Merge remote branch 'khussein/master'

50 files changed, 2381 insertions, 1311 deletions

diff --git a/README.md b/README.md
index 6257536f..aefd2e61 100644
--- a/README.md
+++ b/README.md
@@ -1,5 +1,5 @@
-Keystone: Identity Service
-==========================
+Keystone: OpenStack Identity Service
+====================================
 
 Keystone is a proposed independent authentication service for [OpenStack](http://www.openstack.org).
 
@@ -18,80 +18,47 @@ SERVICES:
 
 Also included:
 
+* Keystone    - Service and Admin API are available separately. Admin API allows management of tenants, roles, and users as well.
 * Auth_Basic  - Stub for WSGI middleware that will be used to handle basic auth
 * Auth_OpenID - Stub for WSGI middleware that will be used to handle openid auth protocol
 * RemoteAuth  - WSGI middleware that can be used in services (like Swift, Nova, and Glance) when Auth middleware is running remotely
 
 
-ENVIRONMENT & DEPENDENCIES:
----------------------------
-See pip-requires for dependency list
-
-Setup:
-Install http://pypi.python.org/pypi/setuptools
-    sudo easy_install pip
-    sudo pip install -r pip-requires
-
-Configuration:
-Keystone gets its configuration from command-line parameters or a .conf file. The file can be provided explicitely
-on the command line otherwise the following logic applies (the conf file in use will be output to help
-in troubleshooting:
-
-1. config.py takes the config file from <topdir>/etc/keystone.conf
-2. If the keystone package is also intalled on the system,
-    /etc/keystone.conf or /etc/keystone/keystone.conf have higher priority than <top_dir>/etc/keystone.conf.
-
-If you are also doing development on a system that has keystone.conf installed in /etc you may need to disambiguate it by providing the conf file in the command-line
-
-     $ bin/keystone-control --confg-file etc/keystone.conf  --pid-file <pidfile> auth <start|stop|restart>
-
-Path:
-keystone-control calls keystone-auth and it needs to be in the PATH
-
-     $ export PATH=<top_dir>/bin:$PATH
-
-
 RUNNING KEYSTONE:
 -----------------
 
-    $ cd bin
-    $ ./keystone-auth
+Starting both Admin and Service API endpoints:
 
+    $ cd bin
+    $ ./keystone
 
-RUNNING KEYSTONE FOR DEVELOPMENT (HACKING):
-------------------------------
-
-During  development, you can simply run as user (root not needed)
-
-From the top Keystone directory (<topdir>)
+Starting the auth server only (exposes the Service API):
 
-     $ bin/keystone=auth
+    $ cd bin
+    $ ./keystone-auth
 
-It dumps stdout and stderr onto the terminal.
+Starting the admin server only (exposes the Admin API):
 
-If you want to specify additional parameters (optional):
+    $ cd bin
+    $ ./keystone-admin
 
-     $ bin/keystone-control --pid-file <pidfile>  --config-file etc/keystone.conf auth <start|stop|restart>
+All above files take parameters from etc/keystone.conf file under the Keystone root folder by default
 
-RUNNING KEYSTONE AS ROOT IN PRODUCTION
---------------------------------------
-In production, stdout and stderr need to be closed and all the output needs to be redirected to a log file.
-Once the package is installed through setup tools, RPM, deb, or ebuild keystone-control is installed as /usr/sbin/keystone-control. Typically, it will be started a script in /etc/init.d/keystoned
 
-keystone-control can invoke keystone-auth and start the keystone daemon with 
 
-     $ /usr/sbin/keystone-control auth start
+DEPENDENCIES:
+-------------
+See pip-requires for dependency list. The list of dependencies should not add to what already is needed to run other OpenStack services.
 
-It writes the process id of the daemon into /var/run/keystone/keystine-auth.pid.
-The daemon can be stopped with
- 
-     $ /usr/sbin/keystone-control auth stop
+Setup:
 
-keystone-control has the infrastructure to start and stop multiple servers keystone-xxx  
+    # Install http://pypi.python.org/pypi/setuptools
+    sudo easy_install pip
+    sudo pip install -r pip-requires
 
 
-RUNNING TEST SERVICE:
----------------------
+RUNNING THE TEST SERVICE (Echo.py):
+----------------------------------
 
     Standalone stack (with Auth_Token)
     $ cd echo/bin
@@ -103,39 +70,43 @@ RUNNING TEST SERVICE:
 
     in separate session
     $ cd keystone/auth_protocols
-    $ python auth_token.py --remote
+    $ python auth_token.py
 
 
 DEMO CLIENT:
----------------------
+------------
+A sample client that gets a token from Keystone and then uses it to call Echo (and a few other example calls):
+
     $ cd echo/echo
     $ python echo_client.py
-    Note: this requires tests data. See section TESTING for initializing data
+    Note: this requires test data. See section TESTING for initializing data
 
 
-TESTING
--------
 
-After starting keystone a keystone.db sqlite database should be created in the keystone folder.
+TESTING:
+--------
+A set of sample data can be added by running a shell script:
 
-Add test data to the database:
+    $ ./bin/sampledata.sh
 
-    $ sqlite3 bin/keystone.db < test/test_setup.sql
+The script calls keystone-manage to create the sample data.
 
-To clean the test database
+After starting keystone or running keystone-manage a keystone.db sqlite database should be created in the keystone folder.
 
-    $ sqlite3 bin/keystone.db < test/kill.sql
 
 To run client demo (with all auth middleware running locally on sample service):
 
     $ ./echo/bin/echod
     $ python echo/echo/echo_client.py
 
+NOTE: NOT ALL TESTS CONVERTED TO NEW MODEL YET. MANY FAIL. THIS WILL BE ADDRESSED SOON.
+
 To run unit tests:
+
 * go to unit test/unit directory
 * run tests: python test_keystone
 
-There are 8 groups of tests. They can be run individually or as an entire colection. To run the entire test suite run
+There are 10 groups of tests. They can be run individually or as an entire colection. To run the entire test suite run
 
     $ python test_keystone.py
 
@@ -150,12 +121,49 @@ For more on unit testing please refer
 
 To perform contract validation and load testing, use SoapUI (for now).
 
+
 Using SOAPUI:
 
-Download [SOAPUI](http://sourceforge.net/projects/soapui/files/):
+First, download [SOAPUI](http://sourceforge.net/projects/soapui/files/):
 
 To Test Keystone Service:
 
 * File->Import Project
 * Select tests/IdentitySOAPUI.xml
 * Double click on "Keystone Tests" and press the green play (>) button
+
+
+ADDITIONAL INFORMATION:
+-----------------------
+
+Configuration:
+Keystone gets its configuration from command-line parameters or a .conf file. The file can be provided explicitely
+on the command line otherwise the following logic applies (the conf file in use will be output to help
+in troubleshooting:
+
+1. config.py takes the config file from <topdir>/etc/keystone.conf
+2. If the keystone package is also intalled on the system,
+    /etc/keystone.conf or /etc/keystone/keystone.conf have higher priority than <top_dir>/etc/keystone.conf.
+
+CURL commands:
+
+curl -d '{"passwordCredentials": {"username": "joeuser", "password": "secrete"}}' -H "Content-type: application/json" http://localhost:8081/v2.0/token
+curl -d '{"passwordCredentials": {"username": "joeuser", "password": "secrete", "tenant": "1234"}}' -H "Content-type: application/json" http://localhost:8081/v2.0/token
+
+NOVA Integration:
+-----------------
+
+Initial support for using keystone as nova's identity component has been started.
+
+    # clone projects
+    bzr clone lp:nova
+    git clone git://github.com/khussein/keystone.git
+
+    # copy keystone librarys into nova
+    cp keystone/keystone/common/bufferedhttp.py nova/nova/auth/
+    cp keystone/keystone/auth_protocols/nova_auth_token.py nova/nova/auth/
+
+    # copy paste config to use nova_auth_token.py
+    cp keystone/docs/nova-api-paste.ini nova/etc/nova/api-paste.ini
+
+Assuming you added the test_sql, you can then use joeuser/secrete
diff --git a/bin/keystone b/bin/keystone
index 45693a3f..1afebe8b 100755
--- a/bin/keystone
+++ b/bin/keystone
@@ -1,196 +1,83 @@
 #!/usr/bin/env python
 # vim: tabstop=4 shiftwidth=4 softtabstop=4
 
-# Copyright (c) 2011 OpenStack, LLC.
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# Copyright 2011 OpenStack LLC.
+# All Rights Reserved.
 #
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
 #
-#    http://www.apache.org/licenses/LICENSE-2.0
+#         http://www.apache.org/licenses/LICENSE-2.0
 #
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-# implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
 
 """
-Helper script for starting/stopping/reloading OpenStack server programs.
-Code copied from swift. Should eventually come from common.
+Keystone Identity Server - Admin and Service API
 """
 
-from __future__ import with_statement
-
-import errno
-import os
 import optparse
-import resource
-import signal
+import os
 import sys
-import time
+import tools.tracer   #load this first
 
+# If ../../keystone/__init__.py exists, add ../ to Python search path, so that
+# it will override what happens to be installed in /usr/(local/)lib/python...
 possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
                                    os.pardir,
-                                   os.pardir,
                                    os.pardir))
 if os.path.exists(os.path.join(possible_topdir, 'keystone', '__init__.py')):
     sys.path.insert(0, possible_topdir)
 
-from keystone import version
+import keystone
 from keystone.common import config
-ALL_COMMANDS = ['start', 'stop', 'restart']
-
-MAX_DESCRIPTORS = 32768
-MAX_MEMORY = (1024 * 1024 * 1024) * 1  # 2 GB
-USAGE = """%prog [options] keystone <COMMAND> [CONFPATH]
-
-And command is one of:
-
-    start, stop,  restart
-
-And CONFPATH is the optional configuration file to use."""
-
-
-def pid_files(server, options):
-    pid_files = []
-    if options['pid_file']:
-        if os.path.exists(os.path.abspath(options['pid_file'])):
-            pid_files = [os.path.abspath(options['pid_file'])]
-    else:
-        if os.path.exists('/var/run/keystone/%s.pid' % server):
-            pid_files = ['/var/run/keystone/%s.pid' % server]
-    for pid_file in pid_files:
-        pid = int(open(pid_file).read().strip())
-        yield pid_file, pid
-
-
-def do_start(server, options, args):
-    for pid_file, pid in pid_files(server, options):
-        if os.path.exists('/proc/%s' % pid):
-            print "%s appears to already be running: %s" % (server, pid_file)
-            return
-        else:
-            print "Removing stale pid file %s" % pid_file
-            os.unlink(pid_file)
-
-    try:
-        resource.setrlimit(resource.RLIMIT_NOFILE,
-                (MAX_DESCRIPTORS, MAX_DESCRIPTORS))
-        resource.setrlimit(resource.RLIMIT_DATA,
-                (MAX_MEMORY, MAX_MEMORY))
-    except ValueError:
-        print "Unable to increase file descriptor limit.  Running as non-root?"
-    os.environ['PYTHON_EGG_CACHE'] = '/tmp'
-
-    def write_pid_file(pid_file, pid):
-        dir, file = os.path.split(pid_file)
-        if not os.path.exists(dir):
-            try:
-                os.makedirs(dir)
-            except OSError, err:
-                if err.errno == errno.EACCES:
-                    sys.exit('Unable to create %s.  Running as non-root?'
-                             % dir)
-        fp = open(pid_file, 'w')
-        fp.write('%d\n' % pid)
-        fp.close()
-
-    def launch(ini_file, pid_file):
-        args = [server, ini_file]
-        print 'Starting %s with %s' % (server, ini_file)
-
-        pid = os.fork()
-        if pid == 0:
-            os.setsid()
-            with open(os.devnull, 'r+b') as nullfile:
-                for desc in (0, 1, 2):  # close stdio
-                    try:
-                        os.dup2(nullfile.fileno(), desc)
-                    except OSError:
-                        pass
-            try:
-                os.execlp('%s' % server, server, ini_file)
-            except OSError, e:
-                sys.exit('unable to launch %s. Got error: %s'
-                         % (server, str(e)))
-            sys.exit(0)
-        else:
-            write_pid_file(pid_file, pid)
-
-    if not options['pid_file']:
-        pid_file = '/var/run/keystone/%s.pid' % server
-    else:
-        pid_file = os.path.abspath(options['pid_file'])
-    conf_file = config.find_config_file(options, args)
-    if not conf_file:
-        sys.exit("Could not find any configuration file to use!")
-    launch_args = [(conf_file, pid_file)]
-
-    # start all servers
-    for conf_file, pid_file in launch_args:
-        launch(conf_file, pid_file)
-
-
-def do_stop(server, options, args, graceful=False):
-    if graceful and server in GRACEFUL_SHUTDOWN_SERVERS:
-        sig = signal.SIGHUP
-    else:
-        sig = signal.SIGTERM
-
-    did_anything = False
-    pfiles = pid_files(server, options)
-    for pid_file, pid in pfiles:
-        did_anything = True
-        try:
-            print 'Stopping %s  pid: %s  signal: %s' % (server, pid, sig)
-            os.kill(pid, sig)
-        except OSError:
-            print "Process %d not running" % pid
-        try:
-            os.unlink(pid_file)
-        except OSError:
-            pass
-    for pid_file, pid in pfiles:
-        for _junk in xrange(150):  # 15 seconds
-            if not os.path.exists('/proc/%s' % pid):
-                break
-            time.sleep(0.1)
-        else:
-            print 'Waited 15 seconds for pid %s (%s) to die; giving up' % \
-                  (pid, pid_file)
-    if not did_anything:
-        print 'No %s running' % server
+from keystone.common import wsgi
 
 
 if __name__ == '__main__':
-    oparser = optparse.OptionParser(usage=USAGE, version='%%prog %s'
-                                    % version.version_string())
-    oparser.add_option('--pid-file', default=None, metavar="PATH",
-                       help="File to use as pid file. Default: "
-                       "/var/run/keysonte/keystone.pid")
-    config.add_common_options(oparser)
-    (options, args) = config.parse_options(oparser)
-
-    if len(args) < 1:
-        oparser.print_usage()
-        sys.exit(1)
-
-    server = 'keystone'
-    command = args.pop(0).lower()
-    if command not in ALL_COMMANDS:
-        command_list = ", ".join(ALL_COMMANDS)
-        msg = ("Unknown command %(command)s specified. Please specify a "
-               "command in this list: %(command_list)s" % locals())
-        sys.exit(msg)
-
-    if command == 'start':
-        do_start(server, options, args)
-
-    if command == 'stop':
-        do_stop(server, options, args)
-
-    if command == 'restart':
-        do_stop(server, options, args)
-        do_start(server, options, args)
+    # Initialize a parser for our configuration paramaters
+    parser = optparse.OptionParser(version='%%prog %s' % keystone.version)
+    common_group = config.add_common_options(parser)
+    config.add_log_options(parser)
+
+    # Handle a special argument to support starting two endpoints
+    common_group.add_option('-a', '--admin-port', default=8081,
+                            dest="admin_port", metavar="PORT",
+                     help = "specifies port for Admin API to listen"
+                            "on (default is 8080)")
+
+    # Parse arguments and load config
+    (options, args) = config.parse_options(parser)
+    config_file = config.find_config_file(options, args)
+    print "Using config file:", config_file
+
+    # Start services
+    try:
+        # Load Service API server
+        conf, app = config.load_paste_app('server', options, args)
+        server = wsgi.Server()
+        server.start(app, int(conf['bind_port']), conf['bind_host'])
+        print "Service API listening on %s:%s" % (conf['bind_host'],
+                                              conf['bind_port'])
+
+        # Load Admin API server
+        admin_conf, admin_app = config.load_paste_app('admin', options, args)
+        admin_server = wsgi.Server()
+        admin_bind = options.get('admin_port') or admin_conf.get('bind_port')
+        if conf['bind_port'] == admin_bind:
+            admin_bind += 1
+        admin_server.start(admin_app, int(admin_bind),
+                           admin_conf['bind_host'])
+        print "Admin API listening on %s:%s" % (admin_conf['bind_host'],
+                                              admin_bind)
+
+        # Wait until done
+        server.wait()
+    except RuntimeError, e:
+        sys.exit("ERROR: %s" % e)
diff --git a/bin/keystone-admin b/bin/keystone-admin
new file mode 100755
index 00000000..11442673
--- /dev/null
+++ b/bin/keystone-admin
@@ -0,0 +1,65 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# Copyright 2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+Keystone Identity Server - Admin API
+"""
+
+import optparse
+import os
+import sys
+import tools.tracer   #load this first
+
+# If ../../keystone/__init__.py exists, add ../ to Python search path, so that
+# it will override what happens to be installed in /usr/(local/)lib/python...
+possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
+                                   os.pardir,
+                                   os.pardir))
+if os.path.exists(os.path.join(possible_topdir, 'keystone', '__init__.py')):
+    sys.path.insert(0, possible_topdir)
+
+import keystone
+from keystone.common import config
+from keystone.common import wsgi
+
+
+if __name__ == '__main__':
+    # Initialize a parser for our configuration paramaters
+    parser = optparse.OptionParser(version='%%prog %s' % keystone.version)
+    common_group = config.add_common_options(parser)
+    config.add_log_options(parser)
+
+    # Parse arguments and load config
+    (options, args) = config.parse_options(parser)
+    config_file = config.find_config_file(options, args)
+    print "Using config file:", config_file
+
+    # Start services
+    try:
+        # Load Admin API server
+        conf, app = config.load_paste_app('admin', options, args)
+        server = wsgi.Server()
+        server.start(app, int(conf['bind_port']), conf['bind_host'])
+        print "Admin API listening on %s:%s" % (conf['bind_host'],
+                                              conf['bind_port'])
+
+        server.wait()
+    except RuntimeError, e:
+        sys.exit("ERROR: %s" % e)
diff --git a/bin/keystone-auth b/bin/keystone-auth
index 8dc71aaa..3e59d3e8 100755
--- a/bin/keystone-auth
+++ b/bin/keystone-auth
@@ -19,12 +19,13 @@
 #    under the License.
 
