'}
+        with user_and_project_generator(self.manager, user_state=st) as (u, p):
+            credentials = self.manager.get_environment_rc(u, p)
+            LOG.debug(credentials)
+            self.assertTrue('export EC2_ACCESS_KEY="access:testproj"\n'
+                            in credentials)
+            self.assertTrue('export EC2_SECRET_KEY="secret"\n' in credentials)
 
     def test_can_list_users(self):
         with user_generator(self.manager):

=== modified file 'nova/tests/test_cloud.py'
--- nova/tests/test_cloud.py	2011-07-29 06:20:40 +0000
+++ nova/tests/test_cloud.py	2011-07-29 19:38:29 +0000
@@ -34,7 +34,6 @@
 from nova import rpc
 from nova import test
 from nova import utils
-from nova.auth import manager
 from nova.api.ec2 import cloud
 from nova.api.ec2 import ec2utils
 from nova.image import fake
@@ -62,12 +61,11 @@
         self.volume = self.start_service('volume')
         self.image_service = utils.import_object(FLAGS.image_service)
 
-        self.manager = manager.AuthManager()
-        self.user = self.manager.create_user('admin', 'admin', 'admin', True)
-        self.project = self.manager.create_project('proj', 'admin', 'proj')
-        self.context = context.RequestContext(user=self.user,
-                                              project=self.project)
-        host = self.network.host
+        self.user_id = 'fake'
+        self.project_id = 'fake'
+        self.context = context.RequestContext(self.user_id,
+                                              self.project_id,
+                                              True)
 
         def fake_show(meh, context, id):
             return {'id': 1, 'container_format': 'ami',
@@ -87,17 +85,15 @@
         self.stubs.Set(rpc, 'cast', finish_cast)
 
     def tearDown(self):
-        networks = db.project_get_networks(self.context, self.project.id,
+        networks = db.project_get_networks(self.context, self.project_id,
                                            associate=False)
         for network in networks:
             db.network_disassociate(self.context, network['id'])
-        self.manager.delete_project(self.project)
-        self.manager.delete_user(self.user)
         super(CloudTestCase, self).tearDown()
 
     def _create_key(self, name):
         # NOTE(vish): create depends on pool, so just call helper directly
-        return cloud._gen_key(self.context, self.context.user.id, name)
+        return cloud._gen_key(self.context, self.context.user_id, name)
 
     def test_describe_regions(self):
         """Makes sure describe regions runs without raising an exception"""
@@ -982,7 +978,7 @@
         key = RSA.load_key_string(private_key, callback=lambda: None)
         bio = BIO.MemoryBuffer()
         public_key = db.key_pair_get(self.context,
-                                    self.context.user.id,
+                                    self.context.user_id,
                                     'test')['public_key']
         key.save_pub_key_bio(bio)
         converted = crypto.ssl_pub_to_ssh_pub(bio.read())
@@ -1006,7 +1002,7 @@
                                                'mytestfprint')
         self.assertTrue(result1)
         keydata = db.key_pair_get(self.context,
-                                  self.context.user.id,
+                                  self.context.user_id,
                                   'testimportkey1')
         self.assertEqual('mytestpubkey', keydata['public_key'])
         self.assertEqual('mytestfprint', keydata['fingerprint'])
@@ -1023,7 +1019,7 @@
                                                dummypub)
         self.assertTrue(result2)
         keydata = db.key_pair_get(self.context,
-                                  self.context.user.id,
+                                  self.context.user_id,
                                   'testimportkey2')
         self.assertEqual(dummypub, keydata['public_key'])
         self.assertEqual(dummyfprint, keydata['fingerprint'])

=== modified file 'nova/tests/test_compute.py'
--- nova/tests/test_compute.py	2011-07-27 22:02:49 +0000
+++ nova/tests/test_compute.py	2011-07-29 19:38:29 +0000
@@ -19,10 +19,6 @@
 Tests For Compute
 """
 
-import mox
-import stubout
-
-from nova.auth import manager
 from nova import compute
 from nova.compute import instance_types
 from nova.compute import manager as compute_manager
@@ -67,10 +63,9 @@
                    network_manager='nova.network.manager.FlatManager')
         self.compute = utils.import_object(FLAGS.compute_manager)
         self.compute_api = compute.API()
-        self.manager = manager.AuthManager()
-        self.user = self.manager.create_user('fake', 'fake', 'fake')
-        self.project = self.manager.create_project('fake', 'fake', 'fake')
-        self.context = context.RequestContext('fake', 'fake', False)
+        self.user_id = 'fake'
+        self.project_id = 'fake'
+        self.context = context.RequestContext(self.user_id, self.project_id)
         test_notifier.NOTIFICATIONS = []
 
         def fake_show(meh, context, id):
@@ -78,19 +73,14 @@
 
         self.stubs.Set(nova.image.fake._FakeImageService, 'show', fake_show)
 
-    def tearDown(self):
-        self.manager.delete_user(self.user)
-        self.manager.delete_project(self.project)
-        super(ComputeTestCase, self).tearDown()
-
     def _create_instance(self, params={}):
         """Create a test instance"""
         inst = {}
         inst['image_ref'] = 1
         inst['reservation_id'] = 'r-fakeres'
         inst['launch_time'] = '10'
-        inst['user_id'] = self.user.id
-        inst['project_id'] = self.project.id
+        inst['user_id'] = self.user_id
+        inst['project_id'] = self.project_id
         type_id = instance_types.get_instance_type_by_name('m1.tiny')['id']
         inst['instance_type_id'] = type_id
         inst['ami_launch_index'] = 0
@@ -115,8 +105,8 @@
     def _create_group(self):
         values = {'name': 'testgroup',
                   'description': 'testgroup',
-                  'user_id': self.user.id,
-                  'project_id': self.project.id}
+                  'user_id': self.user_id,
+                  'project_id': self.project_id}
         return db.security_group_create(self.context, values)
 
