Merge from upstream

38 files changed, 1187 insertions, 984 deletions

diff --git a/bin/nova-api b/bin/nova-api
index ede09d38c..a5027700b 100755
--- a/bin/nova-api
+++ b/bin/nova-api
@@ -1,31 +1,28 @@
 #!/usr/bin/env python
+# pylint: disable-msg=C0103
 # vim: tabstop=4 shiftwidth=4 softtabstop=4
 
 # Copyright 2010 United States Government as represented by the
 # Administrator of the National Aeronautics and Space Administration.
 # All Rights Reserved.
 #
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
+#    Licensed under the Apache License, Version 2.0 (the "License");
+#    you may not use this file except in compliance with the License.
+#    You may obtain a copy of the License at
 #
-#         http://www.apache.org/licenses/LICENSE-2.0
+#        http://www.apache.org/licenses/LICENSE-2.0
 #
 #    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
+#    distributed under the License is distributed on an "AS IS" BASIS,
+#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+#    See the License for the specific language governing permissions and
+#    limitations under the License.
 """
-Tornado daemon for the main API endpoint.
+Nova API daemon.
 """
 
-import logging
 import os
 import sys
-from tornado import httpserver
-from tornado import ioloop
 
 # If ../nova/__init__.py exists, add ../ to Python search path, so that
 # it will override what happens to be installed in /usr/(local/)lib/python...
@@ -36,28 +33,16 @@ if os.path.exists(os.path.join(possible_topdir, 'nova', '__init__.py')):
     sys.path.insert(0, possible_topdir)
 
 from nova import flags
-from nova import server
 from nova import utils
-from nova.endpoint import admin
-from nova.endpoint import api
-from nova.endpoint import cloud
+from nova import server
 
 FLAGS = flags.FLAGS
+flags.DEFINE_integer('api_port', 8773, 'API port')
 
-
-def main(_argv):
-    """Load the controllers and start the tornado I/O loop."""
-    controllers = {
-        'Cloud': cloud.CloudController(),
-        'Admin': admin.AdminController()}
-    _app = api.APIServerApplication(controllers)
-
-    io_inst = ioloop.IOLoop.instance()
-    http_server = httpserver.HTTPServer(_app)
-    http_server.listen(FLAGS.cc_port)
-    logging.debug('Started HTTP server on %s', FLAGS.cc_port)
-    io_inst.start()
-
+def main(_args):
+    from nova import api
+    from nova import wsgi
+    wsgi.run_server(api.API(), FLAGS.api_port)
 
 if __name__ == '__main__':
     utils.default_flagfile()
diff --git a/bin/nova-api-new b/bin/nova-api-new
deleted file mode 100755
index 8625c487f..000000000
--- a/bin/nova-api-new
+++ /dev/null
@@ -1,45 +0,0 @@
-#!/usr/bin/env python
-# pylint: disable-msg=C0103
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright 2010 United States Government as represented by the
-# Administrator of the National Aeronautics and Space Administration.
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License");
-#    you may not use this file except in compliance with the License.
-#    You may obtain a copy of the License at
-#
-#        http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS,
-#    WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-#    See the License for the specific language governing permissions and
-#    limitations under the License.
-"""
-Nova API daemon.
-"""
-
-import os
-import sys
-
-# If ../nova/__init__.py exists, add ../ to Python search path, so that
-# it will override what happens to be installed in /usr/(local/)lib/python...
-possible_topdir = os.path.normpath(os.path.join(os.path.abspath(sys.argv[0]),
-                                   os.pardir,
-                                   os.pardir))
-if os.path.exists(os.path.join(possible_topdir, 'nova', '__init__.py')):
-    sys.path.insert(0, possible_topdir)
-
-from nova import api
-from nova import flags
-from nova import utils
-from nova import wsgi
-
-FLAGS = flags.FLAGS
-flags.DEFINE_integer('api_port', 8773, 'API port')
-
-if __name__ == '__main__':
-    utils.default_flagfile()
-    wsgi.run_server(api.API(), FLAGS.api_port)
diff --git a/bin/nova-manage b/bin/nova-manage
index 824e00ac5..baa1cb4db 100755
--- a/bin/nova-manage
+++ b/bin/nova-manage
@@ -73,7 +73,6 @@ from nova import quota
 from nova import utils
 from nova.auth import manager
 from nova.cloudpipe import pipelib
-from nova.endpoint import cloud
 