 """
-Keystone API Server
+Keystone Identity Server - Service API
 """
 
 import optparse
 import os
 import sys
+import tools.tracer   #load this first
 
 # If ../../keystone/__init__.py exists, add ../ to Python search path, so that
 # it will override what happens to be installed in /usr/(local/)lib/python...
@@ -34,33 +35,29 @@ possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
 if os.path.exists(os.path.join(possible_topdir, 'keystone', '__init__.py')):
     sys.path.insert(0, possible_topdir)
 
-from keystone import  version
+import keystone
 from keystone.common import config
 from keystone.common import wsgi
 
 
-def create_options(parser):
-    """
-    Sets up the CLI and config-file options that may be
-    parsed and program commands.
-
-    :param parser: The option parser
-    """
-    config.add_common_options(parser)
+if __name__ == '__main__':
+    # Initialize a parser for our configuration paramaters
+    parser = optparse.OptionParser(version='%%prog %s' % keystone.version)
+    common_group = config.add_common_options(parser)
     config.add_log_options(parser)
 
+    # Parse arguments and load config
+    (options, args) = config.parse_options(parser)
+    config_file = config.find_config_file(options, args)
+    print "Using config file:", config_file
 
-if __name__ == '__main__':
-    oparser = optparse.OptionParser(version='%%prog %s'
-                                    % version.version_string())
-    create_options(oparser)
-    (options, args) = config.parse_options(oparser)
-
+    # Start services
     try:
+        # Load Service API server
         conf, app = config.load_paste_app('server', options, args)
         server = wsgi.Server()
         server.start(app, int(conf['bind_port']), conf['bind_host'])
-        print "Server listening on %s:%s" % (conf['bind_host'],
+        print "Service API listening on %s:%s" % (conf['bind_host'],
                                               conf['bind_port'])
         server.wait()
     except RuntimeError, e:
diff --git a/bin/keystone-control b/bin/keystone-control
deleted file mode 100755
index 3061f0c8..00000000
--- a/bin/keystone-control
+++ /dev/null
@@ -1,225 +0,0 @@
-#!/usr/bin/env python
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright (c) 2011 OpenStack, LLC.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-# implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-"""
-Helper script for starting/stopping/reloading Keystone server programs.
-Thanks for some of the code, Swifties ;)
-"""
-
-from __future__ import with_statement
-
-import errno
-import os
-import optparse
-import resource
-import signal
-import sys
-import time
-
-# If ../keystone/__init__.py exists, add ../ to Python search path, so that
-# it will override what happens to be installed in /usr/(local/)lib/python...
-possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
-                                   os.pardir,
-                                   os.pardir))
-if os.path.exists(os.path.join(possible_topdir, 'keystone', '__init__.py')):
-    sys.path.insert(0, possible_topdir)
-
-from keystone import version
-from keystone.common import config
-
-ALL_COMMANDS = ['start', 'stop', 'shutdown', 'restart',
-                'reload', 'force-reload']
-ALL_SERVERS = ['keystone-auth']
-GRACEFUL_SHUTDOWN_SERVERS = ['keystone-auth']
-MAX_DESCRIPTORS = 32768
-MAX_MEMORY = (1024 * 1024 * 1024) * 2  # 2 GB
-USAGE = """%prog [options] <SERVER> <COMMAND> [CONFPATH]
-
-Where <SERVER> is one of:
-
-    all, auth
-
-And command is one of:
-
-    start, stop, shutdown, restart, reload, force-reload
-
-And CONFPATH is the optional configuration file to use."""
-
-
-def pid_files(server, options):
-    pid_files = []
-    if options['pid_file']:
-        if os.path.exists(os.path.abspath(options['pid_file'])):
-            pid_files = [os.path.abspath(options['pid_file'])]
-    else:
-        if os.path.exists('/var/run/keystone/%s.pid' % server):
-            pid_files = ['/var/run/keystone/%s.pid' % server]
-    for pid_file in pid_files:
-        pid = int(open(pid_file).read().strip())
-        yield pid_file, pid
-
-
-def do_start(server, options, args):
-    server_type = '-'.join(server.split('-')[:-1])
-
-    for pid_file, pid in pid_files(server, options):
-        if os.path.exists('/proc/%s' % pid):
-            print "%s appears to already be running: %s" % (server, pid_file)
-            return
-        else:
-            print "Removing stale pid file %s" % pid_file
-            os.unlink(pid_file)
-
-    os.environ['PYTHON_EGG_CACHE'] = '/tmp'
-
-    def write_pid_file(pid_file, pid):
-        dir, file = os.path.split(pid_file)
-        if not os.path.exists(dir):
-            try:
-                os.makedirs(dir)
-            except OSError, err:
-                if err.errno == errno.EACCES:
-                    sys.exit('Unable to create %s.  Running as non-root?'
-                             % dir)
-        fp = open(pid_file, 'w')
-        fp.write('%d\n' % pid)
-        fp.close()
-
-    def launch(ini_file, pid_file):
-        args = [server, ini_file]
-        print 'Starting %s with %s' % (server, ini_file)
-
-        pid = os.fork()
-        if pid == 0:
-            os.setsid()
-            with open(os.devnull, 'r+b') as nullfile:
-                for desc in (0, 1, 2):  # close stdio
-                    try:
-                        os.dup2(nullfile.fileno(), desc)
-                    except OSError:
-                        pass
-            try:
-                os.execlp('%s' % server, server, ini_file)
-            except OSError, e:
-                sys.exit('unable to launch %s. Got error: %s'
-                         % (server, str(e)))
-            sys.exit(0)
-        else:
-            write_pid_file(pid_file, pid)
-
-    if not options['pid_file']:
-        pid_file = '/var/run/keystone/%s.pid' % server
-    else:
-        pid_file = os.path.abspath(options['pid_file'])
-    conf_file = config.find_config_file(options, args)
-    if not conf_file:
-        sys.exit("Could not find any configuration file to use!")
-    launch_args = [(conf_file, pid_file)]
-
-    # start all servers
-    for conf_file, pid_file in launch_args:
-        launch(conf_file, pid_file)
-
-
-def do_stop(server, options, args, graceful=False):
-    if graceful and server in GRACEFUL_SHUTDOWN_SERVERS:
-        sig = signal.SIGHUP
-    else:
-        sig = signal.SIGTERM
-
-    did_anything = False
-    pfiles = pid_files(server, options)
-    for pid_file, pid in pfiles:
-        did_anything = True
-        try:
-            print 'Stopping %s  pid: %s  signal: %s' % (server, pid, sig)
-            os.kill(pid, sig)
-        except OSError:
-            print "Process %d not running" % pid
-        try:
-            os.unlink(pid_file)
-        except OSError:
-            pass
-    for pid_file, pid in pfiles:
-        for _junk in xrange(150):  # 15 seconds
-            if not os.path.exists('/proc/%s' % pid):
-                break
-            time.sleep(0.1)
-        else:
-            print 'Waited 15 seconds for pid %s (%s) to die; giving up' % \
-                  (pid, pid_file)
-    if not did_anything:
-        print 'No %s running' % server
-
-
-if __name__ == '__main__':
-    oparser = optparse.OptionParser(usage=USAGE, version='%%prog %s'
-                                    % version.version_string())
-    oparser.add_option('--pid-file', default=None, metavar="PATH",
-                       help="File to use as pid file. Default: "
-                       "/var/run/keystone/$server.pid")
-    config.add_common_options(oparser)
-    (options, args) = config.parse_options(oparser)
-
-    if len(args) < 2:
-        oparser.print_usage()
-        sys.exit(1)
-
-    server = args.pop(0).lower()
-    if server == 'all':
-        servers = ALL_SERVERS
-    else:
-        if not server.startswith('keystone-'):
-            server = 'keystone-%s' % server
-        if server not in ALL_SERVERS:
-            server_list = ", ".join([s.replace('keystone-', '')
-                                     for s in ALL_SERVERS])
-            msg = ("Unknown server '%(server)s' specified. Please specify "
-                   "all, or one of the servers: %(server_list)s" % locals())
-            sys.exit(msg)
-        servers = [server]
-
-    command = args.pop(0).lower()
-    if command not in ALL_COMMANDS:
-        command_list = ", ".join(ALL_COMMANDS)
-        msg = ("Unknown command %(command)s specified. Please specify a "
-               "command in this list: %(command_list)s" % locals())
-        sys.exit(msg)
-
-    if command == 'start':
-        for server in servers:
-            do_start(server, options, args)
-
-    if command == 'stop':
-        for server in servers:
-            do_stop(server, options, args)
-
-    if command == 'shutdown':
-        for server in servers:
-            do_stop(server, options, args, graceful=True)
-
-    if command == 'restart':
-        for server in servers:
-            do_stop(server, options, args)
-        for server in servers:
-            do_start(server, options, args)
-
-    if command == 'reload' or command == 'force-reload':
-        for server in servers:
-            do_stop(server, options, args, graceful=True)
-            do_start(server, options, args)
diff --git a/bin/keystone-manage b/bin/keystone-manage
new file mode 100755
index 00000000..2d5aecea
--- /dev/null
+++ b/bin/keystone-manage
@@ -0,0 +1,280 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# Copyright 2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+Keystone Identity Server - CLI Management Interface
+"""
+
+import datetime
+import optparse
+import os
+import sys
+import tools.tracer
+
+# If ../../keystone/__init__.py exists, add ../ to Python search path, so that
+# it will override what happens to be installed in /usr/(local/)lib/python...
+possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
+                                   os.pardir,
+                                   os.pardir))
+if os.path.exists(os.path.join(possible_topdir, 'keystone', '__init__.py')):
+    sys.path.insert(0, possible_topdir)
+
+import keystone
+from keystone.common import config
+import keystone.db.sqlalchemy.api as db_api
+import keystone.db.sqlalchemy.models as db_models
+
+
+def Main():
+    """
+    Usage: keystone-manage [options] type command [id [attributes]]
+      type       : role, tenant, user, token (more to come)
+      command    : add, list, disable (more to come)
+      id         : name or id
+      attributes : depending on type...
+        users    : password, tenant
+        tokens   : user, tenant, expiration
+    
+    options
+      -c | --config-file : config file to use
+      -d | --debug : debug mode
+    
+    Example: keystone-manage add user Admin P@ssw0rd
+    """
+    usage = "usage: %prog [options] type command [id [attributes]]"
+
+    # Initialize a parser for our configuration paramaters
+    parser = optparse.OptionParser(usage, version='%%prog %s'
+                                   % keystone.version())
+    common_group = config.add_common_options(parser)
+    config.add_log_options(parser)
+
+    # Parse command-line and load config
+    (options, args) = config.parse_options(parser)
+    config_file, conf = config.load_paste_config('admin', options, args)
+
+    # Check arguments
+    if len(args) == 0:
+        parser.error('No object type specified for first argument')
+
+    object_type = args[0]
+    if object_type in ['user', 'tenant', 'role', 'token']:
+        pass
+    else:
+        parser.error('%s is not a supported object type' % object_type)
+    
+    if len(args) == 1:
+        parser.error('No command specified for second argument')
+    command = args[1]
+    if command in ['add', 'list', 'disable', 'delete', 'grant', 'revoke']:
+        pass
+    else:
+        parser.error('add, disable, delete, and list are the only supported"\
+                     " commands (right now)')
+    
+    if len(args) == 2:
+        if command != 'list':
+            parser.error('No id specified for third argument')
+    if len(args) > 2:
+        object_id = args[2]
+
+    # Set things up to run the command
+    print "Config file in use: %s" % config_file
+    config.setup_logging(options, conf)
+    
+    db_api.configure_db(conf)
+
+    if object_type == "user":
+        if command == "add":
+            if len(args) < 4:
+                parser.error('No password specified for fourth argument')
+            password = args[3]
+    
+            try:
+                object = db_models.User()
+                object.id = object_id
+                object.password = password
+                object.enabled = True
+                if len(args) > 4:
+                    tenant = args[4]
+                    object.tenant_id = tenant
+                db_api.user_create(object)
+                print "User created successfully. ID=%s" % object.id
+            except Exception as exc:
+                print "ERROR: Failed to create user: %s" % exc
+            return
+        elif command == "disable":
+            try:
+                object = db_api.user_get(object_id)
+                if object == None:
+                    raise IndexError("User %s not found" % object_id)
+                object.enabled = False
+                db_api.user_update(object_id, object)
+                print "User disabled: %s" % object.id
+            except Exception as exc:
+                print "ERROR: Failed to disable user: %s" % exc
+            return
+        elif command == "list":
+            try:
+                if len(args) > 2:
+                    tenant = args[2]
+                    objects = db_api.user_get_by_tenant(tenant)
+                    if objects == None:
+                        raise IndexError("Users not found")
+                    print 'id', 'enabled'
+                    print '-' * 20
+                    for row in objects:
+                        print row.id, row.enabled
+                else:
+                    objects = db_api.user_get_all()
+                    if objects == None:
+                        raise IndexError("Users not found")
+                    print 'id', 'enabled', 'tenant'
+                    print '-' * 20
+                    for row in objects:
+                        print row.id, row.enabled, row.tenant_id
+            except Exception, e:
+                print 'Error getting all users:', str(e)
+            return
+    elif object_type == "tenant":
+        if command == "add":
+            try:
+                object = db_models.Tenant()
+                object.id = object_id
+                object.enabled = True
+                db_api.tenant_create(object)
+                print "Tenant created successfully. ID=%s" % object.id
+                return
+            except Exception as exc:
+                print "ERROR: Failed to create tenant: %s" % exc
+                return
+        elif command == "list":
+            try:
+                objects = db_api.tenant_get_all()
+                if objects == None:
+                    raise IndexError("Tenants not found")
+                print 'tenant', 'enabled'
+                print '-' * 20
+                for row in objects:
+                    print row.id, row.enabled
+            except Exception, e:
+                print 'Error getting all users:', str(e)
+            return
+        elif command == "disable":
+            try:
+                object = db_api.tenant_get(object_id)
+                if object == None:
+                    raise IndexError("Tenant %s not found" % object_id)
+                object.enabled = False
+                db_api.tenant_update(object_id, object)
+                print "Tenant disabled: %s" % object.id
+            except Exception as exc:
+                print "ERROR: Failed to disable tenant: %s" % exc
+            return
+    elif object_type == "role":
+        if command == "add":
+            try:
+                object = db_models.Role()
+                object.id = object_id
+                db_api.role_create(object)
+                print "Role created successfully. ID=%s" % object.id
+                return
+            except Exception as exc:
+                print "ERROR: Failed to create role: %s" % exc
+                return
+        elif command == "list":
+            try:
+                objects = db_api.role_get_all()
+                if objects == None:
+                    raise IndexError("Roles not found")
+                print 'role'
+                print '-' * 20
+                for row in objects:
+                    print row.id
+            except Exception, e:
+                print 'Error getting all roles:', str(e)
+            return
+        elif command == "grant":
+            if len(args) < 5:
+                parser.error("Missing arguments: role grant 'role' 'user'"\
+                            "'tenant'")
+            user = args[3]
+            tenant = args[4]
+            try:
+                object = db_models.UserRoleAssociation()
+                object.role_id = object_id
+                object.user_id = user
+                object.tenant_id = tenant
+                db_api.user_role_add(object)
+                print "Successfully granted %s the %s role on %s" %\
+                        (object.user_id, object.role_id, object.tenant_id)
+            except Exception as exc:
+                print "ERROR: Failed to grant role: %s" % exc
+            return
+    elif object_type == "token":
+        if command == "add":
+            if len(args) < 6:
+                parser.error('Creating a token requires a token id, user'\
+                             ', tenant, and expiration')
+            try:
+                object = db_models.Token()
+                object.token_id = object_id
+                object.user_id = args[3]
+                object.tenant_id = args[4]
+                tuple_time = datetime.datetime.strptime(args[5]
+                                                        .replace("-", ""),
+                                                        "%Y%m%dT%H:%M")
+                object.expires = tuple_time
+                db_api.token_create(object)
+                print "Token created successfully. ID=%s" % object.token_id
+                return
+            except Exception as exc:
+                print "ERROR: Failed to create token: %s" % exc
+                return
+        elif command == "list":
+            try:
+                objects = db_api.token_get_all()
+                if objects == None:
+                    raise IndexError("Tokens not found")
+                print 'token', 'user', 'expiration', 'tenant'
+                print '-' * 20
+                for row in objects:
+                    print row.token_id, row.user_id, row.expires, row.tenant_id
+            except Exception, e:
+                print 'Error getting all tokens:', str(e)
+            return
+        elif command == "delete":
+            try:
+                object = db_api.token_get(object_id)
+                if object == None:
+                    raise IndexError("Token %s not found" % object_id)
+                else:
+                    db_api.token_delete(object_id)
+                    print 'Token %s deleted' % object_id
+            except Exception, e:
+                print 'Error deleting token %s:' % object_id, str(e)
+            return
+
+    # Command not handled
+    print ("Fail: %s %s not yet supported" % (object_type, command))
+
+
+if __name__ == '__main__':
+    Main()
diff --git a/bin/sampledata.sh b/bin/sampledata.sh
new file mode 100755
index 00000000..c4102332
--- /dev/null
+++ b/bin/sampledata.sh
@@ -0,0 +1,51 @@
+#!/bin/bash
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# Copyright 2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+# Tenants
+./keystone-manage tenant add 1234
+./keystone-manage tenant add 0000
+./keystone-manage tenant disable 0000
+
+# Users
+./keystone-manage user add joeuser secrete 1234
+./keystone-manage user add admin secrete 1234
+./keystone-manage user add disabled secrete 1234
+./keystone-manage user disable disabled
+
+# Roles
+./keystone-manage role add Admin
+./keystone-manage role add Admin admin 1234
+
+
+# Groups
+#./keystone-manage group add Admin 1234
+#./keystone-manage group add Default 1234
+#./keystone-manage group add Empty 0000
+
+# User Group Associations
+#./keystone-manage user joeuser join Default
+#./keystone-manage user disabled join Default
+#./keystone-manage user admin join Admin
+
+# Tokens
+./keystone-manage token add 887665443383838 joeuser 1234 2012-02-05T00:00
+./keystone-manage token add 999888777666 admin 1234 2015-02-05T00:00
+./keystone-manage token add 000999 admin 1234 2010-02-05T00:00
+./keystone-manage token add 999888777 disabled 1234 2015-02-05T00:00
diff --git a/docs/nova-api-paste.ini b/docs/nova-api-paste.ini
new file mode 100644
index 00000000..e1c26a24
--- /dev/null
+++ b/docs/nova-api-paste.ini
@@ -0,0 +1,114 @@
+#######
+# EC2 #
+#######
+
+[composite:ec2]
+use = egg:Paste#urlmap
+/: ec2versions
+/services/Cloud: ec2cloud
+/services/Admin: ec2admin
+/latest: ec2metadata
+/2007-01-19: ec2metadata
+/2007-03-01: ec2metadata
+/2007-08-29: ec2metadata
+/2007-10-10: ec2metadata
+/2007-12-15: ec2metadata
+/2008-02-01: ec2metadata
+/2008-09-01: ec2metadata
+/2009-04-04: ec2metadata
+/1.0: ec2metadata
+
+[pipeline:ec2cloud]
+pipeline = logrequest authenticate cloudrequest authorizer ec2executor
+#pipeline = logrequest ec2lockout authenticate cloudrequest authorizer ec2executor
+
+[pipeline:ec2admin]
+pipeline = logrequest authenticate adminrequest authorizer ec2executor
+
+[pipeline:ec2metadata]
+pipeline = logrequest ec2md
+
+[pipeline:ec2versions]
+pipeline = logrequest ec2ver
+
+[filter:logrequest]
+paste.filter_factory = nova.api.ec2:RequestLogging.factory
+
+[filter:ec2lockout]
+paste.filter_factory = nova.api.ec2:Lockout.factory
+
+[filter:authenticate]
+paste.filter_factory = nova.api.ec2:Authenticate.factory
+
+[filter:cloudrequest]
+controller = nova.api.ec2.cloud.CloudController
+paste.filter_factory = nova.api.ec2:Requestify.factory
+
+[filter:adminrequest]
+controller = nova.api.ec2.admin.AdminController
+paste.filter_factory = nova.api.ec2:Requestify.factory
+
+[filter:authorizer]
+paste.filter_factory = nova.api.ec2:Authorizer.factory
+
+[app:ec2executor]
+paste.app_factory = nova.api.ec2:Executor.factory
+
+[app:ec2ver]
+paste.app_factory = nova.api.ec2:Versions.factory
+
+[app:ec2md]
+paste.app_factory = nova.api.ec2.metadatarequesthandler:MetadataRequestHandler.factory
+
+#############
+# Openstack #
+#############
+
+[composite:osapi]
+use = egg:Paste#urlmap
+/: osversions
+/v1.0: openstackapi10
+/v1.1: openstackapi11
+
+[pipeline:openstackapi10]
+pipeline = faultwrap tokenauth auth_shim ratelimit osapiapp10
+
+[pipeline:openstackapi11]
+pipeline = faultwrap tokenauth auth_shim ratelimit extensions osapiapp11
+
+[filter:faultwrap]
+paste.filter_factory = nova.api.openstack:FaultWrapper.factory
+
+[filter:auth]
+paste.filter_factory = nova.api.openstack.auth:AuthMiddleware.factory
+
+[filter:tokenauth]
+paste.filter_factory = nova.auth.nova_auth_token:filter_factory
+service_protocol = http
+service_host = 127.0.0.1
+service_port = 808
+auth_host = 127.0.0.1
+auth_port = 8081
+auth_protocol = http
+admin_token = 999888777666
+
+[filter:auth_shim]
+paste.filter_factory = nova.auth.nova_auth_token:KeystoneAuthShim.factory
+
+[filter:ratelimit]
+paste.filter_factory = nova.api.openstack.limits:RateLimitingMiddleware.factory
+
+[filter:extensions]
+paste.filter_factory = nova.api.openstack.extensions:ExtensionMiddleware.factory
+
+[app:osapiapp10]
+paste.app_factory = nova.api.openstack:APIRouterV10.factory
+
+[app:osapiapp11]
+paste.app_factory = nova.api.openstack:APIRouterV11.factory
+
+[pipeline:osversions]
+pipeline = faultwrap osversionapp
+
+[app:osversionapp]
+paste.app_factory = nova.api.openstack.versions:Versions.factory
diff --git a/echo/echo/echo.ini b/echo/echo/echo.ini
index b81174d0..a7b95e9e 100644
--- a/echo/echo/echo.ini
+++ b/echo/echo/echo.ini
@@ -6,7 +6,7 @@ delay_auth_decision = 0
 ;where to find the OpenStack service (if not in local WSGI chain)
 service_protocol = http
 service_host = 127.0.0.1
-service_port = 8090
+service_port = 8081
 ;used to verify this component with the OpenStack service (or PAPIAuth)
 service_pass = dTpw
 