     def _get_dummy_instance(self):
@@ -350,8 +340,8 @@
         self.assertEquals(msg['priority'], 'INFO')
         self.assertEquals(msg['event_type'], 'compute.instance.create')
         payload = msg['payload']
-        self.assertEquals(payload['tenant_id'], self.project.id)
-        self.assertEquals(payload['user_id'], self.user.id)
+        self.assertEquals(payload['tenant_id'], self.project_id)
+        self.assertEquals(payload['user_id'], self.user_id)
         self.assertEquals(payload['instance_id'], instance_id)
         self.assertEquals(payload['instance_type'], 'm1.tiny')
         type_id = instance_types.get_instance_type_by_name('m1.tiny')['id']
@@ -374,8 +364,8 @@
         self.assertEquals(msg['priority'], 'INFO')
         self.assertEquals(msg['event_type'], 'compute.instance.delete')
         payload = msg['payload']
-        self.assertEquals(payload['tenant_id'], self.project.id)
-        self.assertEquals(payload['user_id'], self.user.id)
+        self.assertEquals(payload['tenant_id'], self.project_id)
+        self.assertEquals(payload['user_id'], self.user_id)
         self.assertEquals(payload['instance_id'], instance_id)
         self.assertEquals(payload['instance_type'], 'm1.tiny')
         type_id = instance_types.get_instance_type_by_name('m1.tiny')['id']
@@ -457,8 +447,8 @@
         self.assertEquals(msg['priority'], 'INFO')
         self.assertEquals(msg['event_type'], 'compute.instance.resize.prep')
         payload = msg['payload']
-        self.assertEquals(payload['tenant_id'], self.project.id)
-        self.assertEquals(payload['user_id'], self.user.id)
+        self.assertEquals(payload['tenant_id'], self.project_id)
+        self.assertEquals(payload['user_id'], self.user_id)
         self.assertEquals(payload['instance_id'], instance_id)
         self.assertEquals(payload['instance_type'], 'm1.tiny')
         type_id = instance_types.get_instance_type_by_name('m1.tiny')['id']
@@ -849,7 +839,6 @@
 
     def test_run_kill_vm(self):
         """Detect when a vm is terminated behind the scenes"""
-        self.stubs = stubout.StubOutForTesting()
         self.stubs.Set(compute_manager.ComputeManager,
                 '_report_driver_status', nop_report_driver_status)
 

=== modified file 'nova/tests/test_console.py'
--- nova/tests/test_console.py	2011-06-06 17:20:08 +0000
+++ nova/tests/test_console.py	2011-07-29 19:38:29 +0000
@@ -26,10 +26,9 @@
 from nova import flags
 from nova import test
 from nova import utils
-from nova.auth import manager
-from nova.console import manager as console_manager
 
 FLAGS = flags.FLAGS
+flags.DECLARE('console_driver', 'nova.console.manager')
 
 
 class ConsoleTestCase(test.TestCase):
@@ -39,17 +38,11 @@
         self.flags(console_driver='nova.console.fake.FakeConsoleProxy',
                    stub_compute=True)
         self.console = utils.import_object(FLAGS.console_manager)
-        self.manager = manager.AuthManager()
-        self.user = self.manager.create_user('fake', 'fake', 'fake')
-        self.project = self.manager.create_project('fake', 'fake', 'fake')
-        self.context = context.get_admin_context()
+        self.user_id = 'fake'
+        self.project_id = 'fake'
+        self.context = context.RequestContext(self.user_id, self.project_id)
         self.host = 'test_compute_host'
 
-    def tearDown(self):
-        self.manager.delete_user(self.user)
-        self.manager.delete_project(self.project)
-        super(ConsoleTestCase, self).tearDown()
-
     def _create_instance(self):
         """Create a test instance"""
         inst = {}
@@ -58,8 +51,8 @@
         inst['image_id'] = 1
         inst['reservation_id'] = 'r-fakeres'
         inst['launch_time'] = '10'
-        inst['user_id'] = self.user.id
-        inst['project_id'] = self.project.id
+        inst['user_id'] = self.user_id
+        inst['project_id'] = self.project_id
         inst['instance_type_id'] = 1
         inst['ami_launch_index'] = 0
         return db.instance_create(self.context, inst)['id']

=== modified file 'nova/tests/test_db_api.py'
--- nova/tests/test_db_api.py	2011-07-28 16:01:38 +0000
+++ nova/tests/test_db_api.py	2011-07-29 19:38:29 +0000
@@ -22,7 +22,6 @@
 from nova import context
 from nova import db
 from nova import flags
-from nova.auth import manager
 
 FLAGS = flags.FLAGS
 
@@ -45,42 +44,35 @@
     db.fixed_ip_create(ctxt, fixed_ip)
     fix_ref = db.fixed_ip_get_by_address(ctxt, ip)
     db.floating_ip_create(ctxt, {'address': flo_addr,
-                                        'fixed_ip_id': fix_ref.id})
+                                 'fixed_ip_id': fix_ref['id']})
 
 
 class DbApiTestCase(test.TestCase):
     def setUp(self):
         super(DbApiTestCase, self).setUp()
-        self.manager = manager.AuthManager()
-        self.user = self.manager.create_user('admin', 'admin', 'admin', True)
-        self.project = self.manager.create_project('proj', 'admin', 'proj')
-        self.context = context.RequestContext(user=self.user,
-                                              project=self.project)
-
-    def tearDown(self):
-        self.manager.delete_project(self.project)
-        self.manager.delete_user(self.user)
-        super(DbApiTestCase, self).tearDown()
+        self.user_id = 'fake'
+        self.project_id = 'fake'
+        self.context = context.RequestContext(self.user_id, self.project_id)
 
     def test_instance_get_project_vpn(self):
-        result = db.fixed_ip_get_all(self.context)
         values = {'instance_type_id': FLAGS.default_instance_type,
                   'image_ref': FLAGS.vpn_image_id,
-                  'project_id': self.project.id,
+                  'project_id': self.project_id
                  }
         instance = db.instance_create(self.context, values)
-        result = db.instance_get_project_vpn(self.context, self.project.id)
-        self.assertEqual(instance.id, result.id)
+        result = db.instance_get_project_vpn(self.context.elevated(),
+                                             self.project_id)
+        self.assertEqual(instance['id'], result['id'])
 
     def test_instance_get_project_vpn_joins(self):
-        result = db.fixed_ip_get_all(self.context)
         values = {'instance_type_id': FLAGS.default_instance_type,
                   'image_ref': FLAGS.vpn_image_id,
-                  'project_id': self.project.id,
+                  'project_id': self.project_id
                  }
         instance = db.instance_create(self.context, values)
-        _setup_networking(instance.id)
-        result = db.instance_get_project_vpn(self.context, self.project.id)
-        self.assertEqual(instance.id, result.id)
+        _setup_networking(instance['id'])
+        result = db.instance_get_project_vpn(self.context.elevated(),
+                                             self.project_id)
+        self.assertEqual(instance['id'], result['id'])
         self.assertEqual(result['fixed_ips'][0]['floating_ips'][0].address,
                          '1.2.1.2')