 
 FLAGS = flags.FLAGS
@@ -84,7 +83,7 @@ class VpnCommands(object):
 
     def __init__(self):
         self.manager = manager.AuthManager()
-        self.pipe = pipelib.CloudPipe(cloud.CloudController())
+        self.pipe = pipelib.CloudPipe()
 
     def list(self):
         """Print a listing of the VPNs for all projects."""
diff --git a/doc/source/auth.rst b/doc/source/auth.rst
index 70aca704a..3fcb309cd 100644
--- a/doc/source/auth.rst
+++ b/doc/source/auth.rst
@@ -172,14 +172,6 @@ Further Challenges
 
 
 
-The :mod:`rbac` Module
---------------------------
-
-.. automodule:: nova.auth.rbac
-    :members:
-    :undoc-members:
-    :show-inheritance:
-
 The :mod:`signer` Module
 ------------------------
 
diff --git a/nova/api/__init__.py b/nova/api/__init__.py
index 9f116dada..744abd621 100644
--- a/nova/api/__init__.py
+++ b/nova/api/__init__.py
@@ -23,23 +23,65 @@ Root WSGI middleware for all API controllers.
 import routes
 import webob.dec
 
+from nova import flags
 from nova import wsgi
+from nova.api import cloudpipe
 from nova.api import ec2
 from nova.api import rackspace
+from nova.api.ec2 import metadatarequesthandler
+
+
+flags.DEFINE_string('rsapi_subdomain', 'rs', 
+                    'subdomain running the RS API')
+flags.DEFINE_string('ec2api_subdomain', 'ec2', 
+                    'subdomain running the EC2 API')
+flags.DEFINE_string('FAKE_subdomain', None, 
+                    'set to rs or ec2 to fake the subdomain of the host for testing')
+FLAGS = flags.FLAGS
 
 
 class API(wsgi.Router):
     """Routes top-level requests to the appropriate controller."""
 
     def __init__(self):
+        rsdomain =  {'sub_domain': [FLAGS.rsapi_subdomain]}
+        ec2domain = {'sub_domain': [FLAGS.ec2api_subdomain]}
+        # If someone wants to pretend they're hitting the RS subdomain
+        # on their local box, they can set FAKE_subdomain to 'rs', which
+        # removes subdomain restrictions from the RS routes below.
+        if FLAGS.FAKE_subdomain == 'rs':
+            rsdomain = {}
+        elif FLAGS.FAKE_subdomain == 'ec2':
+            ec2domain = {}
         mapper = routes.Mapper()
-        mapper.connect("/", controller=self.versions)
-        mapper.connect("/v1.0/{path_info:.*}", controller=rackspace.API())
-        mapper.connect("/ec2/{path_info:.*}", controller=ec2.API())
+        mapper.sub_domains = True
+        mapper.connect("/", controller=self.rsapi_versions, 
+                            conditions=rsdomain)
+        mapper.connect("/v1.0/{path_info:.*}", controller=rackspace.API(),
+                            conditions=rsdomain)
+
+        mapper.connect("/", controller=self.ec2api_versions,
+                            conditions=ec2domain)
+        mapper.connect("/services/{path_info:.*}", controller=ec2.API(),
+                            conditions=ec2domain)
+        mapper.connect("/cloudpipe/{path_info:.*}", controller=cloudpipe.API())
+        mrh = metadatarequesthandler.MetadataRequestHandler()
+        for s in ['/latest',
+                  '/2009-04-04',
+                  '/2008-09-01',
+                  '/2008-02-01',
+                  '/2007-12-15',
+                  '/2007-10-10',
+                  '/2007-08-29',
+                  '/2007-03-01',
+                  '/2007-01-19',
+                  '/1.0']:
+            mapper.connect('%s/{path_info:.*}' % s, controller=mrh,
+                           conditions=ec2domain)
         super(API, self).__init__(mapper)
 