@@ -20,17 +20,17 @@ pipeline =
     echo
 
 [filter:tokenauth]
-paste.filter_factory = keystone:tokenauth_factory
+paste.filter_factory = keystone.auth_protocols.auth_token:filter_factory
 ;where to find the token auth service
 auth_host = 127.0.0.1
-auth_port = 8080
+auth_port = 8081
 auth_protocol = http
 ;how to authenticate to the auth service for priviledged operations
 ;like validate token
 admin_token = 999888777666
 
 [filter:basicauth]
-paste.filter_factory = keystone:basicauth_factory
+paste.filter_factory = keystone.auth_protocols.auth_basic:filter_factory
 
 [filter:openidauth]
-paste.filter_factory = keystone:openidauth_factory
+paste.filter_factory = keystone.auth_protocols.auth_openid:filter_factory
diff --git a/echo/echo/echo_basic.ini b/echo/echo/echo_basic.ini
index 38da0c66..65c85357 100644
--- a/echo/echo/echo_basic.ini
+++ b/echo/echo/echo_basic.ini
@@ -6,7 +6,7 @@ delay_auth_decision = 0
 ;where to find the OpenStack service (if not in local WSGI chain)
 service_protocol = http
 service_host = 127.0.0.1
-service_port = 8090
+service_port = 8081
 ;used to verify this component with the OpenStack service (or PAPIAuth)
 service_pass = dTpw
 
@@ -20,17 +20,17 @@ pipeline =
     echo
 
 [filter:tokenauth]
-paste.filter_factory = keystone:tokenauth_factory
+paste.filter_factory = keystone.auth_protocols.auth_token:filter_factory
 ;where to find the token auth service
 auth_host = 127.0.0.1
-auth_port = 8080
+auth_port = 8081
 auth_protocol = http
 ;how to authenticate to the auth service for priviledged operations
 ;like validate token
 admin_token = 999888777666
 
 [filter:basicauth]
-paste.filter_factory = keystone:basicauth_factory
+paste.filter_factory = keystone.auth_protocols.auth_basic:filter_factory
 
 [filter:openidauth]
-paste.filter_factory = keystone:openidauth_factory
+paste.filter_factory = keystone.auth_protocols.auth_openid:filter_factory
diff --git a/echo/echo/echo_remote.ini b/echo/echo/echo_remote.ini
index c27b2365..d225f756 100644
--- a/echo/echo/echo_remote.ini
+++ b/echo/echo/echo_remote.ini
@@ -9,11 +9,11 @@ pipeline =
     echo
 
 [filter:remoteauth]
-paste.filter_factory = keystone:remoteauth_factory
+paste.filter_factory = keystone.middleware.remoteauth:filter_factory
 ;password which will tell us call is coming from a trusted auth proxy
 ; (otherwise we redirect call)
 remote_auth_pass = dTpw
 ;where to redirect untrusted calls to
-auth_location = http://127.0.0.1:8080/
+auth_location = http://127.0.0.1:8081/
 
 
diff --git a/echo/echo_client.py b/echo/echo_client.py
index a70d2a4a..ba835417 100644..100755
--- a/echo/echo_client.py
+++ b/echo/echo_client.py
@@ -1,3 +1,4 @@
+#!/usr/bin/env python
 # vim: tabstop=4 shiftwidth=4 softtabstop=4
 # Copyright (c) 2010-2011 OpenStack, LLC.
 #
@@ -31,6 +32,7 @@ def get_auth_token(username, password, tenant):
     conn.request("POST", "/v2.0/token", json.dumps(params), headers=headers)
     response = conn.getresponse()
     data = response.read()
+    print data
     ret = data
     return ret
 
diff --git a/etc/keystone.conf b/etc/keystone.conf
index 117b3eca..e9c59046 100644
--- a/etc/keystone.conf
+++ b/etc/keystone.conf
@@ -1,24 +1,15 @@
 [DEFAULT]
 # Show more verbose log output (sets INFO log level output)
-verbose = True
+verbose = False
 
 # Show debugging output in logs (sets DEBUG log level output)
-debug = True
-
-[app:server]
-paste.app_factory = keystone.server:app_factory
+debug = False
 
 # Which backend store should Keystone use by default.
 # Default: 'sqlite'
 # Available choices are 'sqlite' [future will include LDAP, PAM, etc]
 default_store = sqlite
 
-# Address to bind the API server
-bind_host = 0.0.0.0
-
-# Port the bind the API server to
-bind_port = 8080
-
 # Log to this file. Make sure you do not set the same log
 # file for both the API and registry servers!
 #
@@ -35,3 +26,21 @@ sql_connection = sqlite:///../keystone/keystone.db
 #
 sql_idle_timeout = 30
 
+[app:admin]
+paste.app_factory = keystone.server:admin_app_factory
+
+# Address to bind the Admin API server
+bind_host = 0.0.0.0
+
+# Port the bind the Admin API server to
+bind_port = 8081
+
+
+[app:server]
+paste.app_factory = keystone.server:app_factory
+
+# Address to bind the API server
+bind_host = 0.0.0.0
+
+# Port the bind the API server to
+bind_port = 8080
diff --git a/keystone/__init__.py b/keystone/__init__.py
index aec9d44f..b70c0009 100644
--- a/keystone/__init__.py
+++ b/keystone/__init__.py
@@ -1,3 +1,34 @@
+# Copyright (C) 2011 OpenStack LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+'''Main module for Keystone service. This installs the gettext function
+for all sub modules and packages.'''
+
+import gettext
+
+__version__ = '0.9'
+
+# This installs the _(...) function as a built-in so all other modules
+# don't need to.
+gettext.install('keystone')
+
+
+def version():
+    return __version__
+
+'''
+TODO(Ziad): Commenting out so we don't load this always - remove eventually
 #TOKEN AUTH
 from auth_protocols.auth_token \
         import filter_factory as tokenauth_factory
@@ -13,3 +44,4 @@ from auth_protocols.auth_openid \
 #Remote Auth handler
 from middleware.remoteauth \
         import filter_factory as remoteauth_factory
+'''
\ No newline at end of file
diff --git a/keystone/auth_protocols/auth_token.ini b/keystone/auth_protocols/auth_token.ini
index 3154fc69..25f2cbbf 100644
--- a/keystone/auth_protocols/auth_token.ini
+++ b/keystone/auth_protocols/auth_token.ini
@@ -5,7 +5,7 @@ paste.app_factory = auth_token:app_factory
 
 auth_protocol = http
 auth_host = 127.0.0.1
-auth_port = 8080
+auth_port = 8081
 admin_token = 999888777666
 
 delay_auth_decision = 0
diff --git a/keystone/auth_protocols/auth_token.py b/keystone/auth_protocols/auth_token.py
index 8fe519ca..4de54a55 100644
--- a/keystone/auth_protocols/auth_token.py
+++ b/keystone/auth_protocols/auth_token.py
@@ -165,8 +165,8 @@ class AuthProtocol(object):
                                            "Proxy %s" % claims['user'])
                     self._decorate_request('X_TENANT',
                                            claims['tenant'])
-                    self._decorate_request('X_GROUP',
-                                           claims['group'])
+                    if 'group' in claims:
+                        self._decorate_request('X_GROUP', claims['group'])
                     self.expanded = True
 
             #Send request downstream
@@ -262,11 +262,12 @@ class AuthProtocol(object):
 
         token_info = json.loads(data)
         #TODO(Ziad): make this more robust
-        first_group = token_info['auth']['user']['groups']['group'][0]
+        #first_group = token_info['auth']['user']['groups']['group'][0]
         verified_claims = {'user': token_info['auth']['user']['username'],
-                    'tenant': token_info['auth']['user']['tenantId'],
-                    'group': '%s/%s' % (first_group['id'],
-                                        first_group['tenantId'])}
+                    'tenant': token_info['auth']['user']['tenantId']}
+        # TODO(Ziad): removed groups for now
+        #            ,'group': '%s/%s' % (first_group['id'],
+        #                                first_group['tenantId'])}
         return verified_claims
 