=== modified file 'nova/tests/test_libvirt.py'
--- nova/tests/test_libvirt.py	2011-07-28 16:01:38 +0000
+++ nova/tests/test_libvirt.py	2011-07-29 19:38:29 +0000
@@ -32,7 +32,6 @@
 from nova import test
 from nova import utils
 from nova.api.ec2 import cloud
-from nova.auth import manager
 from nova.compute import power_state
 from nova.virt.libvirt import connection
 from nova.virt.libvirt import firewall
@@ -154,36 +153,15 @@
         super(LibvirtConnTestCase, self).setUp()
         connection._late_load_cheetah()
         self.flags(fake_call=True)
-        self.manager = manager.AuthManager()
-
-        try:
-            pjs = self.manager.get_projects()
-            pjs = [p for p in pjs if p.name == 'fake']
-            if 0 != len(pjs):
-                self.manager.delete_project(pjs[0])
-
-            users = self.manager.get_users()
-            users = [u for u in users if u.name == 'fake']
-            if 0 != len(users):
-                self.manager.delete_user(users[0])
-        except Exception, e:
-            pass
-
-        users = self.manager.get_users()
-        self.user = self.manager.create_user('fake', 'fake', 'fake',
-                                             admin=True)
-        self.project = self.manager.create_project('fake', 'fake', 'fake')
+        self.user_id = 'fake'
+        self.project_id = 'fake'
+        self.context = context.RequestContext(self.user_id, self.project_id)
         self.network = utils.import_object(FLAGS.network_manager)
         self.context = context.get_admin_context()
         FLAGS.instances_path = ''
         self.call_libvirt_dependant_setup = False
         self.test_ip = '10.11.12.13'
 
-    def tearDown(self):
-        self.manager.delete_project(self.project)
-        self.manager.delete_user(self.user)
-        super(LibvirtConnTestCase, self).tearDown()
-
     test_instance = {'memory_kb':     '1024000',
                      'basepath':      '/some/path',
                      'bridge_name':   'br100',
@@ -441,8 +419,8 @@
         self.assertEquals(parameters[1].get('value'), 'fake')
 
     def _check_xml_and_container(self, instance):
-        user_context = context.RequestContext(project=self.project,
-                                              user=self.user)
+        user_context = context.RequestContext(self.user_id,
+                                              self.project_id)
         instance_ref = db.instance_create(user_context, instance)
         _setup_networking(instance_ref['id'], self.test_ip)
 
@@ -470,11 +448,10 @@
 
     def _check_xml_and_uri(self, instance, expect_ramdisk, expect_kernel,
                            rescue=False):
-        user_context = context.RequestContext(project=self.project,
-                                              user=self.user)
+        user_context = context.RequestContext(self.user_id, self.project_id)
         instance_ref = db.instance_create(user_context, instance)
         network_ref = db.project_get_networks(context.get_admin_context(),
-                                             self.project.id)[0]
+                                             self.project_id)[0]
 
         _setup_networking(instance_ref['id'], self.test_ip)
 
@@ -802,11 +779,9 @@
     def setUp(self):
         super(IptablesFirewallTestCase, self).setUp()
 
-        self.manager = manager.AuthManager()
-        self.user = self.manager.create_user('fake', 'fake', 'fake',
-                                             admin=True)
-        self.project = self.manager.create_project('fake', 'fake', 'fake')
-        self.context = context.RequestContext('fake', 'fake')
+        self.user_id = 'fake'
+        self.project_id = 'fake'
+        self.context = context.RequestContext(self.user_id, self.project_id)
         self.network = utils.import_object(FLAGS.network_manager)
 
         class FakeLibvirtConnection(object):
@@ -832,11 +807,6 @@
         connection.libxml2 = __import__('libxml2')
         return True
 
-    def tearDown(self):
-        self.manager.delete_project(self.project)
-        self.manager.delete_user(self.user)
-        super(IptablesFirewallTestCase, self).tearDown()
-
     in_nat_rules = [
       '# Generated by iptables-save v1.4.10 on Sat Feb 19 00:03:19 2011',
       '*nat',
@@ -1119,11 +1089,9 @@
         class Mock(object):
             pass
 
-        self.manager = manager.AuthManager()
-        self.user = self.manager.create_user('fake', 'fake', 'fake',
-                                             admin=True)
-        self.project = self.manager.create_project('fake', 'fake', 'fake')
-        self.context = context.RequestContext(self.user, self.project)
+        self.user_id = 'fake'
+        self.project_id = 'fake'
+        self.context = context.RequestContext(self.user_id, self.project_id)
 
         self.fake_libvirt_connection = Mock()
 
@@ -1131,11 +1099,6 @@
         self.fw = firewall.NWFilterFirewall(
                                          lambda: self.fake_libvirt_connection)
 
-    def tearDown(self):
-        self.manager.delete_project(self.project)
-        self.manager.delete_user(self.user)
-        super(NWFilterTestCase, self).tearDown()
-
     def test_cidr_rule_nwfilter_xml(self):
         cloud_controller = cloud.CloudController()
         cloud_controller.create_security_group(self.context,

=== modified file 'nova/tests/test_objectstore.py'
--- nova/tests/test_objectstore.py	2011-06-21 15:50:28 +0000
+++ nova/tests/test_objectstore.py	2011-07-29 19:38:29 +0000
@@ -21,8 +21,6 @@
 """
 
 import boto
-import glob
-import hashlib
 import os
 import shutil
 import tempfile
@@ -30,12 +28,9 @@
 from boto import exception as boto_exception
 from boto.s3 import connection as s3
 
-from nova import context
-from nova import exception
 from nova import flags
 from nova import wsgi
 from nova import test
-from nova.auth import manager
 from nova.objectstore import s3server
 
 
@@ -57,15 +52,9 @@
     def setUp(self):
         """Setup users, projects, and start a test server."""
         super(S3APITestCase, self).setUp()
-        self.flags(auth_driver='nova.auth.ldapdriver.FakeLdapDriver',
-                   buckets_path=os.path.join(OSS_TEMPDIR, 'buckets'),
+        self.flags(buckets_path=os.path.join(OSS_TEMPDIR, 'buckets'),
                    s3_host='127.0.0.1')
 
-        self.auth_manager = manager.AuthManager()
-        self.admin_user = self.auth_manager.create_user('admin', admin=True)
-        self.admin_project = self.auth_manager.create_project('admin',
-                                                              self.admin_user)
-
         shutil.rmtree(FLAGS.buckets_path)
         os.mkdir(FLAGS.buckets_path)
 