     def _decorate_request(self, index, value):
diff --git a/keystone/auth_protocols/nova_auth_token.py b/keystone/auth_protocols/nova_auth_token.py
new file mode 100644
index 00000000..8cc51206
--- /dev/null
+++ b/keystone/auth_protocols/nova_auth_token.py
@@ -0,0 +1,363 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+#
+# Copyright (c) 2010-2011 OpenStack, LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+# Not Yet PEP8 standardized
+
+
+# FIXME(ja): fix "copy & paste ware"!
+#            determine how to integrate nova, dash, keystone
+
+"""
+TOKEN-BASED AUTH MIDDLEWARE
+
+This WSGI component performs multiple jobs:
+- it verifies that incoming client requests have valid tokens by verifying
+    tokens with the auth service.
+- it will reject unauthenticated requests UNLESS it is in 'delay_auth_decision'
+    mode, which means the final decision is delegated to the downstream WSGI
+    component (usually the OpenStack service)
+- it will collect and forward identity information from a valid token
+    such as user name, groups, etc...
+
+Refer to: http://wiki.openstack.org/openstack-authn
+
+
+HEADERS
+-------
+Headers starting with HTTP_ is a standard http header
+Headers starting with HTTP_X is an extended http header
+
+> Coming in from initial call from client or customer
+HTTP_X_AUTH_TOKEN   : the client token being passed in
+HTTP_X_STORAGE_TOKEN: the client token being passed in (legacy Rackspace use)
+                      to support cloud files
+> Used for communication between components
+www-authenticate    : only used if this component is being used remotely
+HTTP_AUTHORIZATION  : basic auth password used to validate the connection
+
+> What we add to the request for use by the OpenStack service
+HTTP_X_AUTHORIZATION: the client identity being passed in
+
+"""
+
+from bufferedhttp import http_connect_raw as http_connect
+import eventlet
+import httplib
+import json
+from nova import auth
+from nova import context
+from nova import flags
+from nova import utils
+from nova import wsgi
+import os
+from paste.deploy import loadapp
+import sys
+from urlparse import urlparse
+import webob.exc
+import webob.dec
+from webob.exc import HTTPUnauthorized, HTTPUseProxy
+from webob.exc import Request, Response
+
+FLAGS = flags.FLAGS
+
+PROTOCOL_NAME = "Token Authentication"
+
+
+class AuthProtocol(object):
+    """Auth Middleware that handles authenticating client calls"""
+
+    def _init_protocol_common(self, app, conf):
+        """ Common initialization code"""
+        print "Starting the %s component" % PROTOCOL_NAME
+
+        self.conf = conf
+        self.app = app
+        #if app is set, then we are in a WSGI pipeline and requests get passed
+        # on to app. If it is not set, this component should forward requests
+
+        # where to find the OpenStack service (if not in local WSGI chain)
+        # these settings are only used if this component is acting as a proxy
+        # and the OpenSTack service is running remotely
+        self.service_protocol = conf.get('service_protocol', 'https')
+        self.service_host = conf.get('service_host')
+        self.service_port = int(conf.get('service_port'))
+        self.service_url = '%s://%s:%s' % (self.service_protocol,
+                                           self.service_host,
+                                           self.service_port)
+        # used to verify this component with the OpenStack service or PAPIAuth
+        self.service_pass = conf.get('service_pass')
+
+        # delay_auth_decision means we still allow unauthenticated requests
+        # through and we let the downstream service make the final decision
+        self.delay_auth_decision = int(conf.get('delay_auth_decision', 0))
+
+    def _init_protocol(self, app, conf):
+        """ Protocol specific initialization """
+
+         # where to find the auth service (we use this to validate tokens)
+        self.auth_host = conf.get('auth_host')
+        self.auth_port = int(conf.get('auth_port'))
+        self.auth_protocol = conf.get('auth_protocol', 'https')
+        self.auth_location = "%s://%s:%s" % (self.auth_protocol,
+                                             self.auth_host,
+                                             self.auth_port)
+
+        # Credentials used to verify this component with the Auth service since
+        # validating tokens is a priviledged call
+        self.admin_token = conf.get('admin_token')
+
+    def __init__(self, app, conf):
+        """ Common initialization code """
+
+        #TODO(ziad): maybe we rafactor this into a superclass
+        self._init_protocol_common(app, conf)  # Applies to all protocols
+        self._init_protocol(app, conf)  # Specific to this protocol
+
+    def __call__(self, env, start_response):
+        """ Handle incoming request. Authenticate. And send downstream. """
+
+        self.start_response = start_response
+        self.env = env
+
+        #Prep headers to forward request to local or remote downstream service
+        self.proxy_headers = env.copy()
+        for header in self.proxy_headers.iterkeys():
+            if header[0:5] == 'HTTP_':
+                self.proxy_headers[header[5:]] = self.proxy_headers[header]
+                del self.proxy_headers[header]
+
+        #Look for authentication claims
+        self.claims = self._get_claims(env)
+        if not self.claims:
+            #No claim(s) provided
+            if self.delay_auth_decision:
+                #Configured to allow downstream service to make final decision.
+                #So mark status as Invalid and forward the request downstream
+                self._decorate_request("X_IDENTITY_STATUS", "Invalid")
+            else:
+                #Respond to client as appropriate for this auth protocol
+                return self._reject_request()
+        else:
+            # this request is presenting claims. Let's validate them
+            valid = self._validate_claims(self.claims)
+            if not valid:
+                # Keystone rejected claim
+                if self.delay_auth_decision:
+                    # Downstream service will receive call still and decide
+                    self._decorate_request("X_IDENTITY_STATUS", "Invalid")
+                else:
+                    #Respond to client as appropriate for this auth protocol
+                    return self._reject_claims()
+            else:
+                self._decorate_request("X_IDENTITY_STATUS", "Confirmed")
+
+            #Collect information about valid claims
+            if valid:
+                claims = self._expound_claims()
+                if claims:
+                    # TODO(Ziad): add additional details we may need,
+                    #             like tenant and group info
+                    self._decorate_request('X_AUTHORIZATION',
+                                           claims['user'])
+                    self._decorate_request('X_TENANT',
+                                           claims['tenant'])
+                    self._decorate_request('X_GROUP',
+                                           claims['group'])
+                    self.expanded = True
+
+            #Send request downstream
+            return self._forward_request()
+
+    def get_admin_auth_token(self, username, password, tenant):
+        """
+        This function gets an admin auth token to be used by this service to
+        validate a user's token. Validate_token is a priviledged call so
+        it needs to be authenticated by a service that is calling it
+        """
+        headers = {"Content-type": "application/json", "Accept": "text/json"}
+        params = {"passwordCredentials": {"username": username,
+                                          "password": password,
+                                          "tenantId": "1"}}
+        conn = httplib.HTTPConnection("%s:%s" \
+            % (self.auth_host, self.auth_port))
+        conn.request("POST", "/v2.0/token", json.dumps(params), \
+            headers=headers)
+        response = conn.getresponse()
+        data = response.read()
+        return data
+
+    def _get_claims(self, env):
+        claims = env.get('HTTP_X_AUTH_TOKEN', env.get('HTTP_X_STORAGE_TOKEN'))
+        return claims
+
+    def _reject_request(self):
+        # Redirect client to auth server
+        return HTTPUseProxy(location=self.auth_location)(self.env,
+            self.start_response)
+
+    def _reject_claims(self):
+        # Client sent bad claims
+        return HTTPUnauthorized()(self.env,
+            self.start_response)
+
+    def _validate_claims(self, claims):
+        """Validate claims, and provide identity information isf applicable """
+
+        # Step 1: We need to auth with the keystone service, so get an
+        # admin token
+        #TODO(ziad): Need to properly implement this, where to store creds
+        # for now using token from ini
+        #auth = self.get_admin_auth_token("admin", "secrete", "1")
+        #admin_token = json.loads(auth)["auth"]["token"]["id"]
+
+        # Step 2: validate the user's token with the auth service
+        # since this is a priviledged op,m we need to auth ourselves
+        # by using an admin token
+        headers = {"Content-type": "application/json",
+                    "Accept": "text/json",
+                    "X-Auth-Token": self.admin_token}
+                    ##TODO(ziad):we need to figure out how to auth to keystone
+                    #since validate_token is a priviledged call
+                    #Khaled's version uses creds to get a token
+                    # "X-Auth-Token": admin_token}
+                    # we're using a test token from the ini file for now
+        conn = http_connect(self.auth_host, self.auth_port, 'GET',
+                            '/v2.0/token/%s' % claims, headers=headers)
+        resp = conn.getresponse()
+        data = resp.read()
+        conn.close()
+
+        if not str(resp.status).startswith('20'):
+            # Keystone rejected claim
+            return False
+        else:
+            #TODO(Ziad): there is an optimization we can do here. We have just
+            #received data from Keystone that we can use instead of making
+            #another call in _expound_claims
+            return True
+
+    def _expound_claims(self):
+        # Valid token. Get user data and put it in to the call
+        # so the downstream service can use it
+        headers = {"Content-type": "application/json",
+                    "Accept": "text/json",
+                    "X-Auth-Token": self.admin_token}
+                    ##TODO(ziad):we need to figure out how to auth to keystone
+                    #since validate_token is a priviledged call
+                    #Khaled's version uses creds to get a token
+                    # "X-Auth-Token": admin_token}
+                    # we're using a test token from the ini file for now
+        conn = http_connect(self.auth_host, self.auth_port, 'GET',
+                            '/v2.0/token/%s' % self.claims, headers=headers)
+        resp = conn.getresponse()
+        data = resp.read()
+        conn.close()
+
+        if not str(resp.status).startswith('20'):
+            raise LookupError('Unable to locate claims: %s' % resp.status)
+
+        token_info = json.loads(data)
+        #TODO(Ziad): make this more robust
+        first_group = token_info['auth']['user']['groups']['group'][0]
+        verified_claims = {'user': token_info['auth']['user']['username'],
+                    'tenant': token_info['auth']['user']['tenantId'],
+                    'group': '%s/%s' % (first_group['id'],
+                                        first_group['tenantId'])}
+        return verified_claims
+
+    def _decorate_request(self, index, value):
+        self.proxy_headers[index] = value
+        self.env["HTTP_%s" % index] = value
+
+    def _forward_request(self):
+        #Token/Auth processed & claims added to headers
+        self._decorate_request('AUTHORIZATION',
+                                  "Basic %s" % self.service_pass)
+        #now decide how to pass on the call
+        if self.app:
+            # Pass to downstream WSGI component
+            return self.app(self.env, self.start_response)
+            #.custom_start_response)
+        else:
+            # We are forwarding to a remote service (no downstream WSGI app)
+            req = Request(self.proxy_headers)
+            parsed = urlparse(req.url)
+            conn = http_connect(self.service_host,
+                                self.service_port,
+                                req.method,
+                                parsed.path,
+                                self.proxy_headers,
+                                ssl=(self.service_protocol == 'https'))
+            resp = conn.getresponse()
+            data = resp.read()
+            #TODO(ziad): use a more sophisticated proxy
+            # we are rewriting the headers now
+            return Response(status=resp.status, body=data)(self.proxy_headers,
+                                                           self.start_response)
+
+
+class KeystoneAuthShim(wsgi.Middleware):
+    """Lazy provisioning nova project/users from keystone tenant/user"""
+
+    def __init__(self, application, db_driver=None):
+        if not db_driver:
+            db_driver = FLAGS.db_driver
+        self.db = utils.import_object(db_driver)
+        self.auth = auth.manager.AuthManager()
+        super(KeystoneAuthShim, self).__init__(application)
+
+    @webob.dec.wsgify(RequestClass=wsgi.Request)
+    def __call__(self, req):
+        user_id = req.headers['X_AUTHORIZATION']
+        try:
+            user_ref = self.auth.get_user(user_id)
+        except:
+            user_ref = self.auth.create_user(user_id)
+        project_id = req.headers['X_TENANT']
+        try:
+            project_ref = self.auth.get_project(project_id)
+        except:
+            project_ref = self.auth.create_project(project_id, user_id)
+
+        if not self.auth.is_project_member(user_id, project_id):
+            self.auth.add_to_project(user_id, project_id)
+
+        # groups = req.headers['X_GROUP']
+
+        req.environ['nova.context'] = context.RequestContext(user_ref, project_ref)
+        return self.application
+
+def filter_factory(global_conf, **local_conf):
+    """Returns a WSGI filter app for use with paste.deploy."""
+    conf = global_conf.copy()
+    conf.update(local_conf)
+
+    def auth_filter(app):
+        return AuthProtocol(app, conf)
+    return auth_filter
+
+
+def app_factory(global_conf, **local_conf):
+    conf = global_conf.copy()
+    conf.update(local_conf)
+    return AuthProtocol(None, conf)
+
+if __name__ == "__main__":
+    app = loadapp("config:" + \
+        os.path.join(os.path.abspath(os.path.dirname(__file__)),
+        "auth_token.ini"), global_conf={"log_name": "auth_token.log"})
+    wsgi.server(eventlet.listen(('', 8090)), app)
diff --git a/keystone/common/config.py b/keystone/common/config.py
index e202bf89..708213c9 100644
--- a/keystone/common/config.py
+++ b/keystone/common/config.py
@@ -75,14 +75,28 @@ def add_common_options(parser):
                      help="Print more verbose output")
     group.add_option('-d', '--debug', default=False, dest="debug",
                      action="store_true",
-                     help="Print debugging output")
-    group.add_option('--config-file', default=None, metavar="PATH",
-                     help="Path to the config file to use. When not specified "
-                          "(the default), we generally look at the first "
-                          "argument specified to be a config file, and if "
-                          "that is also missing, we search standard "
+                     help="Print debugging output to console")
+    group.add_option('-c', '--config-file', default=None, metavar="PATH",
+                     help="Path to the config file to use. When not specified "\
+                          "(the default), we generally look at the first "\
+                          "argument specified to be a config file, and if "\
+                          "that is also missing, we search standard "\
                           "directories for a config file.")
+    group.add_option('-p', '--port', '--bind-port', default=8080,
+                     dest="bind_port",
+                     help="specifies port to listen on (default is 8080)")
+    group.add_option('--host', '--bind-host',
+                     default="0.0.0.0", dest="bind_host",
+                     help="specifies host address to listen on "\
+                            "(default is all or 0.0.0.0)")
+    # This one is handled by tools/tracer.py (if loaded)
+    group.add_option('-t', '--trace-calls', default=False,
+                     dest="trace_calls",
+                     action="store_true",
+                     help="Turns on call tracing for troubleshooting")
+
     parser.add_option_group(group)
+    return group
 
 
 def add_log_options(parser):
@@ -97,22 +111,51 @@ def add_log_options(parser):
 
     group = optparse.OptionGroup(parser, "Logging Options", help_text)
     group.add_option('--log-config', default=None, metavar="PATH",
-                     help="If this option is specified, the logging "
-                          "configuration file specified is used and overrides "
-                          "any other logging options specified. Please see "
-                          "the Python logging module documentation for "
+                     help="If this option is specified, the logging "\
+                          "configuration file specified is used and overrides "\
+                          "any other logging options specified. Please see "\
+                          "the Python logging module documentation for "\
                           "details on logging configuration files.")
     group.add_option('--log-date-format', metavar="FORMAT",
                       default=DEFAULT_LOG_DATE_FORMAT,
-                      help="Format string for %(asctime)s in log records. "
+                      help="Format string for %(asctime)s in log records. "\
                            "Default: %default")
     group.add_option('--log-file', default=None, metavar="PATH",
-                      help="(Optional) Name of log file to output to. "
+                      help="(Optional) Name of log file to output to. "\
                            "If not set, logging will go to stdout.")
     group.add_option("--log-dir", default=None,
-                      help="(Optional) The directory to keep log files in "
+                      help="(Optional) The directory to keep log files in "\
                            "(will be prepended to --logfile)")
+
     parser.add_option_group(group)
+    return group
+
+
+def add_console_handler(logger, level=logging.INFO):
+    """
+    Add a Handler which writes log messages to sys.stderr
+    (which is often the console)
+    There is a copy of this function in wsgi.py (TODO(Ziad): Make it one copy)
+    """
+    console = None
+    for console in logger.handlers:
+        if isinstance(console, logging.StreamHandler):
+            break
+
+    if not console:
+        console = logging.StreamHandler()
+        console.setLevel(level)
+        # set a format which is simpler for console use
+        formatter = logging.Formatter("%(name)-12s: "\
+                                      "%(levelname)-8s %(message)s")
+        # tell the handler to use this format
+        console.setFormatter(formatter)
+        # add the handler to the root logger
+        logger.addHandler(console)
+    else:
+        if console.level != level:
+            console.setLevel(level)
+    return console
 
 
 def setup_logging(options, conf):
@@ -128,7 +171,7 @@ def setup_logging(options, conf):
             logging.config.fileConfig(options['log_config'])
             return
         else:
-            raise RuntimeError("Unable to locate specified logging "
+            raise RuntimeError("Unable to locate specified logging "\
                                "config file: %s" % options['log_config'])
 
     # If either the CLI option or the conf value
@@ -163,8 +206,12 @@ def setup_logging(options, conf):
             logfile = os.path.join(logdir, logfile)
         logfile = logging.FileHandler(logfile)
         logfile.setFormatter(formatter)
-        logfile.setFormatter(formatter)
         root_logger.addHandler(logfile)
+        # Mirror to console if verbose or debug
+        if debug:
+            add_console_handler(root_logger, logging.INFO)  #debug too noisy
+        elif verbose:
+            add_console_handler(root_logger, logging.INFO)
     else:
         handler = logging.StreamHandler(sys.stdout)
         handler.setFormatter(formatter)
@@ -217,10 +264,7 @@ def find_config_file(options, args):
                 # For debug only
                 config_file = os.path.join(POSSIBLE_TOPDIR, 'etc', \
                         'keystone.conf')
-                print "Running server from %s " % config_file
-
-                return os.path.join(POSSIBLE_TOPDIR, 'etc', \
-                        'keystone.conf')
+                return config_file
 
 
 def load_paste_config(app_name, options, args):
@@ -250,7 +294,7 @@ def load_paste_config(app_name, options, args):
     """
     conf_file = find_config_file(options, args)
     if not conf_file:
-        raise RuntimeError("Unable to locate any configuration file. "
+        raise RuntimeError("Unable to locate any configuration file. "\
                             "Cannot load application %s" % app_name)
     try:
         conf = deploy.appconfig("config:%s" % conf_file, name=app_name)
@@ -274,7 +318,7 @@ def load_paste_app(app_name, options, args):
         * /etc/keystone
         * /etc
 
-    :param app_name: Name of the application to load
+    :param app_name: Name of the application to load (server, admin, proxy, ...)
     :param options: Set of typed options returned from parse_options()
     :param args: Command line arguments from argv[1:]
 
@@ -298,15 +342,15 @@ def load_paste_app(app_name, options, args):
         # Log the options used when starting if we're in debug mode...
         if debug:
             logger = logging.getLogger(app_name)
-            logger.debug("*" * 80)
-            logger.debug("Configuration options gathered from config file:")
-            logger.debug(conf_file)
-            logger.debug("================================================")
+            logger.info("*" * 50)
+            logger.info("Configuration options gathered from config file:")
+            logger.info(conf_file)
+            logger.info("================================================")
             items = dict([(k, v) for k, v in conf.items()
                           if k not in ('__file__', 'here')])
             for key, value in sorted(items.items()):
-                logger.debug("%(key)-30s %(value)s" % locals())
-            logger.debug("*" * 80)
+                logger.info("%(key)-20s %(value)s" % locals())
+            logger.info("*" * 50)
         app = deploy.loadapp("config:%s" % conf_file, name=app_name)
     except (LookupError, ImportError), e:
         raise RuntimeError("Unable to load %(app_name)s from "
diff --git a/keystone/common/exception.py b/keystone/common/exception.py
index 1f793c7c..fb64220d 100755
--- a/keystone/common/exception.py
+++ b/keystone/common/exception.py
@@ -18,7 +18,7 @@
 
 """
 OpenStack base exception handling, including decorator for re-raising
-OpenSTack-type exceptions. SHOULD include dedicated exception logging.
+OpenStack-type exceptions. SHOULD include dedicated exception logging.
 """
 
 import logging
diff --git a/keystone/common/template.py b/keystone/common/template.py
index 58c8bd6e..f8412d62 100644
--- a/keystone/common/template.py
+++ b/keystone/common/template.py
@@ -1,3 +1,22 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+#
+# Template library copied from bottle: http://bottlepy.org/
 #
 # Copyright (c) 2011, Marcel Hellkamp.
 #
@@ -19,7 +38,6 @@
 # OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 # THE SOFTWARE.
 #
-# original code copied from bottle.py
 
 
 import cgi
diff --git a/keystone/common/wsgi.py b/keystone/common/wsgi.py
index 32de27c9..1f48137c 100755
--- a/keystone/common/wsgi.py
+++ b/keystone/common/wsgi.py
@@ -34,13 +34,41 @@ import routes.middleware
 import webob.dec
 import webob.exc
 
+def add_console_handler(logger, level):
+    """
+    Add a Handler which writes messages to sys.stderr which is often the
+    console.
+    There is a copy of this function in config.py (TODO(Ziad): Make it one copy)
+    """
+    console = None
+    for console in logger.handlers:
+        if isinstance(console, logging.StreamHandler):
+            break
+            
+    if not console:
+        console = logging.StreamHandler()
+        console.setLevel(level)
+        # set a format which is simpler for console use
+        formatter = logging.Formatter('%(name)-12s: %(levelname)-8s %(message)s')
+        # tell the handler to use this format
+        console.setFormatter(formatter)
+        # add the handler to the root logger
+        logger.addHandler(console)
+    elif console.level != level:
+        console.setLevel(level)
+    return console
+
 
 class WritableLogger(object):
     """A thin wrapper that responds to `write` and logs."""
 
-    def __init__(self, logger, level=logging.DEBUG):
+    def __init__(self, logger, level=logging.INFO):
         self.logger = logger
         self.level = level
+        # TODO(Ziad): figure out why root logger is not set to same level as
+        # caller. Maybe something to do with paste?
+        if level == logging.DEBUG:
+            add_console_handler(logger, level)
 
     def write(self, msg):
         self.logger.log(self.level, msg.strip("\n"))
@@ -73,8 +101,10 @@ class Server(object):
     def _run(self, application, socket):
         """Start a WSGI server in a new green thread."""
         logger = logging.getLogger('eventlet.wsgi.server')
+        # TODO(Ziad): figure out why root logger is not set to same level as
+        # caller. Maybe something to do with paste?
         eventlet.wsgi.server(socket, application, custom_pool=self.pool,
-                             log=WritableLogger(logger))
+                             log=WritableLogger(logger, logging.root.level))
 
 
 class Middleware(object):
@@ -176,7 +206,7 @@ class Router(object):
           # Pointing to an arbitrary WSGI app.  You can specify the
           # {path_info:.*} parameter so the target app can be handed just that
           # section of the URL.
-          mapper.connect(None, "/v2.0/{path_info:.*}", controller=BlogApp())
+          mapper.connect(None, "/v2.0/{path_info:.*}", controller=TheApp())
         """
         self.map = mapper
         self._router = routes.middleware.RoutesMiddleware(self._dispatch,
diff --git a/keystone/db/sqlalchemy/api.py b/keystone/db/sqlalchemy/api.py
index e479a4aa..95fbb9ee 100644
--- a/keystone/db/sqlalchemy/api.py
+++ b/keystone/db/sqlalchemy/api.py
@@ -28,6 +28,7 @@ _ENGINE = None
 _MAKER = None
 BASE = models.Base
 
+
 def configure_db(options):
     """
     Establish the database, create an engine if needed, and
@@ -77,11 +78,33 @@ def unregister_models():
     assert _ENGINE
     BASE.metadata.drop_all(_ENGINE)
 
+
 #
-# Tenant API operations
+# Role API operations
 #
+def role_create(values):
+    role_ref = models.Role()
+    role_ref.update(values)
+    role_ref.save()
+    return role_ref
+
+
+def role_get(id, session=None):
+    if not session:
+        session = get_session()
+    result = session.query(models.Role).filter_by(id=id).first()
+    return result
+
+
+def role_get_all(session=None):
+    if not session:
+        session = get_session()
+    return session.query(models.Role).all()
 
 
+#
+# Tenant API operations
+#
 def tenant_create(values):
     tenant_ref = models.Tenant()
     tenant_ref.update(values)
@@ -182,11 +205,11 @@ def tenant_delete(id, session=None):
         tenant_ref = tenant_get(id, session)
         session.delete(tenant_ref)
 
+
+
 #
 # Tenant Group Operations API
 #
-
-
 def tenant_group_create(values):
     group_ref = models.Group()
     group_ref.update(values)
@@ -288,6 +311,16 @@ def tenant_group_delete(id, tenant_id, session=None):
         session.delete(tenantgroup_ref)
 
 
+#
+# User Operations
+#
+def user_get_all(session=None):
+    if not session:
+        session = get_session()
+    result = session.query(models.User)
+    return result
+
+
 def get_user_by_group(user_id, group_id, session=None):
     if not session:
         session = get_session()
@@ -310,10 +343,6 @@ def user_tenant_group_delete(id, group_id, session=None):
         usertenantgroup_ref = get_user_by_group(id, group_id, session)
         session.delete(usertenantgroup_ref)
 
-#
-# User Operations
-#
-
 
 def user_create(values):
     user_ref = models.User()
@@ -325,8 +354,10 @@ def user_create(values):
 def user_get(id, session=None):
     if not session:
         session = get_session()
-    result = session.query(models.User).options(joinedload('groups')).options(\
-            joinedload('tenants')).filter_by(id=id).first()
+    #TODO(Ziad): finish cleaning up model
+    #    result = session.query(models.User).options(joinedload('groups')).options(\
+    #            joinedload('tenants')).filter_by(id=id).first()
+    result = session.query(models.User).filter_by(id=id).first()
     return result
 
 
@@ -345,6 +376,14 @@ def user_groups(id, session=None):
     return result
 
 
+def user_roles_by_tenant(user_id, tenant_id, session=None):
+    if not session:
+        session = get_session()
+    result = session.query(models.UserRoleAssociation).filter_by(\
+            user_id=user_id, tenant_id=tenant_id).options(joinedload('roles'))
+    return result
+
+
 def user_update(id, values, session=None):
     if not session:
         session = get_session()
@@ -419,6 +458,64 @@ def users_tenant_group_get_page_markers(group_id, marker, limit, session=None):
     return (prev, next)
 
 
+def user_delete(id, session=None):
+    if not session:
+        session = get_session()
+    with session.begin():
+        user_ref = user_get(id, session)
+        session.delete(user_ref)
+
+
+def user_get_by_tenant(id, tenant_id, session=None):
+    if not session:
+        session = get_session()
+    user_tenant = session.query(models.UserTenantAssociation).filter_by(\
+        tenant_id=tenant_id, user_id=id).first()
+    if user_tenant:
+        return user_get(id, session)
+    else:
+        return None
+
+
+def user_get_by_group(id, session=None):
+    if not session:
+        session = get_session()
+    user_group = session.query(models.Group).filter_by(tenant_id=id).all()
+    return user_group
+
+
+def user_delete_tenant(id, tenant_id, session=None):
+    if not session:
+        session = get_session()
+    with session.begin():
+        user_tenant_ref = user_get_by_tenant(id, tenant_id, session)
+
+        session.delete(user_tenant_ref)
+        user_group_ref = user_get_by_group(tenant_id, session)
+
+        if user_group_ref is not None:
+            for user_group in user_group_ref:
+                group_users = session.query(models.UserGroupAssociation)\
+                                .filter_by(user_id=id,
+                                        group_id=user_group.id).all()
+                for group_user in group_users:
+                    session.delete(group_user)
+        user_tenant_ref = session.query(models.UserTenantAssociation)\
+                            .filter_by(user_id=id).first()
+        if user_tenant_ref is None:
+            user_ref = user_get(id, session)
+            session.delete(user_ref)
+
+def user_get_by_tenant(user_id, tenant_id, session=None):
+    if not session:
+        session = get_session()
+    result = session.query(models.User).filter_by(id=user_id,
+                                                  tenant_id=tenant_id).first()
+    return result
+
+#
+# Group Operations
+#
 def group_get(id, session=None):
     if not session:
         session = get_session()
@@ -499,11 +596,10 @@ def group_delete(id, session=None):
         group_ref = group_get(id, session)
         session.delete(group_ref)
 
+
 #
 # Token Operations
 #
-
-
 def token_create(values):
     token_ref = models.Token()
     token_ref.update(values)
@@ -542,6 +638,22 @@ def token_for_user_tenant(user_id, tenant_id, session=None):
     return result
 
 
+def token_get_all(session=None):
+    if not session:
+        session = get_session()
+    return session.query(models.Token).all()
+
+
+#
+# Unsorted operations
+#
+def user_role_add(values):
+    user_role_ref = models.UserRoleAssociation()
+    user_role_ref.update(values)
+    user_role_ref.save()
+    return user_role_ref
+
+
 def user_tenant_create(values):
     user_tenant_ref = models.UserTenantAssociation()
     user_tenant_ref.update(values)
@@ -555,6 +667,7 @@ def user_get_update(id, session=None):
     result = session.query(models.User).filter_by(id=id).first()
     return result
 
+
 def users_get_by_tenant_get_page(tenant_id, marker, limit, session=None):
     if not session:
         session = get_session()
@@ -708,49 +821,3 @@ def groups_get_by_user_get_page_markers(user_id, marker, limit, session=None):
     else:
         next = next.id
     return (prev, next)
-
-
-def user_delete(id, session=None):
-    if not session:
-        session = get_session()
-    with session.begin():
-        user_ref = user_get(id, session)
-        session.delete(user_ref)
-
-
-def user_get_by_tenant(id, tenant_id, session=None):
-    if not session:
-        session = get_session()
-    user_tenant = session.query(models.UserTenantAssociation).filter_by(\
-    tenant_id=tenant_id, user_id=id).first()
-    return user_tenant
-
-
-def user_get_by_group(id, session=None):
-    if not session:
-        session = get_session()
-    user_group = session.query(models.Group).filter_by(tenant_id=id).all()
-    return user_group
-
-
-def user_delete_tenant(id, tenant_id, session=None):
-    if not session:
-        session = get_session()
-    with session.begin():
-        user_tenant_ref = user_get_by_tenant(id, tenant_id, session)
-
-        session.delete(user_tenant_ref)
-        user_group_ref = user_get_by_group(tenant_id, session)
-
-        if user_group_ref is not None:
-            for user_group in user_group_ref:
-                group_users = session.query(models.UserGroupAssociation)\
-                                .filter_by(user_id=id,
-                                        group_id=user_group.id).all()
-                for group_user in group_users:
-                    session.delete(group_user)
-        user_tenant_ref = session.query(models.UserTenantAssociation)\
-                            .filter_by(user_id=id).first()
-        if user_tenant_ref is None:
-            user_ref = user_get(id, session)
-            session.delete(user_ref)
diff --git a/keystone/db/sqlalchemy/models.py b/keystone/db/sqlalchemy/models.py
index bdcd5015..71511653 100644
--- a/keystone/db/sqlalchemy/models.py
+++ b/keystone/db/sqlalchemy/models.py
@@ -74,18 +74,38 @@ class KeystoneBase(object):
         return local.iteritems()
 
 
-class UserTenantAssociation(Base, KeystoneBase):
-    __tablename__ = 'user_tenant_association'
+# Define associations firest
+class UserGroupAssociation(Base, KeystoneBase):
+    __tablename__ = 'user_group_association'
 
     user_id = Column(String(255), ForeignKey('users.id'), primary_key=True)
-    tenant_id = Column(String(255), ForeignKey('tenants.id'), primary_key=True)
+    group_id = Column(String(255), ForeignKey('groups.id'), primary_key=True)
 
 
-class UserGroupAssociation(Base, KeystoneBase):
-    __tablename__ = 'user_group_association'
+class UserRoleAssociation(Base, KeystoneBase):
+    __tablename__ = 'user_roles'
 
     user_id = Column(String(255), ForeignKey('users.id'), primary_key=True)
-    group_id = Column(String(255), ForeignKey('groups.id'), primary_key=True)
+    role_id = Column(String(255), ForeignKey('roles.id'), primary_key=True)
+    tenant_id = Column(String(255), ForeignKey('tenants.id'), primary_key=True)
+
+
+# Define objects
+class Role(Base, KeystoneBase):
+    __tablename__ = 'roles'
+
+    id = Column(String(255), primary_key=True, unique=True)
+    desc = Column(String(255))
+
+
+class Tenant(Base, KeystoneBase):
+    __tablename__ = 'tenants'
+
+    id = Column(String(255), primary_key=True, unique=True)
+    desc = Column(String(255))
+    enabled = Column(Integer)
+
+    groups = relationship('Group', backref='tenants')
 
 
 class User(Base, KeystoneBase):
@@ -95,17 +115,27 @@ class User(Base, KeystoneBase):
     password = Column(String(255))
     email = Column(String(255))
     enabled = Column(Integer)
+    tenant_id = Column(String(255), ForeignKey('tenants.id'))
+    
     groups = relationship(UserGroupAssociation, backref='users')
-    tenants = relationship(UserTenantAssociation, backref='user')
+    roles = relationship(UserRoleAssociation)
 
+class Credentials(Base, KeystoneBase):
+    __tablename__ = 'credentials'
 
-class Tenant(Base, KeystoneBase):
-    __tablename__ = 'tenants'
+    user_id = Column(String(255), ForeignKey('users.id'), primary_key=True)
+    type = Column(String(20)) #('Password','APIKey','EC2')
+    key = Column(String(255))
+    secret = Column(String(255))
+
+
+class Group(Base, KeystoneBase):
+    __tablename__ = 'groups'
 
     id = Column(String(255), primary_key=True, unique=True)
     desc = Column(String(255))
-    enabled = Column(Integer)
-    groups = relationship('Group', backref='tenants')
+    tenant_id = Column(String(255), ForeignKey('tenants.id'))
+
 
 class Token(Base, KeystoneBase):
     __tablename__ = 'token'
@@ -115,11 +145,10 @@ class Token(Base, KeystoneBase):
     tenant_id = Column(String(255))
     expires = Column(DateTime)
 
-class Group(Base, KeystoneBase):
-    __tablename__ = 'groups'
+
+class Endpoints(Base, KeystoneBase):
+    __tablename__ = 'endpoints'
 
     id = Column(String(255), primary_key=True, unique=True)
+    service = Column(String(255))
     desc = Column(String(255))
-    tenant_id = Column(String(255), ForeignKey('tenants.id'))
-
-
diff --git a/keystone/keystone.ini b/keystone/keystone.ini
deleted file mode 100644
index 626ca1ed..00000000
--- a/keystone/keystone.ini
+++ /dev/null
@@ -1,16 +0,0 @@
-;
-; This file not used
-;
-[DEFAULT]
-
-[composite:main]
-use = egg:Paste#urlmap
-/ = home
-/tenants = admin
-
-[app:home]
-use = egg:keystone
-
-[app:admin]
-use = egg:keystone
-
diff --git a/keystone/logic/service.py b/keystone/logic/service.py
index 8c833df3..c9fc0e2d 100644
--- a/keystone/logic/service.py
+++ b/keystone/logic/service.py
@@ -34,12 +34,19 @@ class IdentityService(object):
     #
 
     def authenticate(self, credentials):
+        # Check credentials
         if not isinstance(credentials, auth.PasswordCredentials):
             raise fault.BadRequestFault("Expecting Password Credentials!")
 
-        duser = db_api.user_get(credentials.username)
-        if duser == None:
-            raise fault.UnauthorizedFault("Unauthorized")
+        if not credentials.tenant_id:
+            duser = db_api.user_get(credentials.username)
+            if duser == None:
+                raise fault.UnauthorizedFault("Unauthorized")
+        else:
+            duser = db_api.user_get_by_tenant(credentials.username, credentials.tenant_id)
+            if duser == None:
+                raise fault.UnauthorizedFault("Unauthorized on this tenant")
+        
         if not duser.enabled:
             raise fault.UserDisabledFault("Your account has been disabled")
         if duser.password != credentials.password:
@@ -55,23 +62,12 @@ class IdentityService(object):
             dtoken = db_api.token_for_user_tenant(duser.id,
                                                   credentials.tenant_id)
         if not dtoken or dtoken.expires < datetime.now():
+            # Create new token
             dtoken = db_models.Token()
             dtoken.token_id = str(uuid.uuid4())
             dtoken.user_id = duser.id
-
-            if not duser.tenants:
-                raise fault.IdentityFault("Strange: user %s is not associated "
-                                     "with a tenant!" % duser.id)
-            user = db_api.user_get_by_tenant(duser.id, credentials.tenant_id)
-
-            if not credentials.tenant_id or not user:
-                raise fault.ForbiddenFault("Error: user %s is "
-                                     "not associated "
-                                     "with a tenant! %s" % (duser.id,
-                                                    credentials.tenant_id))
+            if credentials.tenant_id:
                 dtoken.tenant_id = credentials.tenant_id
-            else:
-                dtoken.tenant_id = duser.tenants[0].tenant_id
             dtoken.expires = datetime.now() + timedelta(days=1)
             db_api.token_create(dtoken)
 
@@ -833,21 +829,18 @@ class IdentityService(object):
 
         token = auth.Token(dtoken.expires, dtoken.token_id)
 
-        gs = []
+        """gs = []
         for ug in duser.groups:
             dgroup = db_api.group_get(ug.group_id)
-            gs.append(auth.Group(dgroup.id, dgroup.tenant_id))
-        groups = auth.Groups(gs, [])
-        if len(duser.tenants) == 0:
-            raise fault.IdentityFault("Strange: user %s is not associated "
-                                 "with a tenant!" % duser.id)
-        if not dtoken.tenant_id and \
-            db_api.user_get_by_tenant(duser.id, dtoken.tenant_id):
-            raise fault.IdentityFault("Error: user %s is not associated "
-                                 "with a tenant! %s" % (duser.id,
-                                                dtoken.tenant_id))
-
-        user = auth.User(duser.id, dtoken.tenant_id, groups)
+            if dtoken.tenant_id:
+                if dgroup.tenant_id == dtoken.tenant_id:
+                    gs.append(auth.Group(dgroup.id, dgroup.tenant_id))
+            else:
+                if dgroup.tenant_id == None:
+                    gs.append(auth.Group(dgroup.id))
+        user = auth.User(duser.id, dtoken.tenant_id, gs)
+        """
+        user = auth.User(duser.id, dtoken.tenant_id, None)
         return auth.AuthData(token, user)
 
     def __validate_token(self, token_id, admin=True):
@@ -862,11 +855,12 @@ class IdentityService(object):
         if not user.enabled:
             raise fault.UserDisabledFault("The user %s has been disabled!"
                                           % user.id)
+        '''TODO(Ziad): return roles
         if admin:
-            for ug in user.groups:
+            for roles in user.roles:
                 if ug.group_id == "Admin":
                     return (token, user)
             raise fault.UnauthorizedFault("You are not authorized "
                                        "to make this call")
-
+        '''
         return (token, user)
diff --git a/keystone/logic/types/auth.py b/keystone/logic/types/auth.py
index c822ea8c..d80e158e 100644
--- a/keystone/logic/types/auth.py
+++ b/keystone/logic/types/auth.py
@@ -21,11 +21,9 @@ from lxml import etree
 import keystone.logic.types.fault as fault
 