@@ -80,8 +69,8 @@
             boto.config.add_section('Boto')
 
         boto.config.set('Boto', 'num_retries', '0')
-        conn = s3.S3Connection(aws_access_key_id=self.admin_user.access,
-                               aws_secret_access_key=self.admin_user.secret,
+        conn = s3.S3Connection(aws_access_key_id='fake',
+                               aws_secret_access_key='fake',
                                host=FLAGS.s3_host,
                                port=FLAGS.s3_port,
                                is_secure=False,
@@ -104,11 +93,11 @@
         self.assertEquals(buckets[0].name, name, "Wrong name")
         return True
 
-    def test_000_list_buckets(self):
+    def test_list_buckets(self):
         """Make sure we are starting with no buckets."""
         self._ensure_no_buckets(self.conn.get_all_buckets())
 
-    def test_001_create_and_delete_bucket(self):
+    def test_create_and_delete_bucket(self):
         """Test bucket creation and deletion."""
         bucket_name = 'testbucket'
 
@@ -117,7 +106,7 @@
         self.conn.delete_bucket(bucket_name)
         self._ensure_no_buckets(self.conn.get_all_buckets())
 
-    def test_002_create_bucket_and_key_and_delete_key_again(self):
+    def test_create_bucket_and_key_and_delete_key_again(self):
         """Test key operations on buckets."""
         bucket_name = 'testbucket'
         key_name = 'somekey'
@@ -146,8 +135,6 @@
                           bucket_name)
 
     def tearDown(self):
-        """Tear down auth and test server."""
-        self.auth_manager.delete_user('admin')
-        self.auth_manager.delete_project('admin')
+        """Tear down test server."""
         self.server.stop()
         super(S3APITestCase, self).tearDown()

=== modified file 'nova/tests/test_quota.py'
--- nova/tests/test_quota.py	2011-07-27 00:40:50 +0000
+++ nova/tests/test_quota.py	2011-07-29 19:38:29 +0000
@@ -20,12 +20,9 @@
 from nova import context
 from nova import db
 from nova import flags
-from nova import network
 from nova import quota
 from nova import test
-from nova import utils
 from nova import volume
-from nova.auth import manager
 from nova.compute import instance_types
 
 
@@ -48,25 +45,20 @@
                    quota_gigabytes=20,
                    quota_floating_ips=1)
 
-        self.manager = manager.AuthManager()
-        self.user = self.manager.create_user('admin', 'admin', 'admin', True)
-        self.project = self.manager.create_project('admin', 'admin', 'admin')
         self.network = self.network = self.start_service('network')
-        self.context = context.RequestContext(project=self.project,
-                                              user=self.user)
-
-    def tearDown(self):
-        manager.AuthManager().delete_project(self.project)
-        manager.AuthManager().delete_user(self.user)
-        super(QuotaTestCase, self).tearDown()
+        self.user_id = 'admin'
+        self.project_id = 'admin'
+        self.context = context.RequestContext(self.user_id,
+                                              self.project_id,
+                                              True)
 
     def _create_instance(self, cores=2):
         """Create a test instance"""
         inst = {}
         inst['image_id'] = 1
         inst['reservation_id'] = 'r-fakeres'
-        inst['user_id'] = self.user.id
-        inst['project_id'] = self.project.id
+        inst['user_id'] = self.user_id
+        inst['project_id'] = self.project_id
         inst['instance_type_id'] = '3'  # m1.large
         inst['vcpus'] = cores
         return db.instance_create(self.context, inst)['id']
@@ -74,8 +66,8 @@
     def _create_volume(self, size=10):
         """Create a test volume"""
         vol = {}
-        vol['user_id'] = self.user.id
-        vol['project_id'] = self.project.id
+        vol['user_id'] = self.user_id
+        vol['project_id'] = self.project_id
         vol['size'] = size
         return db.volume_create(self.context, vol)['id']
 
@@ -95,15 +87,15 @@
         num_instances = quota.allowed_instances(self.context, 100,
             self._get_instance_type('m1.small'))
         self.assertEqual(num_instances, 2)
-        db.quota_create(self.context, self.project.id, 'instances', 10)
+        db.quota_create(self.context, self.project_id, 'instances', 10)
         num_instances = quota.allowed_instances(self.context, 100,
             self._get_instance_type('m1.small'))
         self.assertEqual(num_instances, 4)
-        db.quota_create(self.context, self.project.id, 'cores', 100)
+        db.quota_create(self.context, self.project_id, 'cores', 100)
         num_instances = quota.allowed_instances(self.context, 100,
             self._get_instance_type('m1.small'))
         self.assertEqual(num_instances, 10)
-        db.quota_create(self.context, self.project.id, 'ram', 3 * 2048)
+        db.quota_create(self.context, self.project_id, 'ram', 3 * 2048)
         num_instances = quota.allowed_instances(self.context, 100,
             self._get_instance_type('m1.small'))
         self.assertEqual(num_instances, 3)
@@ -113,13 +105,13 @@
         num_metadata_items = quota.allowed_metadata_items(self.context,
                                                           too_many_items)
         self.assertEqual(num_metadata_items, FLAGS.quota_metadata_items)
-        db.quota_create(self.context, self.project.id, 'metadata_items', 5)
+        db.quota_create(self.context, self.project_id, 'metadata_items', 5)
         num_metadata_items = quota.allowed_metadata_items(self.context,
                                                           too_many_items)
         self.assertEqual(num_metadata_items, 5)
 
         # Cleanup
-        db.quota_destroy_all_by_project(self.context, self.project.id)
+        db.quota_destroy_all_by_project(self.context, self.project_id)
 