 
-
 class PasswordCredentials(object):
     """Credentials based on username, password, and (optional) tenant_id.
-        To handle multiple token for a user depending on tenants,
-        tenant_id is mandatory.
+        To handle multiple token for a user depending on tenants.
     """
 
     def __init__(self, username, password, tenant_id):
@@ -49,12 +47,6 @@ class PasswordCredentials(object):
             if password == None:
                 raise fault.BadRequestFault("Expecting a password")
             tenant_id = root.get("tenantId")
-
-            #--for multi-token handling--
-            if tenant_id == None:
-                raise fault.BadRequestFault("Expecting tenant")
-            # ----
-
             return PasswordCredentials(username, password, tenant_id)
         except etree.LxmlError as e:
             raise fault.BadRequestFault("Cannot parse password credentials",
@@ -76,10 +68,7 @@ class PasswordCredentials(object):
             if "tenantId" in cred:
                 tenant_id = cred["tenantId"]
             else:
-                #--for multi-token handling--
-                if tenant_id == None:
-                    raise fault.BadRequestFault("Expecting a tenant")
-                # ---
+                tenant_id = None
             return PasswordCredentials(username, password, tenant_id)
         except (ValueError, TypeError) as e:
             raise fault.BadRequestFault("Cannot parse password credentials",
@@ -128,20 +117,21 @@ class AuthData(object):
 
     def to_xml(self):
         dom = etree.Element("auth",
-                             xmlns="http://docs.openstack.org/identity/api/v2.0")
+                        xmlns="http://docs.openstack.org/identity/api/v2.0")
         token = etree.Element("token",
                              expires=self.token.expires.isoformat())
         token.set("id", self.token.token_id)
         user = etree.Element("user",
                              username=self.user.username,
                              tenantId=str(self.user.tenant_id))
-        groups = etree.Element("groups")
+        """groups = etree.Element("groups")
         for group in self.user.groups.values:
             g = etree.Element("group",
                              tenantId=group.tenant_id)
             g.set("id", group.group_id)
             groups.append(g)
         user.append(groups)
+        """
         dom.append(token)
         dom.append(user)
         return etree.tostring(dom)
@@ -153,7 +143,7 @@ class AuthData(object):
         user = {}
         user["username"] = self.user.username
         user["tenantId"] = self.user.tenant_id
-        group = []
+        """group = []
         for g in self.user.groups.values:
             grp = {}
             grp["tenantId"] = g.tenant_id
@@ -162,6 +152,7 @@ class AuthData(object):
         groups = {}
         groups["group"] = group
         user["groups"] = groups
+        """
         auth = {}
         auth["token"] = token
         auth["user"] = user
diff --git a/keystone/logic/types/user.py b/keystone/logic/types/user.py
index 6f6e619e..43e7e986 100644
--- a/keystone/logic/types/user.py
+++ b/keystone/logic/types/user.py
@@ -19,6 +19,7 @@ import string
 
 import keystone.logic.types.fault as fault
 
+
 class User(object):
 
     def __init__(self, password, user_id, tenant_id, email, enabled):
@@ -33,7 +34,8 @@ class User(object):
         try:
             dom = etree.Element("root")
             dom.append(etree.fromstring(xml_str))
-            root = dom.find("{http://docs.openstack.org/identity/api/v2.0}user")
+            root = dom.find("{http://docs.openstack.org/identity/api/v2.0}" \
+                            "user")
             if root == None:
                 raise fault.BadRequestFault("Expecting User")
             user_id = root.get("id")
@@ -43,8 +45,6 @@ class User(object):
             enabled = root.get("enabled")
             if user_id == None:
                 raise fault.BadRequestFault("Expecting User")
-            elif tenant_id == None:
-                raise fault.BadRequestFault("Expecting User tenant")
             elif password == None:
                 raise fault.BadRequestFault("Expecting User password")
             elif email == None:
@@ -75,9 +75,10 @@ class User(object):
             if not "password" in user:
                 raise fault.BadRequestFault("Expecting User Password")
             password = user["password"]
-            if not "tenantId" in user:
-                raise fault.BadRequestFault("Expecting User Tenant")
-            tenant_id = user["tenantId"]
+            if "tenantId" in user:
+                tenant_id = user["tenantId"]
+            else:
+                tenant_id = None
             if not "email" in user:
                 raise fault.BadRequestFault("Expecting User Email")
             email = user["email"]
@@ -87,15 +88,13 @@ class User(object):
                     raise fault.BadRequestFault("Bad enabled attribute!")
             else:
                 set_enabled = True
-            if password == '':
-                password = user_id
             return User(password, user_id, tenant_id, email, set_enabled)
         except (ValueError, TypeError) as e:
             raise fault.BadRequestFault("Cannot parse Tenant", str(e))
 
     def to_dom(self):
         dom = etree.Element("user",
-                            xmlns="http://docs.openstack.org/identity/api/v2.0")
+                        xmlns="http://docs.openstack.org/identity/api/v2.0")
         if self.email:
             dom.set("email", self.email)
         if self.tenant_id:
@@ -116,7 +115,8 @@ class User(object):
 
         if self.user_id:
             user["id"] = self.user_id
-        user["tenantId"] = self.tenant_id
+        if self.tenant_id:
+            user["tenantId"] = self.tenant_id
         if self.password:
             user["password"] = self.password
         user["email"] = self.email
@@ -143,7 +143,8 @@ class User_Update(object):
         try:
             dom = etree.Element("root")
             dom.append(etree.fromstring(xml_str))
-            root = dom.find("{http://docs.openstack.org/identity/api/v2.0}user")
+            root = dom.find("{http://docs.openstack.org/identity/api/v2.0}" \
+                            "user")
             if root == None:
                 raise fault.BadRequestFault("Expecting User")
             user_id = root.get("id")
@@ -200,7 +201,7 @@ class User_Update(object):
 
     def to_dom(self):
         dom = etree.Element("user",
-                            xmlns="http://docs.openstack.org/identity/api/v2.0")
+                        xmlns="http://docs.openstack.org/identity/api/v2.0")
         if self.email:
             dom.set("email", self.email)
         if self.tenant_id:
diff --git a/keystone/server.py b/keystone/server.py
index 91526c9a..59a3f8e3 100755..100644
--- a/keystone/server.py
+++ b/keystone/server.py
@@ -173,6 +173,37 @@ class AuthController(wsgi.Controller):
                      service.revoke_token(utils.get_auth_token(req), token_id))
 
 
+class LegacyAuthController(wsgi.Controller):
+    """
+        Auth Controller for v1.x -
+        Controller for token related operations
+    """
+
+    def __init__(self, options):
+        self.options = options
+        self.request = None
+
+    @utils.wrap_error
+    def authenticate(self, req):
+        self.request = req
+
+        creds = auth.PasswordCredentials(utils.get_auth_user(req),
+                                         utils.get_auth_key(req),
+                                         None)
+
+        """HTTP/1.1 204 No Content
+        Date: Mon, 12 Nov 2007 15:32:21 GMT
+        X-Storage-Url: https://storage.clouddrive.com/v1/CF_xer7_34
+        X-CDN-Management-Url: https://cdn.clouddrive.com/v1/CF_xer7_34
+        X-Auth-Token: eaaafd18-0fed-4b3a-81b4-663c99ec1cbb
+        Content-Length: 0
+        Content-Type: text/plain; charset=UTF-8"""
+
+        result = service.authenticate(creds)
+        headers = {"X-Auth-Token": result.token.token_id}
+        return utils.send_legacy_result(204, headers)
+
+
 class TenantController(wsgi.Controller):
     """
         Tenant Controller -
@@ -484,13 +515,94 @@ class GroupsController(wsgi.Controller):
 
 
 class KeystoneAPI(wsgi.Router):
-    """WSGI entry point for all Keystone Auth API requests."""
+    """WSGI entry point for public Keystone API requests."""
 
     def __init__(self, options):
         self.options = options
         mapper = routes.Mapper()
-        
+
         db_api.configure_db(options)
+
+        # Legacy Token Operations
+        auth_controller = AuthController(options)
+        legacy_auth_controller = LegacyAuthController(options)
+        mapper.connect("/v1.0", controller=legacy_auth_controller,
+                       action="authenticate")
+        mapper.connect("/v1.0/", controller=legacy_auth_controller,
+                       action="authenticate")
+
+        mapper.connect("/v1.1/tokens", controller=auth_controller,
+                       action="authenticate",
+                       conditions=dict(method=["POST"]))
+        mapper.connect("/v1.1/tokens/", controller=auth_controller,
+                       action="authenticate",
+                       conditions=dict(method=["POST"]))
+
+        # Token Operations
+        mapper.connect("/v2.0/token", controller=auth_controller,
+                       action="authenticate")
+        mapper.connect("/v2.0/token/{token_id}", controller=auth_controller,
+                        action="delete_token",
+                        conditions=dict(method=["DELETE"]))
+
+        # Tenant Operations
+        tenant_controller = TenantController(options)
+        mapper.connect("/v2.0/tenants", controller=tenant_controller,
+                    action="get_tenants", conditions=dict(method=["GET"]))
+
+        # Miscellaneous Operations
+        version_controller = VersionController(options)
+        mapper.connect("/v2.0/", controller=version_controller,
+                    action="get_version_info",
+                    conditions=dict(method=["GET"]))
+        mapper.connect("/v2.0", controller=version_controller,
+                    action="get_version_info",
+                    conditions=dict(method=["GET"]))
+
+        # Static Files Controller
+        static_files_controller = StaticFilesController(options)
+        mapper.connect("/v2.0/identitydevguide.pdf",
+                    controller=static_files_controller,
+                    action="get_pdf_contract",
+                    conditions=dict(method=["GET"]))
+        mapper.connect("/v2.0/identity.wadl",
+                    controller=static_files_controller,
+                    action="get_identity_wadl",
+                    conditions=dict(method=["GET"]))
+        mapper.connect("/v2.0/xsd/{xsd}",
+                    controller=static_files_controller,
+                    action="get_pdf_contract",
+                    conditions=dict(method=["GET"]))
+        mapper.connect("/v2.0/xsd/atom/{xsd}",
+                    controller=static_files_controller,
+                    action="get_pdf_contract",
+                    conditions=dict(method=["GET"]))
+
+        super(KeystoneAPI, self).__init__(mapper)
+
+
+class KeystoneAdminAPI(wsgi.Router):
+    """WSGI entry point for admin Keystone API requests."""
+
+    def __init__(self, options):
+        self.options = options
+        mapper = routes.Mapper()
+
+        db_api.configure_db(options)
+
+        # Legacy Token Operations
+        legacy_auth_controller = LegacyAuthController(options)
+        mapper.connect("/v1.0", controller=legacy_auth_controller,
+                       action="authenticate")
+        mapper.connect("/v1.0/", controller=legacy_auth_controller,
+                       action="authenticate")
+        mapper.connect("/v1.1/tokens", controller=legacy_auth_controller,
+                       action="authenticate",
+                       conditions=dict(method=["POST"]))
+        mapper.connect("/v1.1/tokens/", controller=legacy_auth_controller,
+                       action="authenticate",
+                       conditions=dict(method=["POST"]))
+
         # Token Operations
         auth_controller = AuthController(options)
         mapper.connect("/v2.0/token", controller=auth_controller,
@@ -649,7 +761,7 @@ class KeystoneAPI(wsgi.Router):
                     action="get_pdf_contract",
                     conditions=dict(method=["GET"]))
 
-        super(KeystoneAPI, self).__init__(mapper)
+        super(KeystoneAdminAPI, self).__init__(mapper)
 
 
 def app_factory(global_conf, **local_conf):
@@ -660,3 +772,13 @@ def app_factory(global_conf, **local_conf):
     except Exception as err:
         print err
     return KeystoneAPI(conf)
+
+
+def admin_app_factory(global_conf, **local_conf):
+    """paste.deploy app factory for creating OpenStack API server apps"""
+    try:
+        conf = global_conf.copy()
+        conf.update(local_conf)
+    except Exception as err:
+        print err
+    return KeystoneAdminAPI(conf)
diff --git a/keystone/utils.py b/keystone/utils.py
index df480e31..a72d40b6 100644
--- a/keystone/utils.py
+++ b/keystone/utils.py
@@ -56,6 +56,20 @@ def get_auth_token(req):
     return auth_token
 
 
+def get_auth_user(req):
+    auth_user = None
+    if "X-Auth-User" in req.headers:
+        auth_user = req.headers["X-Auth-User"]
+    return auth_user
+
+
+def get_auth_key(req):
+    auth_key = None
+    if "X-Auth-Key" in req.headers:
+        auth_key = req.headers["X-Auth-Key"]
+    return auth_key
+
+
 def wrap_error(func):
 
     @functools.wraps(func)
@@ -68,7 +82,8 @@ def wrap_error(func):
             else:
                 logging.exception(err)
                 return send_error(500, kwargs['req'],
-                                fault.IdentityFault("Unhandled error", str(err)))
+                                fault.IdentityFault("Unhandled error",
+                                                    str(err)))
     return check_error
 
 
@@ -80,7 +95,8 @@ def get_normalized_request_content(model, req):
     elif req.content_type == "application/json":
         ret = model.from_json(req.body)
     else:
-        raise fault.IDMFault("I don't understand the content type ", code=415)
+        raise fault.IdentityFault("I don't understand the content type ",
+                                  code=415)
     return ret
 
 
@@ -129,3 +145,18 @@ def send_result(code, req, result):
         resp.unicode_body = content.decode('UTF-8')
 
     return resp
+
+
+def send_legacy_result(code, headers):
+    resp = Response()
+    if 'content-type' not in headers:
+        headers['content-type'] = "text/plain"
+
+    resp.headers = headers
+    resp.status = code
+    if code > 399:
+        return resp
+
+    resp.content_type_params = {'charset': 'UTF-8'}
+
+    return resp
diff --git a/keystone/version.py b/keystone/version.py
deleted file mode 100755
index 770259b4..00000000
--- a/keystone/version.py
+++ /dev/null
@@ -1,33 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-#    Copyright 2011 OpenStack LLC
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
-""" Version file for the  python daemon script """
-
-KEYSTONE_VERSION = ['1', '0']
-MAJOR, MINOR = KEYSTONE_VERSION
-
-FINAL = True
-
-
-def canonical_version_string():
-    return '.'.join([MAJOR, MINOR])
-
-
-def version_string():
-    if FINAL:
-        return canonical_version_string()
-    else:
-        return '%s-dev' % (canonical_version_string(),)
diff --git a/management/delgroup.py b/management/delgroup.py
index 9ef2d733..1b48cd77 100644..100755
--- a/management/delgroup.py
+++ b/management/delgroup.py
@@ -1,42 +1,54 @@
-# Copyright (c) 2010-2011 OpenStack, LLC.

-#

-# Licensed under the Apache License, Version 2.0 (the "License");

-# you may not use this file except in compliance with the License.

-# You may obtain a copy of the License at

-#

-#    http://www.apache.org/licenses/LICENSE-2.0

-#

-# Unless required by applicable law or agreed to in writing, software

-# distributed under the License is distributed on an "AS IS" BASIS,

-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or

-# implied.

-# See the License for the specific language governing permissions and

-# limitations under the License.

-

-import optparse

-import keystone.db.sqlalchemy.api as db_api

-

-

-def main():

-    usage = "usage: %prog group_id"

-    parser = optparse.OptionParser(usage)

-    options, args = parser.parse_args()

-    if len(args) != 1:

-        parser.error("Incorrect number of arguments")

-    else:

-        index = args[0]

-

-        try:

-            o = db_api.group_get(index)

-            if o == None:

-                raise IndexError("Group %s not found", index)

-            else:

-                db_api.group_delete(index)

-            print 'Group', index, 'deleted.'

-

-        except Exception, e:

-            print 'Error deleting group', index, str(e)

-

-

-if __name__ == '__main__':

-    main()

+#!/usr/bin/env python
+# Copyright (c) 2010-2011 OpenStack, LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import sys
+
+# If ../keystone/__init__.py exists, add ../ to Python search path, so that
+# it will override what happens to be installed in /usr/(local/)lib/python...
+possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
+                                   os.pardir,
+                                   os.pardir))
+if os.path.exists(os.path.join(possible_topdir, 'keystone', '__init__.py')):
+    sys.path.insert(0, possible_topdir)
+
+import optparse
+import keystone.db.sqlalchemy.api as db_api
+
+
+def main():
+    usage = "usage: %prog group_id"
+    parser = optparse.OptionParser(usage)
+    options, args = parser.parse_args()
+    if len(args) != 1:
+        parser.error("Incorrect number of arguments")
+    else:
+        index = args[0]
+
+        try:
+            o = db_api.group_get(index)
+            if o == None:
+                raise IndexError("Group %s not found", index)
+            else:
+                db_api.group_delete(index)
+            print 'Group', index, 'deleted.'
+
+        except Exception, e:
+            print 'Error deleting group', index, str(e)
+
+
+if __name__ == '__main__':
+    main()
diff --git a/management/getgroup.py b/management/getgroup.py
index 38a6b8f2..9bb0e41f 100644..100755
--- a/management/getgroup.py
+++ b/management/getgroup.py
@@ -1,40 +1,52 @@
-# Copyright (c) 2010-2011 OpenStack, LLC.

-#

-# Licensed under the Apache License, Version 2.0 (the "License");

-# you may not use this file except in compliance with the License.

-# You may obtain a copy of the License at

-#

-#    http://www.apache.org/licenses/LICENSE-2.0

-#

-# Unless required by applicable law or agreed to in writing, software

-# distributed under the License is distributed on an "AS IS" BASIS,

-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or

-# implied.

-# See the License for the specific language governing permissions and

-# limitations under the License.

-

-import optparse

-import keystone.db.sqlalchemy.api as db_api

-

-

-def main():

-    usage = "usage: %prog group_id"

-    parser = optparse.OptionParser(usage)

-    options, args = parser.parse_args()

-    if len(args) != 1:

-        parser.error("Incorrect number of arguments")

-    else:

-        index = args[0]

-

-        try:

-            o = db_api.group_get(index)

-            if o == None:

-                raise IndexError("Group %s not found", index)

-

-            print o.id, o.desc

-        except Exception, e:

-            print 'Error getting group', index, str(e)

-

-

-if __name__ == '__main__':

-    main()

+#!/usr/bin/env python
+# Copyright (c) 2010-2011 OpenStack, LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import sys
+
+# If ../keystone/__init__.py exists, add ../ to Python search path, so that
+# it will override what happens to be installed in /usr/(local/)lib/python...
+possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
+                                   os.pardir,
+                                   os.pardir))
+if os.path.exists(os.path.join(possible_topdir, 'keystone', '__init__.py')):
+    sys.path.insert(0, possible_topdir)
+
+import optparse
+import keystone.db.sqlalchemy.api as db_api
+
+
+def main():
+    usage = "usage: %prog group_id"
+    parser = optparse.OptionParser(usage)
+    options, args = parser.parse_args()
+    if len(args) != 1:
+        parser.error("Incorrect number of arguments")
+    else:
+        index = args[0]
+
+        try:
+            o = db_api.group_get(index)
+            if o == None:
+                raise IndexError("Group %s not found", index)
+
+            print o.id, o.desc
+        except Exception, e:
+            print 'Error getting group', index, str(e)
+
+
+if __name__ == '__main__':
+    main()
diff --git a/management/getgroups.py b/management/getgroups.py
index 501d948f..2fc94cb9 100644..100755
--- a/management/getgroups.py
+++ b/management/getgroups.py
@@ -1,37 +1,49 @@
-# Copyright (c) 2010-2011 OpenStack, LLC.

-#

-# Licensed under the Apache License, Version 2.0 (the "License");

-# you may not use this file except in compliance with the License.

-# You may obtain a copy of the License at

-#

-#    http://www.apache.org/licenses/LICENSE-2.0

-#

-# Unless required by applicable law or agreed to in writing, software

-# distributed under the License is distributed on an "AS IS" BASIS,

-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or

-# implied.

-# See the License for the specific language governing permissions and

-# limitations under the License.

-

-import optparse

-import keystone.db.sqlalchemy.api as db_api

-

-

-def main():

-    usage = "usage: %prog "

-    parser = optparse.OptionParser(usage)

-    options, args = parser.parse_args()

-    if len(args) != 0:

-        parser.error("Incorrect number of arguments")

-    else:

-        try:

-            u = db_api.group_get_all()

-            if u == None:

-                raise IndexError("Groups not found")

-            for row in u:

-                print row.id

-        except Exception, e:

-            print 'Error getting groups:', str(e)

-

-if __name__ == '__main__':

-    main()

+#!/usr/bin/env python
+# Copyright (c) 2010-2011 OpenStack, LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import sys
+
+# If ../keystone/__init__.py exists, add ../ to Python search path, so that
+# it will override what happens to be installed in /usr/(local/)lib/python...
+possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
+                                   os.pardir,
+                                   os.pardir))
+if os.path.exists(os.path.join(possible_topdir, 'keystone', '__init__.py')):
+    sys.path.insert(0, possible_topdir)
+
+import optparse
+import keystone.db.sqlalchemy.api as db_api
+
+
+def main():
+    usage = "usage: %prog "
+    parser = optparse.OptionParser(usage)
+    options, args = parser.parse_args()
+    if len(args) != 0:
+        parser.error("Incorrect number of arguments")
+    else:
+        try:
+            u = db_api.group_get_all()
+            if u == None:
+                raise IndexError("Groups not found")
+            for row in u:
+                print row.id
+        except Exception, e:
+            print 'Error getting groups:', str(e)
+
+if __name__ == '__main__':
+    main()
diff --git a/management/getgroupusers.py b/management/getgroupusers.py
index 0fc7d231..1d663eb4 100644..100755
--- a/management/getgroupusers.py
+++ b/management/getgroupusers.py
@@ -1,39 +1,51 @@
-# Copyright (c) 2010-2011 OpenStack, LLC.

-#

-# Licensed under the Apache License, Version 2.0 (the "License");

-# you may not use this file except in compliance with the License.

-# You may obtain a copy of the License at

-#

-#    http://www.apache.org/licenses/LICENSE-2.0

-#

-# Unless required by applicable law or agreed to in writing, software

-# distributed under the License is distributed on an "AS IS" BASIS,

-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or

-# implied.

-# See the License for the specific language governing permissions and

-# limitations under the License.

-

-import optparse

-import keystone.db.sqlalchemy.api as db_api

-

-

-def main():

-    usage = "usage: %prog group_id"

-    parser = optparse.OptionParser(usage)

-    options, args = parser.parse_args()

-    if len(args) != 1:

-        parser.error("Incorrect number of arguments")

-    else:

-        group_id = args[0]

-

-        try:

-            g = db_api.group_users(group_id)

-            if g == None:

-                raise IndexError("Group users not found")

-            for row in g:

-                print row

-        except Exception, e:

-            print 'Error getting group users for group', group_id, ':', str(e)

-

-if __name__ == '__main__':

-    main()

+#!/usr/bin/env python
+# Copyright (c) 2010-2011 OpenStack, LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import sys
+
+# If ../keystone/__init__.py exists, add ../ to Python search path, so that
+# it will override what happens to be installed in /usr/(local/)lib/python...
+possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
+                                   os.pardir,
+                                   os.pardir))
+if os.path.exists(os.path.join(possible_topdir, 'keystone', '__init__.py')):
+    sys.path.insert(0, possible_topdir)
+
+import optparse
+import keystone.db.sqlalchemy.api as db_api
+
+
+def main():
+    usage = "usage: %prog group_id"
+    parser = optparse.OptionParser(usage)
+    options, args = parser.parse_args()
+    if len(args) != 1:
+        parser.error("Incorrect number of arguments")
+    else:
+        group_id = args[0]
+
+        try:
+            g = db_api.group_users(group_id)
+            if g == None:
+                raise IndexError("Group users not found")
+            for row in g:
+                print row
+        except Exception, e:
+            print 'Error getting group users for group', group_id, ':', str(e)
+
+if __name__ == '__main__':
+    main()
diff --git a/management/getuser.py b/management/getuser.py
index 036f10f4..af0ba89f 100644..100755
--- a/management/getuser.py
+++ b/management/getuser.py
@@ -1,37 +1,49 @@
-# Copyright (c) 2010-2011 OpenStack, LLC.

-#

-# Licensed under the Apache License, Version 2.0 (the "License");

-# you may not use this file except in compliance with the License.

-# You may obtain a copy of the License at

-#

-#    http://www.apache.org/licenses/LICENSE-2.0

-#

-# Unless required by applicable law or agreed to in writing, software

-# distributed under the License is distributed on an "AS IS" BASIS,

-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or

-# implied.

-# See the License for the specific language governing permissions and

-# limitations under the License.

-

-import optparse

-import keystone.db.sqlalchemy.api as db_api

-

-

-def main():

-    usage = "usage: %prog username"

-    parser = optparse.OptionParser(usage)

-    options, args = parser.parse_args()

-    if len(args) != 1:

-        parser.error("Incorrect number of arguments")

-    else:

-        username = args[0]

-        try:

-            u = db_api.user_get(username)

-            if u == None:

-                raise IndexError("User not found")

-            print u.id, u.email, u.enabled

-        except Exception, e:

-            print 'Error finding user', username, ':', str(e)

-

-if __name__ == '__main__':

-    main()

+#!/usr/bin/env python
+# Copyright (c) 2010-2011 OpenStack, LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import sys
+
+# If ../keystone/__init__.py exists, add ../ to Python search path, so that
+# it will override what happens to be installed in /usr/(local/)lib/python...
+possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
+                                   os.pardir,
+                                   os.pardir))
+if os.path.exists(os.path.join(possible_topdir, 'keystone', '__init__.py')):
+    sys.path.insert(0, possible_topdir)
+
+import optparse
+import keystone.db.sqlalchemy.api as db_api
+
+
+def main():
+    usage = "usage: %prog username"
+    parser = optparse.OptionParser(usage)
+    options, args = parser.parse_args()
+    if len(args) != 1:
+        parser.error("Incorrect number of arguments")
+    else:
+        username = args[0]
+        try:
+            u = db_api.user_get(username)
+            if u == None:
+                raise IndexError("User not found")
+            print u.id, u.email, u.enabled
+        except Exception, e:
+            print 'Error finding user', username, ':', str(e)
+
+if __name__ == '__main__':
+    main()
diff --git a/management/getusergroups.py b/management/getusergroups.py
index 3fd7d3f9..33801a93 100644..100755
--- a/management/getusergroups.py
+++ b/management/getusergroups.py
@@ -1,38 +1,50 @@
-# Copyright (c) 2010-2011 OpenStack, LLC.

-#

-# Licensed under the Apache License, Version 2.0 (the "License");

-# you may not use this file except in compliance with the License.

-# You may obtain a copy of the License at

-#

-#    http://www.apache.org/licenses/LICENSE-2.0

-#

-# Unless required by applicable law or agreed to in writing, software

-# distributed under the License is distributed on an "AS IS" BASIS,

-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or

-# implied.

-# See the License for the specific language governing permissions and

-# limitations under the License.

-

-import optparse

-import keystone.db.sqlalchemy.api as db_api

-

-

-def main():

-    usage = "usage: %prog user_id"

-    parser = optparse.OptionParser(usage)

-    options, args = parser.parse_args()

-    if len(args) != 1:

-        parser.error("Incorrect number of arguments")

-    else:

-        username = args[0]

-        try:

-            g = db_api.user_groups(username)

-            if g == None:

-                raise IndexError("User groups not found")

-            for row in g:

-                print row

-        except Exception, e:

-            print 'Error getting user groups for user', user_id, ':', str(e)

-

-if __name__ == '__main__':

-    main()

+#!/usr/bin/env python
+# Copyright (c) 2010-2011 OpenStack, LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import sys
+
+# If ../keystone/__init__.py exists, add ../ to Python search path, so that
+# it will override what happens to be installed in /usr/(local/)lib/python...
+possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
+                                   os.pardir,
+                                   os.pardir))
+if os.path.exists(os.path.join(possible_topdir, 'keystone', '__init__.py')):
+    sys.path.insert(0, possible_topdir)
+
+import optparse
+import keystone.db.sqlalchemy.api as db_api
+
+
+def main():
+    usage = "usage: %prog user_id"
+    parser = optparse.OptionParser(usage)
+    options, args = parser.parse_args()
+    if len(args) != 1:
+        parser.error("Incorrect number of arguments")
+    else:
+        username = args[0]
+        try:
+            g = db_api.user_groups(username)
+            if g == None:
+                raise IndexError("User groups not found")
+            for row in g:
+                print row
+        except Exception, e:
+            print 'Error getting user groups for user', user_id, ':', str(e)
+
+if __name__ == '__main__':
+    main()
diff --git a/management/getusers.py b/management/getusers.py
deleted file mode 100644
index 18a5de56..00000000
--- a/management/getusers.py
+++ /dev/null
@@ -1,38 +0,0 @@
-# Copyright (c) 2010-2011 OpenStack, LLC.

-#

-# Licensed under the Apache License, Version 2.0 (the "License");

-# you may not use this file except in compliance with the License.

-# You may obtain a copy of the License at

-#

-#    http://www.apache.org/licenses/LICENSE-2.0

-#

-# Unless required by applicable law or agreed to in writing, software

-# distributed under the License is distributed on an "AS IS" BASIS,

-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or

-# implied.

-# See the License for the specific language governing permissions and

-# limitations under the License.

-

-import optparse

-import keystone.db.sqlalchemy.api as db_api

-

-

-def main():

-    usage = "usage: %prog tenant_id"

-    parser = optparse.OptionParser(usage)

-    options, args = parser.parse_args()

-    if len(args) != 1:

-        parser.error("Incorrect number of arguments")

-    else:

-        tenant_id = args[0]

-        try:

-            u = db_api.user_get_by_tenant(tenant_id)

-            if u == None:

-                raise IndexError("Users not found")

-            for row in u:

-                print row

-        except Exception, e:

-            print 'Error getting users for tenant', tenant_id, ':', str(e)

-

-if __name__ == '__main__':

-    main()

diff --git a/management/groupadd.py b/management/groupadd.py
index adec58dc..11329e44 100644..100755
--- a/management/groupadd.py
+++ b/management/groupadd.py
@@ -1,40 +1,52 @@
-# Copyright (c) 2010-2011 OpenStack, LLC.

-#

-# Licensed under the Apache License, Version 2.0 (the "License");

-# you may not use this file except in compliance with the License.

-# You may obtain a copy of the License at

-#

-#    http://www.apache.org/licenses/LICENSE-2.0

-#

-# Unless required by applicable law or agreed to in writing, software

-# distributed under the License is distributed on an "AS IS" BASIS,

-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or

-# implied.

-# See the License for the specific language governing permissions and

-# limitations under the License.

-

-import optparse

-import keystone.db.sqlalchemy.api as db_api

-from keystone.db.sqlalchemy import models

-

-

-def main():

-    usage = "usage: %prog group_id group_desc"

-    parser = optparse.OptionParser(usage)

-    options, args = parser.parse_args()

-    if len(args) != 2:

-        parser.error("Incorrect number of arguments")

-    else:

-        group_id = args[0]

-        group_desc = args[1]

-        try:

-            g = models.Group()

-            g.id = group_id

-            g.desc = group_desc

-            db_api.group_create(g)

-            print 'Group', g.id, 'created.'

-        except Exception, e:

-            print 'Error creating group', group_id, ':', str(e)

-

-if __name__ == '__main__':

-    main()

+#!/usr/bin/env python
+# Copyright (c) 2010-2011 OpenStack, LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import sys
+
+# If ../keystone/__init__.py exists, add ../ to Python search path, so that
+# it will override what happens to be installed in /usr/(local/)lib/python...
+possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
+                                   os.pardir,
+                                   os.pardir))
+if os.path.exists(os.path.join(possible_topdir, 'keystone', '__init__.py')):
+    sys.path.insert(0, possible_topdir)
+
+import optparse
+import keystone.db.sqlalchemy.api as db_api
+from keystone.db.sqlalchemy import models
+
+
+def main():
+    usage = "usage: %prog group_id group_desc"
+    parser = optparse.OptionParser(usage)
+    options, args = parser.parse_args()
+    if len(args) != 2:
+        parser.error("Incorrect number of arguments")
+    else:
+        group_id = args[0]
+        group_desc = args[1]
+        try:
+            g = models.Group()
+            g.id = group_id
+            g.desc = group_desc
+            db_api.group_create(g)
+            print 'Group', g.id, 'created.'
+        except Exception, e:
+            print 'Error creating group', group_id, ':', str(e)
+
+if __name__ == '__main__':
+    main()
diff --git a/management/setuserlock.py b/management/setuserlock.py
index 622d876b..7cfa8c15 100644..100755
--- a/management/setuserlock.py
+++ b/management/setuserlock.py
@@ -1,49 +1,61 @@
-# Copyright (c) 2010-2011 OpenStack, LLC.

-#

-# Licensed under the Apache License, Version 2.0 (the "License");

-# you may not use this file except in compliance with the License.

-# You may obtain a copy of the License at

-#

-#    http://www.apache.org/licenses/LICENSE-2.0

-#

-# Unless required by applicable law or agreed to in writing, software

-# distributed under the License is distributed on an "AS IS" BASIS,

-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or

-# implied.

-# See the License for the specific language governing permissions and

-# limitations under the License.

-

-import optparse

-import keystone.db.sqlalchemy.api as db_api

-

-

-def main():

-    usage = "usage: %prog username enabled"

-    parser = optparse.OptionParser(usage)

-    options, args = parser.parse_args()

-    if len(args) != 2:

-        parser.error("Incorrect number of arguments")

-    else:

-        username = args[0]

-        enabled = args[1].capitalize().strip()

-

-        if enabled == 'True' or enabled == '1':

-            enabled = 1

-        elif enabled == 'False' or enabled == '0':

-            enabled = 0

-        else:

-            parser.error("Incorrect arguments value")

-

-        try:

-            u = db_api.user_get(username)

-            if u == None:

-                raise IndexError("User not found")

-            else:

-                values = {'enabled': enabled}

-                db_api.user_update(username, values)

-            print 'User', u.id, 'updated. Enabled =', enabled

-        except Exception, e:

-            print 'Error updating user', username, ':', str(e)

-

-if __name__ == '__main__':

-    main()

+#!/usr/bin/env python
+# Copyright (c) 2010-2011 OpenStack, LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import sys
+
+# If ../keystone/__init__.py exists, add ../ to Python search path, so that
+# it will override what happens to be installed in /usr/(local/)lib/python...
+possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
+                                   os.pardir,
+                                   os.pardir))
+if os.path.exists(os.path.join(possible_topdir, 'keystone', '__init__.py')):
+    sys.path.insert(0, possible_topdir)
+
+import optparse
+import keystone.db.sqlalchemy.api as db_api
+
+
+def main():
+    usage = "usage: %prog username enabled"
+    parser = optparse.OptionParser(usage)
+    options, args = parser.parse_args()
+    if len(args) != 2:
+        parser.error("Incorrect number of arguments")
+    else:
+        username = args[0]
+        enabled = args[1].capitalize().strip()
+
+        if enabled == 'True' or enabled == '1':
+            enabled = 1
+        elif enabled == 'False' or enabled == '0':
+            enabled = 0
+        else:
+            parser.error("Incorrect arguments value")
+
+        try:
+            u = db_api.user_get(username)
+            if u == None:
+                raise IndexError("User not found")
+            else:
+                values = {'enabled': enabled}
+                db_api.user_update(username, values)
+            print 'User', u.id, 'updated. Enabled =', enabled
+        except Exception, e:
+            print 'Error updating user', username, ':', str(e)
+
+if __name__ == '__main__':
+    main()
diff --git a/management/setuserpswd.py b/management/setuserpswd.py
index 6283bf73..abfddbda 100644..100755
--- a/management/setuserpswd.py
+++ b/management/setuserpswd.py
@@ -1,41 +1,53 @@
-# Copyright (c) 2010-2011 OpenStack, LLC.

-#

-# Licensed under the Apache License, Version 2.0 (the "License");

-# you may not use this file except in compliance with the License.

-# You may obtain a copy of the License at

-#

-#    http://www.apache.org/licenses/LICENSE-2.0

-#

-# Unless required by applicable law or agreed to in writing, software

-# distributed under the License is distributed on an "AS IS" BASIS,

-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or

-# implied.

-# See the License for the specific language governing permissions and

-# limitations under the License.

-

-import optparse

-import keystone.db.sqlalchemy.api as db_api

-

-

-def main():

-    usage = "usage: %prog username password"

-    parser = optparse.OptionParser(usage)

-    options, args = parser.parse_args()

-    if len(args) != 2:

-        parser.error("Incorrect number of arguments")

-    else:

-        username = args[0]

-        password = args[1]

-        try:

-            u = db_api.user_get(username)

-            if u == None:

-                raise IndexError("User not found")

-            else:

-                values = {'password': password}

-                db_api.user_update(username, values)

-            print 'User', u.id, 'updated.'

-        except Exception, e:

-            print 'Error updating user', username, ':', str(e)

-

-if __name__ == '__main__':

-    main()

+#!/usr/bin/env python
+# Copyright (c) 2010-2011 OpenStack, LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import sys
+
+# If ../keystone/__init__.py exists, add ../ to Python search path, so that
+# it will override what happens to be installed in /usr/(local/)lib/python...
+possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
+                                   os.pardir,
+                                   os.pardir))
+if os.path.exists(os.path.join(possible_topdir, 'keystone', '__init__.py')):
+    sys.path.insert(0, possible_topdir)
+
+import optparse
+import keystone.db.sqlalchemy.api as db_api
+
+
+def main():
+    usage = "usage: %prog username password"
+    parser = optparse.OptionParser(usage)
+    options, args = parser.parse_args()
+    if len(args) != 2:
+        parser.error("Incorrect number of arguments")
+    else:
+        username = args[0]
+        password = args[1]
+        try:
+            u = db_api.user_get(username)
+            if u == None:
+                raise IndexError("User not found")
+            else:
+                values = {'password': password}
+                db_api.user_update(username, values)
+            print 'User', u.id, 'updated.'
+        except Exception, e:
+            print 'Error updating user', username, ':', str(e)
+
+if __name__ == '__main__':
+    main()
diff --git a/management/updategroup.py b/management/updategroup.py
index 598d38ef..35b4ef66 100644..100755
--- a/management/updategroup.py
+++ b/management/updategroup.py
@@ -1,42 +1,54 @@
-# Copyright (c) 2010-2011 OpenStack, LLC.

-#

-# Licensed under the Apache License, Version 2.0 (the "License");

-# you may not use this file except in compliance with the License.