     def test_unlimited_instances(self):
         FLAGS.quota_instances = 2
@@ -129,7 +121,7 @@
         num_instances = quota.allowed_instances(self.context, 100,
                                                 instance_type)
         self.assertEqual(num_instances, 2)
-        db.quota_create(self.context, self.project.id, 'instances', None)
+        db.quota_create(self.context, self.project_id, 'instances', None)
         num_instances = quota.allowed_instances(self.context, 100,
                                                 instance_type)
         self.assertEqual(num_instances, 100)
@@ -145,7 +137,7 @@
         num_instances = quota.allowed_instances(self.context, 100,
                                                 instance_type)
         self.assertEqual(num_instances, 2)
-        db.quota_create(self.context, self.project.id, 'ram', None)
+        db.quota_create(self.context, self.project_id, 'ram', None)
         num_instances = quota.allowed_instances(self.context, 100,
                                                 instance_type)
         self.assertEqual(num_instances, 100)
@@ -161,7 +153,7 @@
         num_instances = quota.allowed_instances(self.context, 100,
                                                 instance_type)
         self.assertEqual(num_instances, 2)
-        db.quota_create(self.context, self.project.id, 'cores', None)
+        db.quota_create(self.context, self.project_id, 'cores', None)
         num_instances = quota.allowed_instances(self.context, 100,
                                                 instance_type)
         self.assertEqual(num_instances, 100)
@@ -174,7 +166,7 @@
         FLAGS.quota_gigabytes = -1
         volumes = quota.allowed_volumes(self.context, 100, 1)
         self.assertEqual(volumes, 10)
-        db.quota_create(self.context, self.project.id, 'volumes', None)
+        db.quota_create(self.context, self.project_id, 'volumes', None)
         volumes = quota.allowed_volumes(self.context, 100, 1)
         self.assertEqual(volumes, 100)
         volumes = quota.allowed_volumes(self.context, 101, 1)
@@ -185,7 +177,7 @@
         FLAGS.quota_gigabytes = 10
         volumes = quota.allowed_volumes(self.context, 100, 1)
         self.assertEqual(volumes, 10)
-        db.quota_create(self.context, self.project.id, 'gigabytes', None)
+        db.quota_create(self.context, self.project_id, 'gigabytes', None)
         volumes = quota.allowed_volumes(self.context, 100, 1)
         self.assertEqual(volumes, 100)
         volumes = quota.allowed_volumes(self.context, 101, 1)
@@ -195,7 +187,7 @@
         FLAGS.quota_floating_ips = 10
         floating_ips = quota.allowed_floating_ips(self.context, 100)
         self.assertEqual(floating_ips, 10)
-        db.quota_create(self.context, self.project.id, 'floating_ips', None)
+        db.quota_create(self.context, self.project_id, 'floating_ips', None)
         floating_ips = quota.allowed_floating_ips(self.context, 100)
         self.assertEqual(floating_ips, 100)
         floating_ips = quota.allowed_floating_ips(self.context, 101)
@@ -205,7 +197,7 @@
         FLAGS.quota_metadata_items = 10
         items = quota.allowed_metadata_items(self.context, 100)
         self.assertEqual(items, 10)
-        db.quota_create(self.context, self.project.id, 'metadata_items', None)
+        db.quota_create(self.context, self.project_id, 'metadata_items', None)
         items = quota.allowed_metadata_items(self.context, 100)
         self.assertEqual(items, 100)
         items = quota.allowed_metadata_items(self.context, 101)
@@ -273,11 +265,11 @@
         address = '192.168.0.100'
         db.floating_ip_create(context.get_admin_context(),
                               {'address': address,
-                               'project_id': self.project.id})
+                               'project_id': self.project_id})
         self.assertRaises(quota.QuotaError,
                           self.network.allocate_floating_ip,
                           self.context,
-                          self.project.id)
+                          self.project_id)
         db.floating_ip_destroy(context.get_admin_context(), address)
 
     def test_too_many_metadata_items(self):
@@ -299,7 +291,7 @@
 
     def test_overridden_allowed_injected_files(self):
         FLAGS.quota_max_injected_files = 5
-        db.quota_create(self.context, self.project.id, 'injected_files', 77)
+        db.quota_create(self.context, self.project_id, 'injected_files', 77)
         self.assertEqual(quota.allowed_injected_files(self.context, 100), 77)
 
     def test_unlimited_default_allowed_injected_files(self):
@@ -308,7 +300,7 @@
 
     def test_unlimited_db_allowed_injected_files(self):
         FLAGS.quota_max_injected_files = 5
-        db.quota_create(self.context, self.project.id, 'injected_files', None)
+        db.quota_create(self.context, self.project_id, 'injected_files', None)
         self.assertEqual(quota.allowed_injected_files(self.context, 100), 100)
 
     def test_default_allowed_injected_file_content_bytes(self):
@@ -318,7 +310,7 @@
 
     def test_overridden_allowed_injected_file_content_bytes(self):
         FLAGS.quota_max_injected_file_content_bytes = 12345
-        db.quota_create(self.context, self.project.id,
+        db.quota_create(self.context, self.project_id,
                         'injected_file_content_bytes', 5678)
         limit = quota.allowed_injected_file_content_bytes(self.context, 23456)
         self.assertEqual(limit, 5678)
@@ -330,7 +322,7 @@
 
     def test_unlimited_db_allowed_injected_file_content_bytes(self):
         FLAGS.quota_max_injected_file_content_bytes = 12345
-        db.quota_create(self.context, self.project.id,
+        db.quota_create(self.context, self.project_id,
                         'injected_file_content_bytes', None)
         limit = quota.allowed_injected_file_content_bytes(self.context, 23456)
         self.assertEqual(limit, 23456)

=== modified file 'nova/tests/test_vmwareapi.py'
--- nova/tests/test_vmwareapi.py	2011-07-27 00:40:50 +0000
+++ nova/tests/test_vmwareapi.py	2011-07-29 19:38:29 +0000
@@ -19,11 +19,11 @@
 Test suite for VMWareAPI.
 """
 
+from nova import context
 from nova import db
 from nova import flags
 from nova import test
 from nova import utils
-from nova.auth import manager
 from nova.compute import power_state
 from nova.tests.glance import stubs as glance_stubs
 from nova.tests.vmwareapi import db_fakes
@@ -43,10 +43,9 @@
         self.flags(vmwareapi_host_ip='test_url',
                    vmwareapi_host_username='test_username',
                    vmwareapi_host_password='test_pass')
-        self.manager = manager.AuthManager()
-        self.user = self.manager.create_user('fake', 'fake', 'fake',
-                                             admin=True)
-        self.project = self.manager.create_project('fake', 'fake', 'fake')
+        self.user_id = 'fake'
+        self.project_id = 'fake'
+        self.context = context.RequestContext(self.user_id, self.project_id)
         self.network = utils.import_object(FLAGS.network_manager)
         vmwareapi_fake.reset()
         db_fakes.stub_out_db_instance_api(self.stubs)
@@ -77,14 +76,12 @@
     def tearDown(self):
         super(VMWareAPIVMTestCase, self).tearDown()
         vmwareapi_fake.cleanup()
-        self.manager.delete_project(self.project)
-        self.manager.delete_user(self.user)
 
     def _create_instance_in_the_db(self):
         values = {'name': 1,
                   'id': 1,
-                  'project_id': self.project.id,
-                  'user_id': self.user.id,
+                  'project_id': self.project_id,
+                  'user_id': self.user_id,
                   'image_ref': "1",
                   'kernel_id': "1",
                   'ramdisk_id': "1",

=== modified file 'nova/tests/test_xenapi.py'
--- nova/tests/test_xenapi.py	2011-07-27 22:02:49 +0000
+++ nova/tests/test_xenapi.py	2011-07-29 19:38:29 +0000
@@ -30,7 +30,6 @@
 from nova import log as logging
 from nova import test
 from nova import utils
-from nova.auth import manager
 from nova.compute import instance_types
 from nova.compute import power_state
 from nova import exception
@@ -69,7 +68,9 @@
     def setUp(self):
         super(XenAPIVolumeTestCase, self).setUp()
         self.stubs = stubout.StubOutForTesting()
-        self.context = context.RequestContext('fake', 'fake', False)
+        self.user_id = 'fake'
+        self.project_id = 'fake'
+        self.context = context.RequestContext(self.user_id, self.project_id)
         FLAGS.target_host = '127.0.0.1'
         FLAGS.xenapi_connection_url = 'test_url'
         FLAGS.xenapi_connection_password = 'test_pass'
@@ -77,7 +78,7 @@
         stubs.stub_out_get_target(self.stubs)
         xenapi_fake.reset()
         self.values = {'id': 1,
-                  'project_id': 'fake',
+                  'project_id': self.user_id,
                   'user_id': 'fake',
                   'image_ref': 1,
                   'kernel_id': 2,
@@ -173,10 +174,6 @@
     """Unit tests for VM operations."""
     def setUp(self):
         super(XenAPIVMTestCase, self).setUp()
-        self.manager = manager.AuthManager()
-        self.user = self.manager.create_user('fake', 'fake', 'fake',
-                                             admin=True)
-        self.project = self.manager.create_project('fake', 'fake', 'fake')
         self.network = utils.import_object(FLAGS.network_manager)
         self.stubs = stubout.StubOutForTesting()
         self.flags(xenapi_connection_url='test_url',
@@ -195,7 +192,9 @@
         stubs.stub_out_vm_methods(self.stubs)
         glance_stubs.stubout_glance_client(self.stubs)
         fake_utils.stub_out_utils_execute(self.stubs)
-        self.context = context.RequestContext('fake', 'fake', False)
+        self.user_id = 'fake'
+        self.project_id = 'fake'
+        self.context = context.RequestContext(self.user_id, self.project_id)
         self.conn = xenapi_conn.get_connection(False)
 
     def test_parallel_builds(self):
@@ -229,8 +228,8 @@
             instance = db.instance_create(self.context, values)
             self.conn.spawn(instance, network_info)
 
-        gt1 = eventlet.spawn(_do_build, 1, self.project.id, self.user.id)
-        gt2 = eventlet.spawn(_do_build, 2, self.project.id, self.user.id)
+        gt1 = eventlet.spawn(_do_build, 1, self.project_id, self.user_id)
+        gt2 = eventlet.spawn(_do_build, 2, self.project_id, self.user_id)
         gt1.wait()
         gt2.wait()
 
@@ -401,8 +400,8 @@
         stubs.stubout_loopingcall_start(self.stubs)
         if create_record:
             values = {'id': instance_id,
-                      'project_id': self.project.id,
-                      'user_id': self.user.id,
+                      'project_id': self.project_id,
+                      'user_id': self.user_id,
                       'image_ref': image_ref,
                       'kernel_id': kernel_id,
                       'ramdisk_id': ramdisk_id,
@@ -469,12 +468,30 @@
         self._check_vdis(vdi_recs_start, vdi_recs_end)
 
     def test_spawn_raw_objectstore(self):
-        FLAGS.xenapi_image_service = 'objectstore'
-        self._test_spawn(1, None, None)
+        # TODO(vish): deprecated
+        from nova.auth import manager
+        authman = manager.AuthManager()
+        authman.create_user('fake', 'fake')
+        authman.create_project('fake', 'fake')
+        try:
+            FLAGS.xenapi_image_service = 'objectstore'
+            self._test_spawn(1, None, None)
+        finally:
+            authman.delete_project('fake')
+            authman.delete_user('fake')
 
     def test_spawn_objectstore(self):
-        FLAGS.xenapi_image_service = 'objectstore'
-        self._test_spawn(1, 2, 3)
+        # TODO(vish): deprecated
+        from nova.auth import manager
+        authman = manager.AuthManager()
+        authman.create_user('fake', 'fake')
+        authman.create_project('fake', 'fake')
+        try:
+            FLAGS.xenapi_image_service = 'objectstore'
+            self._test_spawn(1, 2, 3)
+        finally:
+            authman.delete_project('fake')
+            authman.delete_user('fake')
 
     @stub_vm_utils_with_vdi_attached_here
     def test_spawn_raw_glance(self):
@@ -626,7 +643,7 @@
                                            host=FLAGS.host,
                                            vpn=None,
                                            instance_type_id=1,
-                                           project_id=self.project.id)
+                                           project_id=self.project_id)
         self._test_spawn(glance_stubs.FakeGlance.IMAGE_MACHINE,
                          glance_stubs.FakeGlance.IMAGE_KERNEL,
                          glance_stubs.FakeGlance.IMAGE_RAMDISK,
@@ -656,21 +673,13 @@
         # Ensure that it will not unrescue a non-rescued instance.
         self.assertRaises(Exception, conn.unrescue, instance, None)
 
-    def tearDown(self):
-        super(XenAPIVMTestCase, self).tearDown()
-        self.manager.delete_project(self.project)
-        self.manager.delete_user(self.user)
-        self.vm_info = None
-        self.vm = None
-        self.stubs.UnsetAll()
-
     def _create_instance(self, instance_id=1, spawn=True):
         """Creates and spawns a test instance."""
         stubs.stubout_loopingcall_start(self.stubs)
         values = {
             'id': instance_id,
-            'project_id': self.project.id,
-            'user_id': self.user.id,
+            'project_id': self.project_id,
+            'user_id': self.user_id,
             'image_ref': 1,
             'kernel_id': 2,
             'ramdisk_id': 3,
@@ -752,14 +761,12 @@
         stubs.stub_out_get_target(self.stubs)
         xenapi_fake.reset()
         xenapi_fake.create_network('fake', FLAGS.flat_network_bridge)
-        self.manager = manager.AuthManager()
-        self.user = self.manager.create_user('fake', 'fake', 'fake',
-                                             admin=True)
-        self.project = self.manager.create_project('fake', 'fake', 'fake')
-        self.context = context.RequestContext('fake', 'fake', False)
+        self.user_id = 'fake'
+        self.project_id = 'fake'
+        self.context = context.RequestContext(self.user_id, self.project_id)
         self.values = {'id': 1,
-                  'project_id': self.project.id,
-                  'user_id': self.user.id,
+                  'project_id': self.project_id,
+                  'user_id': self.user_id,
                   'image_ref': 1,
                   'kernel_id': None,
                   'ramdisk_id': None,
@@ -773,12 +780,6 @@
         stubs.stubout_get_this_vm_uuid(self.stubs)
         glance_stubs.stubout_glance_client(self.stubs)
 