-# You may obtain a copy of the License at

-#

-#    http://www.apache.org/licenses/LICENSE-2.0

-#

-# Unless required by applicable law or agreed to in writing, software

-# distributed under the License is distributed on an "AS IS" BASIS,

-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or

-# implied.

-# See the License for the specific language governing permissions and

-# limitations under the License.

-

-import optparse

-import keystone.db.sqlalchemy.api as db_api

-from keystone.db.sqlalchemy import models

-

-

-def main():

-    usage = "usage: %prog group_id group_desc"

-    parser = optparse.OptionParser(usage)

-    options, args = parser.parse_args()

-    if len(args) != 2:

-        parser.error("Incorrect number of arguments")

-    else:

-        group = args[0]

-        desc = args[1]

-        try:

-            g = db_api.group_get(group)

-            if g == None:

-                raise IndexError("Group not found")

-            else:

-                values = {'desc': desc}

-                db_api.group_update(group, values)

-            print 'Group', g.id, 'updated.'

-        except Exception, e:

-            print 'Error updating user', group, ':', str(e)

-

-if __name__ == '__main__':

-    main()

+#!/usr/bin/env python
+# Copyright (c) 2010-2011 OpenStack, LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import sys
+
+# If ../keystone/__init__.py exists, add ../ to Python search path, so that
+# it will override what happens to be installed in /usr/(local/)lib/python...
+possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
+                                   os.pardir,
+                                   os.pardir))
+if os.path.exists(os.path.join(possible_topdir, 'keystone', '__init__.py')):
+    sys.path.insert(0, possible_topdir)
+
+import optparse
+import keystone.db.sqlalchemy.api as db_api
+from keystone.db.sqlalchemy import models
+
+
+def main():
+    usage = "usage: %prog group_id group_desc"
+    parser = optparse.OptionParser(usage)
+    options, args = parser.parse_args()
+    if len(args) != 2:
+        parser.error("Incorrect number of arguments")
+    else:
+        group = args[0]
+        desc = args[1]
+        try:
+            g = db_api.group_get(group)
+            if g == None:
+                raise IndexError("Group not found")
+            else:
+                values = {'desc': desc}
+                db_api.group_update(group, values)
+            print 'Group', g.id, 'updated.'
+        except Exception, e:
+            print 'Error updating user', group, ':', str(e)
+
+if __name__ == '__main__':
+    main()
diff --git a/management/useradd.py b/management/useradd.py
deleted file mode 100644
index fc3fc8b6..00000000
--- a/management/useradd.py
+++ /dev/null
@@ -1,42 +0,0 @@
-# Copyright (c) 2010-2011 OpenStack, LLC.

-#

-# Licensed under the Apache License, Version 2.0 (the "License");

-# you may not use this file except in compliance with the License.

-# You may obtain a copy of the License at

-#

-#    http://www.apache.org/licenses/LICENSE-2.0

-#

-# Unless required by applicable law or agreed to in writing, software

-# distributed under the License is distributed on an "AS IS" BASIS,

-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or

-# implied.

-# See the License for the specific language governing permissions and

-# limitations under the License.

-

-import optparse

-import keystone.db.sqlalchemy.api as db_api

-from keystone.db.sqlalchemy import models

-

-

-def main():

-    usage = "usage: %prog username password"

-    parser = optparse.OptionParser(usage)

-    options, args = parser.parse_args()

-    if len(args) != 2:

-        parser.error("Incorrect number of arguments")

-    else:

-        username = args[0]

-        password = args[1]

-        try:

-            u = models.User()

-            u.id = username

-            u.email = username

-            u.password = password

-            u.enabled = True

-            db_api.user_create(u)

-            print 'User', u.id, 'created.'

-        except Exception, e:

-            print 'Error creating user', username, ':', str(e)

-

-if __name__ == '__main__':

-    main()

diff --git a/management/userdel.py b/management/userdel.py
index 928dfc55..f76bc632 100644..100755
--- a/management/userdel.py
+++ b/management/userdel.py
@@ -1,39 +1,51 @@
-# Copyright (c) 2010-2011 OpenStack, LLC.

-#

-# Licensed under the Apache License, Version 2.0 (the "License");

-# you may not use this file except in compliance with the License.

-# You may obtain a copy of the License at

-#

-#    http://www.apache.org/licenses/LICENSE-2.0

-#

-# Unless required by applicable law or agreed to in writing, software

-# distributed under the License is distributed on an "AS IS" BASIS,

-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or

-# implied.

-# See the License for the specific language governing permissions and

-# limitations under the License.

-

-import optparse

-import keystone.db.sqlalchemy.api as db_api

-

-

-def main():

-    usage = "usage: %prog username"

-    parser = optparse.OptionParser(usage)

-    options, args = parser.parse_args()

-    if len(args) != 1:

-        parser.error("Incorrect number of arguments")

-    else:

-        username = args[0]

-        try:

-            u = db_api.user_get(username)

-            if u == None:

-                raise IndexError("User not found")

-            else:

-                db_api.user_delete(username)

-            print 'User', username, 'deleted.'

-        except Exception, e:

-            print 'Error deleting user', username, ':', str(e)

-

-if __name__ == '__main__':

-    main()

+#!/usr/bin/env python
+# Copyright (c) 2010-2011 OpenStack, LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import sys
+
+# If ../keystone/__init__.py exists, add ../ to Python search path, so that
+# it will override what happens to be installed in /usr/(local/)lib/python...
+possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
+                                   os.pardir,
+                                   os.pardir))
+if os.path.exists(os.path.join(possible_topdir, 'keystone', '__init__.py')):
+    sys.path.insert(0, possible_topdir)
+
+import optparse
+import keystone.db.sqlalchemy.api as db_api
+
+
+def main():
+    usage = "usage: %prog username"
+    parser = optparse.OptionParser(usage)
+    options, args = parser.parse_args()
+    if len(args) != 1:
+        parser.error("Incorrect number of arguments")
+    else:
+        username = args[0]
+        try:
+            u = db_api.user_get(username)
+            if u == None:
+                raise IndexError("User not found")
+            else:
+                db_api.user_delete(username)
+            print 'User', username, 'deleted.'
+        except Exception, e:
+            print 'Error deleting user', username, ':', str(e)
+
+if __name__ == '__main__':
+    main()
diff --git a/management/userupdate.py b/management/userupdate.py
index 89174d04..5196d681 100644..100755
--- a/management/userupdate.py
+++ b/management/userupdate.py
@@ -1,41 +1,53 @@
-# Copyright (c) 2010-2011 OpenStack, LLC.

-#

-# Licensed under the Apache License, Version 2.0 (the "License");

-# you may not use this file except in compliance with the License.

-# You may obtain a copy of the License at

-#

-#    http://www.apache.org/licenses/LICENSE-2.0

-#

-# Unless required by applicable law or agreed to in writing, software

-# distributed under the License is distributed on an "AS IS" BASIS,

-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or

-# implied.

-# See the License for the specific language governing permissions and

-# limitations under the License.

-

-import optparse

-import keystone.db.sqlalchemy.api as db_api

-

-

-def main():

-    usage = "usage: %prog username email"

-    parser = optparse.OptionParser(usage)

-    options, args = parser.parse_args()

-    if len(args) != 2:

-        parser.error("Incorrect number of arguments")

-    else:

-        username = args[0]

-        email = args[1]

-        try:

-            u = db_api.user_get(username)

-            if u == None:

-                raise IndexError("User not found")

-            else:

-                values = {'email': email}

-                db_api.user_update(username, values)

-            print 'User', u.id, 'updated.'

-        except Exception, e:

-            print 'Error updating user', username, ':', str(e)

-

-if __name__ == '__main__':

-    main()

+#!/usr/bin/env python
+# Copyright (c) 2010-2011 OpenStack, LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import os
+import sys
+
+# If ../keystone/__init__.py exists, add ../ to Python search path, so that
+# it will override what happens to be installed in /usr/(local/)lib/python...
+possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
+                                   os.pardir,
+                                   os.pardir))
+if os.path.exists(os.path.join(possible_topdir, 'keystone', '__init__.py')):
+    sys.path.insert(0, possible_topdir)
+
+import optparse
+import keystone.db.sqlalchemy.api as db_api
+
+
+def main():
+    usage = "usage: %prog username email"
+    parser = optparse.OptionParser(usage)
+    options, args = parser.parse_args()
+    if len(args) != 2:
+        parser.error("Incorrect number of arguments")
+    else:
+        username = args[0]
+        email = args[1]
+        try:
+            u = db_api.user_get(username)
+            if u == None:
+                raise IndexError("User not found")
+            else:
+                values = {'email': email}
+                db_api.user_update(username, values)
+            print 'User', u.id, 'updated.'
+        except Exception, e:
+            print 'Error updating user', username, ':', str(e)
+
+if __name__ == '__main__':
+    main()
diff --git a/setup.py b/setup.py
index 257f5f65..a3e4a414 100644
--- a/setup.py
+++ b/setup.py
@@ -30,13 +30,14 @@ setup(
     url='http://www.openstack.org',
     include_package_data=True,
     packages=find_packages(exclude=['test', 'bin']),
-    scripts=['bin/keystone']
+    scripts=['bin/keystone, bin/leystone-auth, bin/keystone-admin'
+             ', bin/keystone-manage'],
     zip_safe=False,
     install_requires=['setuptools'],
     entry_points={
         'paste.app_factory': ['main=identity:app_factory'],
         'paste.filter_factory': [
-            'papiauth=keystone:papiauth_factory',
+            'remoteauth=keystone:remoteauth_factory',
             'tokenauth=keystone:tokenauth_factory',
             ],
         },
diff --git a/test/unit/test_authentication.py b/test/unit/test_authentication.py
index a6531473..2cfd8e31 100644
--- a/test/unit/test_authentication.py
+++ b/test/unit/test_authentication.py
@@ -55,6 +55,11 @@ class AuthenticationTest(unittest.TestCase):
         self.assertEqual(200, int(resp['status']))
         self.assertEqual('application/xml', utils.content_type(resp))
 
+    def test_a_authorize_legacy(self):
+        resp, content = utils.get_token_legacy('joeuser', 'secrete')
+        self.assertEqual(204, int(resp['status']))
+        self.assertTrue(resp['x-auth-token'])
+
     def test_a_authorize_user_disabled(self):
         header = httplib2.Http(".cache")
         url = '%stoken' % utils.URL
@@ -153,7 +158,7 @@ class MultiToken(unittest.TestCase):
         utils.delete_user('test_tenant2', 'test_user1', self.auth_token)
         utils.delete_tenant('test_tenant1', self.auth_token)
         utils.delete_tenant('test_tenant2', self.auth_token)
-        
+
     """ INVALID TEST - we're changing how we delegate access to second tenant
     def test_multi_token(self):
         #get token for user1 with tenant1
@@ -170,7 +175,7 @@ class MultiToken(unittest.TestCase):
         resp = utils.delete_token(token1, self.auth_token)
         resp = utils.delete_token(token2, self.auth_token)
     """
-    
+
     def test_unassigned_user(self):
         resp, content = utils.get_token('test_user2', 'secrete', \
                                 'test_tenant2')
diff --git a/test/unit/test_common.py b/test/unit/test_common.py
index 07c46f50..800f1a7c 100644
--- a/test/unit/test_common.py
+++ b/test/unit/test_common.py
@@ -24,15 +24,13 @@ sys.path.append(os.path.abspath(os.path.join(os.path.abspath(__file__),
                                 '..', '..', '..', '..', 'keystone')))
 import unittest
 
-
-
-URL = 'http://localhost:8080/v2.0/'
-
+URL = 'http://localhost:8081/v2.0/'
+URLv1 = 'http://localhost:8081/v1.0/'
 
 def get_token(user, pswd, tenant_id, kind=''):
     header = httplib2.Http(".cache")
     url = '%stoken' % URL
-    # to test multi token, removing below code
+
     if not tenant_id:
         body = {"passwordCredentials": {"username": user,
                                         "password": pswd}}
@@ -40,7 +38,7 @@ def get_token(user, pswd, tenant_id, kind=''):
         body = {"passwordCredentials": {"username": user,
                                         "password": pswd,
                                         "tenantId": tenant_id}}
-    
+
     resp, content = header.request(url, "POST", body=json.dumps(body),
                               headers={"Content-Type": "application/json"})
 
@@ -55,6 +53,23 @@ def get_token(user, pswd, tenant_id, kind=''):
         return (resp, content)
 
 
+def get_token_legacy(user, pswd, kind=''):
+    header = httplib2.Http(".cache")
+    url = URLv1
+    resp, content = header.request(url, "GET", '',
+                              headers={"Content-Type": "application/json",
+                                       "X-Auth-User": user,
+                                       "X-Auth-Key": pswd})
+
+    if int(resp['status']) == 204:
+        token = resp['x-auth-token']
+    else:
+        token = None
+    if kind == 'token':
+        return token
+    else:
+        return (resp, content)
+
 
 def delete_token(token, auth_token):
     header = httplib2.Http(".cache")
@@ -180,7 +195,8 @@ def get_token_xml(user, pswd, tenant_id, type=''):
                                          "ACCEPT": "application/xml"})
         if int(resp['status']) == 200:
             dom = etree.fromstring(content)
-            root = dom.find("{http://docs.openstack.org/identity/api/v2.0}token")
+            root = dom.find("{http://docs.openstack.org/" \
+                            "identity/api/v2.0}token")
             token_root = root.attrib
             token = str(token_root['id'])
         else:
@@ -318,6 +334,7 @@ def delete_user_xml(tenantid, userid, auth_token):
                                        "ACCEPT": "application/xml"})
     return resp
 
+
 def add_user_json(tenantid, userid, auth_token):
     header = httplib2.Http(".cache")
     url = '%stenants/%s/users/%s/add' % (URL, tenantid, userid)
@@ -676,7 +693,8 @@ def handle_user_resp(self, content, respvalue, resptype):
     if respvalue == 200:
         if resptype == 'application/json':
             content = json.loads(content)
-            self.tenant = content['user']['tenantId']
+            if 'tenantId' in content['user']:
+                self.tenant = content['user']['tenantId']
             self.userid = content['user']['id']
         if resptype == 'application/xml':
             content = etree.fromstring(content)
@@ -686,7 +704,3 @@ def handle_user_resp(self, content, respvalue, resptype):
         self.fail('Identity Fault')
     elif respvalue == 503:
         self.fail('Service Not Available')
-
-
-def content_type(resp):
-    return resp['content-type'].split(';')[0]
diff --git a/test/unit/test_exthandler.py b/test/unit/test_exthandler.py
index 5d41aeac..4379e03f 100644
--- a/test/unit/test_exthandler.py
+++ b/test/unit/test_exthandler.py
@@ -1,3 +1,19 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+# Copyright (c) 2010-2011 OpenStack, LLC.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
 import os
 import sys
 # Need to access identity module
diff --git a/tools/__init__.py b/tools/__init__.py
new file mode 100644
index 00000000..e69de29b
--- /dev/null
+++ b/tools/__init__.py
diff --git a/tools/tracer.py b/tools/tracer.py
new file mode 100644
index 00000000..27d52eb2
--- /dev/null
+++ b/tools/tracer.py
@@ -0,0 +1,108 @@
+#!/usr/bin/env python
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# Copyright 2011 OpenStack LLC.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+#
+# Author: Ziad Sawalha (http://launchpad.net/~ziad-sawalha)
+
+"""
+OpenStack Call Tracing Tool
+
+To use this:
+1. include the tools dirextory in your project (__init__.py and tracer.py)
+2. import tools.tracer as early as possible into your module
+3. add --trace-calls to any argument parsers you use so the argument doesn't get
+flagged as invalid.
+
+Usage:
+# Add this as early as possible in the first module called in your service
+import tools.tracer   #load this first
+
+If a '--trace-calls' parameter is found, it will trace calls to the console and
+space them to show the call graph.
+
+"""
+
+import os
+import sys
+
+
+if '--trace-calls' in sys.argv:
+    stack_depth = 0
+
+    def localtrace(frame, event, arg):
+        global stack_depth
+        if event == "return":
+            stack_depth = stack_depth - 1
+        elif event == "exception":
+            co = frame.f_code
+            func_name = co.co_name
+            line_no = frame.f_lineno
+            filename = co.co_filename
+            exc_type, exc_value, exc_traceback = arg
+            print '\033[91m%sERROR: %s %s on line %s of %s\033[0m' % \
+                ('  ' * stack_depth, exc_type.__name__, exc_value, line_no,
+                 func_name)
+        return None
+
+    def selectivetrace(frame, event, arg):
+        global stack_depth
+        if event == "exception":
+            co = frame.f_code
+            func_name = co.co_name
+            line_no = frame.f_lineno
+            filename = co.co_filename
+            exc_type, exc_value, exc_traceback = arg
+            print '\033[91m%sERROR: %s %s on line %s of %s\033[0m' % \
+                ('  ' * stack_depth, exc_type.__name__, exc_value, line_no,
+                 func_name)
+        if event != 'call':
+            return
+        co = frame.f_code
+        func_name = co.co_name
+        if func_name == 'write':
+            # Ignore write() calls from print statements
+            return
+        func_filename = co.co_filename
+        if func_filename == "<string>":
+            return
+        if func_filename.startswith("/System"):
+            return
+        if func_filename.startswith("/Library"):
+            return
+        if 'macosx' in func_filename:
+            return
+        func_line_no = frame.f_lineno
+        # If ../../keystone/__init__.py exists, add ../ to Python search path, so that
+        # it will override what happens to be installed in /usr/(local/)lib/python...
+        possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
+                                           os.pardir,
+                                           os.pardir))
+        func_filename = func_filename.replace(possible_topdir, '')
+        caller = frame.f_back
+        caller_line_no = caller.f_lineno
+        caller_filename = caller.f_code.co_filename.replace(possible_topdir,
+                                                            '')
+        print '%s%s::%s:%s      (from %s:%s)' % \
+            ('  ' * stack_depth, func_filename, func_name, func_line_no,
+             caller_filename, caller_line_no)
+        stack_depth = stack_depth + 1
+        return localtrace
+
+    sys.settrace(selectivetrace)
+    print 'Starting OpenStack call tracer'