-    def tearDown(self):
-        super(XenAPIMigrateInstance, self).tearDown()
-        self.manager.delete_project(self.project)
-        self.manager.delete_user(self.user)
-        self.stubs.UnsetAll()
-
     def test_migrate_disk_and_power_off(self):
         instance = db.instance_create(self.context, self.values)
         stubs.stubout_session(self.stubs, stubs.FakeSessionForMigrationTests)

=== modified file 'nova/utils.py'
--- nova/utils.py	2011-07-29 17:33:58 +0000
+++ nova/utils.py	2011-07-29 19:38:29 +0000
@@ -19,7 +19,6 @@
 
 """Utilities and helper functions."""
 
-import base64
 import datetime
 import functools
 import inspect
@@ -30,7 +29,6 @@
 import random
 import re
 import socket
-import string
 import struct
 import sys
 import time
@@ -50,7 +48,8 @@
 
 
 LOG = logging.getLogger("nova.utils")
-TIME_FORMAT = "%Y-%m-%dT%H:%M:%SZ"
+ISO_TIME_FORMAT = "%Y-%m-%dT%H:%M:%SZ"
+PERFECT_TIME_FORMAT = "%Y-%m-%dT%H:%M:%S.%f"
 FLAGS = flags.FLAGS
 
 
@@ -361,16 +360,26 @@
     utcnow.override_time = None
 
 
+def strtime(at=None, fmt=PERFECT_TIME_FORMAT):
+    """Returns formatted utcnow."""
+    if not at:
+        at = utcnow()
+    return at.strftime(fmt)
+
+
+def parse_strtime(timestr, fmt=PERFECT_TIME_FORMAT):
+    """Turn a formatted time back into a datetime."""
+    return datetime.datetime.strptime(timestr, fmt)
+
+
 def isotime(at=None):
     """Returns iso formatted utcnow."""
-    if not at:
-        at = utcnow()
-    return at.strftime(TIME_FORMAT)
+    return strtime(at, ISO_TIME_FORMAT)
 
 
 def parse_isotime(timestr):
     """Turn an iso formatted time back into a datetime."""
-    return datetime.datetime.strptime(timestr, TIME_FORMAT)
+    return parse_strtime(timestr, ISO_TIME_FORMAT)
 
 
 def parse_mailmap(mailmap='.mailmap'):

=== modified file 'nova/virt/hyperv.py'
--- nova/virt/hyperv.py	2011-07-20 11:21:44 +0000
+++ nova/virt/hyperv.py	2011-07-29 19:38:29 +0000
@@ -66,7 +66,6 @@
 from nova import exception
 from nova import flags
 from nova import log as logging
-from nova.auth import manager
 from nova.compute import power_state
 from nova.virt import driver
 from nova.virt import images
@@ -145,13 +144,12 @@
         if vm is not None:
             raise exception.InstanceExists(name=instance.name)
 
-        user = manager.AuthManager().get_user(instance['user_id'])
-        project = manager.AuthManager().get_project(instance['project_id'])
         #Fetch the file, assume it is a VHD file.
         base_vhd_filename = os.path.join(FLAGS.instances_path,
                                          instance.name)
         vhdfile = "%s.vhd" % (base_vhd_filename)
-        images.fetch(instance['image_ref'], vhdfile, user, project)
+        images.fetch(instance['image_ref'], vhdfile,
+                     instance['user_id'], instance['project_id'])
 
         try:
             self._create_vm(instance)

=== modified file 'nova/virt/images.py'
--- nova/virt/images.py	2011-06-09 21:36:20 +0000
+++ nova/virt/images.py	2011-07-29 19:38:29 +0000
@@ -33,7 +33,7 @@
 LOG = logging.getLogger('nova.virt.images')
 
 
-def fetch(image_href, path, _user, _project):
+def fetch(image_href, path, _user_id, _project_id):
     # TODO(vish): Improve context handling and add owner and auth data
     #             when it is added to glance.  Right now there is no
     #             auth checking in glance, so we assume that access was

=== modified file 'nova/virt/libvirt/connection.py'
--- nova/virt/libvirt/connection.py	2011-07-27 16:19:45 +0000
+++ nova/virt/libvirt/connection.py	2011-07-29 19:38:29 +0000
@@ -769,9 +769,9 @@
             else:
                 utils.execute('cp', base, target)
 
-    def _fetch_image(self, target, image_id, user, project, size=None):
+    def _fetch_image(self, target, image_id, user_id, project_id, size=None):
         """Grab image and optionally attempt to resize it"""
-        images.fetch(image_id, target, user, project)
+        images.fetch(image_id, target, user_id, project_id)
         if size:
             disk.extend(target, size)
 
@@ -809,9 +809,6 @@
         os.close(os.open(basepath('console.log', ''),
                          os.O_CREAT | os.O_WRONLY, 0660))
 
-        user = manager.AuthManager().get_user(inst['user_id'])
-        project = manager.AuthManager().get_project(inst['project_id'])
-
         if not disk_images:
             disk_images = {'image_id': inst['image_ref'],
                            'kernel_id': inst['kernel_id'],
@@ -823,16 +820,16 @@
                               target=basepath('kernel'),
                               fname=fname,
                               image_id=disk_images['kernel_id'],
-                              user=user,
-                              project=project)
+                              user_id=inst['user_id'],
+                              project_id=inst['project_id'])
             if disk_images['ramdisk_id']:
                 fname = '%08x' % int(disk_images['ramdisk_id'])
                 self._cache_image(fn=self._fetch_image,
                                   target=basepath('ramdisk'),
                                   fname=fname,
                                   image_id=disk_images['ramdisk_id'],
-                                  user=user,
-                                  project=project)
+                                  user_id=inst['user_id'],
+                                  project_id=inst['project_id'])
 
         root_fname = hashlib.sha1(disk_images['image_id']).hexdigest()
         size = FLAGS.minimum_root_size
@@ -850,8 +847,8 @@
                               fname=root_fname,
                               cow=FLAGS.use_cow_images,
                               image_id=disk_images['image_id'],
-                              user=user,
-                              project=project,
+                              user_id=inst['user_id'],
+                              project_id=inst['project_id'],
                               size=size)
 
         if inst_type['local_gb'] and not self._volume_in_mapping(

=== modified file 'nova/virt/xenapi/vm_utils.py'
--- nova/virt/xenapi/vm_utils.py	2011-07-21 07:31:14 +0000
+++ nova/virt/xenapi/vm_utils.py	2011-07-29 19:38:29 +0000
@@ -37,7 +37,6 @@
 from nova.image import glance as glance_image_service
 from nova import log as logging
 from nova import utils
-from nova.auth.manager import AuthManager
 from nova.compute import instance_types
 from nova.compute import power_state
 from nova.virt import disk
@@ -384,7 +383,7 @@
         session.wait_for_task(task, instance.id)
 
     @classmethod
-    def fetch_image(cls, session, instance_id, image, user, project,
+    def fetch_image(cls, session, instance_id, image, user_id, project_id,
                     image_type):
         """
         image_type is interpreted as an ImageType instance
@@ -396,18 +395,23 @@
         Returns: A single filename if image_type is KERNEL_RAMDISK
                  A list of dictionaries that describe VDIs, otherwise
         """
-        access = AuthManager().get_access_key(user, project)
 
         if FLAGS.xenapi_image_service == 'glance':
-            return cls._fetch_image_glance(session, instance_id, image,
-                                           access, image_type)
+            return cls._fetch_image_glance(session, instance_id,
+                                           image, image_type)
         else:
+            # TODO(vish): this shouldn't be used anywhere anymore and
+            #             can probably be removed
+            from nova.auth.manager import AuthManager
+            manager = AuthManager()
+            access = manager.get_access_key(user_id, project_id)
+            secret = manager.get_user(user_id).secret
             return cls._fetch_image_objectstore(session, instance_id, image,
-                                                access, user.secret,
+                                                access, secret,
                                                 image_type)
 
     @classmethod
-    def _fetch_image_glance_vhd(cls, session, instance_id, image, access,
+    def _fetch_image_glance_vhd(cls, session, instance_id, image,
                                 image_type):
         """Tell glance to download an image and put the VHDs into the SR
 
@@ -455,7 +459,7 @@
         return vdis
 
     @classmethod
-    def _fetch_image_glance_disk(cls, session, instance_id, image, access,
+    def _fetch_image_glance_disk(cls, session, instance_id, image,
                                  image_type):
         """Fetch the image from Glance
 
@@ -589,8 +593,7 @@
         return image_type
 
     @classmethod
-    def _fetch_image_glance(cls, session, instance_id, image, access,
-                            image_type):
+    def _fetch_image_glance(cls, session, instance_id, image, image_type):
         """Fetch image from glance based on image type.
 
         Returns: A single filename if image_type is KERNEL or RAMDISK
@@ -598,10 +601,10 @@
         """
         if image_type == ImageType.DISK_VHD:
             return cls._fetch_image_glance_vhd(
-                session, instance_id, image, access, image_type)
+                session, instance_id, image, image_type)
         else:
             return cls._fetch_image_glance_disk(
-                session, instance_id, image, access, image_type)
+                session, instance_id, image, image_type)
 
     @classmethod
     def _fetch_image_objectstore(cls, session, instance_id, image, access,

=== modified file 'nova/virt/xenapi/vmops.py'
--- nova/virt/xenapi/vmops.py	2011-07-28 19:01:30 +0000
+++ nova/virt/xenapi/vmops.py	2011-07-29 19:38:29 +0000
@@ -38,7 +38,6 @@
 from nova import log as logging
 from nova import utils
 
-from nova.auth.manager import AuthManager
 from nova.compute import power_state
 from nova.virt import driver
 from nova.virt.xenapi.network_utils import NetworkHelper
@@ -136,11 +135,10 @@
         self._session.call_xenapi('VM.start', vm_ref, False, False)
 
     def _create_disks(self, instance):
-        user = AuthManager().get_user(instance.user_id)
-        project = AuthManager().get_project(instance.project_id)
         disk_image_type = VMHelper.determine_disk_image_type(instance)
         vdis = VMHelper.fetch_image(self._session,
-                instance.id, instance.image_ref, user, project,
+                instance.id, instance.image_ref,
+                instance.user_id, instance.project_id,
                 disk_image_type)
         return vdis
 
@@ -178,21 +176,18 @@
                                   power_state.SHUTDOWN)
             return
 
-        user = AuthManager().get_user(instance.user_id)
-        project = AuthManager().get_project(instance.project_id)
-
         disk_image_type = VMHelper.determine_disk_image_type(instance)
         kernel = None
         ramdisk = None
         try:
             if instance.kernel_id:
                 kernel = VMHelper.fetch_image(self._session, instance.id,
-                        instance.kernel_id, user, project,
-                        ImageType.KERNEL)[0]
+                        instance.kernel_id, instance.user_id,
+                        instance.project_id, ImageType.KERNEL)[0]
             if instance.ramdisk_id:
                 ramdisk = VMHelper.fetch_image(self._session, instance.id,
-                        instance.ramdisk_id, user, project,
-                        ImageType.RAMDISK)[0]
+                        instance.kernel_id, instance.user_id,
+                        instance.project_id, ImageType.RAMDISK)[0]
             # Create the VM ref and attach the first disk
             first_vdi_ref = self._session.call_xenapi('VDI.get_by_uuid',
                     vdis[0]['vdi_uuid'])

=== modified file 'nova/wsgi.py'
--- nova/wsgi.py	2011-07-11 13:06:55 +0000
+++ nova/wsgi.py	2011-07-29 19:38:29 +0000
@@ -274,6 +274,18 @@
         return self.process_response(response)
 
 
+class InjectContext(Middleware):
+    """Add a 'nova.context' to WSGI environ."""
+    def __init__(self, context, *args, **kwargs):
+        self.context = context
+        super(InjectContext, self).__init__(*args, **kwargs)
+
+    @webob.dec.wsgify(RequestClass=Request)
+    def __call__(self, req):
+        req.environ['nova.context'] = self.context
+        return self.application
+
+
 class Debug(Middleware):
     """Helper class for debugging a WSGI application.