     @webob.dec.wsgify
-    def versions(self, req):
+    def rsapi_versions(self, req):
         """Respond to a request for all OpenStack API versions."""
         response = {
                 "versions": [
@@ -48,3 +90,22 @@ class API(wsgi.Router):
             "application/xml": {
                 "attributes": dict(version=["status", "id"])}}
         return wsgi.Serializer(req.environ, metadata).to_content_type(response)
+
+    @webob.dec.wsgify
+    def ec2api_versions(self, req):
+        """Respond to a request for all EC2 versions."""
+        # available api versions
+        versions = [
+            '1.0',
+            '2007-01-19',
+            '2007-03-01',
+            '2007-08-29',
+            '2007-10-10',
+            '2007-12-15',
+            '2008-02-01',
+            '2008-09-01',
+            '2009-04-04',
+        ]
+        return ''.join('%s\n' % v for v in versions)
+
+
diff --git a/nova/api/cloudpipe/__init__.py b/nova/api/cloudpipe/__init__.py
new file mode 100644
index 000000000..6d40990a8
--- /dev/null
+++ b/nova/api/cloudpipe/__init__.py
@@ -0,0 +1,69 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+REST API Request Handlers for CloudPipe
+"""
+
+import logging
+import urllib
+import webob
+import webob.dec
+import webob.exc
+
+from nova import crypto
+from nova import wsgi
+from nova.auth import manager
+from nova.api.ec2 import cloud
+
+
+_log = logging.getLogger("api")
+_log.setLevel(logging.DEBUG)
+
+
+class API(wsgi.Application):
+
+    def __init__(self):
+        self.controller = cloud.CloudController()
+
+    @webob.dec.wsgify
+    def __call__(self, req):
+        if req.method == 'POST':
+            return self.sign_csr(req)
+        _log.debug("Cloudpipe path is %s" % req.path_info)
+        if req.path_info.endswith("/getca/"):
+            return self.send_root_ca(req)
+        return webob.exc.HTTPNotFound()
+
+    def get_project_id_from_ip(self, ip):
+        # TODO(eday): This was removed with the ORM branch, fix!
+        instance = self.controller.get_instance_by_ip(ip)
+        return instance['project_id']
+
+    def send_root_ca(self, req):
+        _log.debug("Getting root ca")
+        project_id = self.get_project_id_from_ip(req.remote_addr)
+        res = webob.Response()
+        res.headers["Content-Type"] = "text/plain"
+        res.body = crypto.fetch_ca(project_id)
+        return res
+
+    def sign_csr(self, req):
+        project_id = self.get_project_id_from_ip(req.remote_addr)
+        cert = self.str_params['cert']
+        return crypto.sign_csr(urllib.unquote(cert), project_id)
diff --git a/nova/api/ec2/__init__.py b/nova/api/ec2/__init__.py
index 6eec0abf7..f0aa57ee4 100644
--- a/nova/api/ec2/__init__.py
+++ b/nova/api/ec2/__init__.py
@@ -1,6 +1,7 @@
 # vim: tabstop=4 shiftwidth=4 softtabstop=4
 
-# Copyright 2010 OpenStack LLC.
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
 # All Rights Reserved.
 #
 #    Licensed under the Apache License, Version 2.0 (the "License"); you may
@@ -15,28 +16,223 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-"""
-WSGI middleware for EC2 API controllers.
-"""
+"""Starting point for routing EC2 requests"""
 
+import logging
 import routes
+import webob
 import webob.dec
+import webob.exc
 
+from nova import exception
+from nova import flags
 from nova import wsgi
+from nova.api.ec2 import apirequest
+from nova.api.ec2 import context
+from nova.api.ec2 import admin
+from nova.api.ec2 import cloud
+from nova.auth import manager
 
 
-class API(wsgi.Router):
-    """Routes EC2 requests to the appropriate controller."""
+FLAGS = flags.FLAGS
+_log = logging.getLogger("api")
+_log.setLevel(logging.DEBUG)
+
+
+class API(wsgi.Middleware):
+
+    """Routing for all EC2 API requests."""
 
     def __init__(self):
-        mapper = routes.Mapper()
-        mapper.connect(None, "{all:.*}", controller=self.dummy)
-        super(API, self).__init__(mapper)
+        self.application = Authenticate(Router(Authorizer(Executor())))
+
+
+class Authenticate(wsgi.Middleware):
+
+    """Authenticate an EC2 request and add 'ec2.context' to WSGI environ."""
+
+    @webob.dec.wsgify
+    def __call__(self, req):
+        # Read request signature and access id.
+        try:
+            signature = req.params['Signature']
+            access = req.params['AWSAccessKeyId']
+        except:
+            raise webob.exc.HTTPBadRequest()
+
+        # Make a copy of args for authentication and signature verification.
+        auth_params = dict(req.params)
+        auth_params.pop('Signature') # not part of authentication args
+
+        # Authenticate the request.
+        try:
+            (user, project) = manager.AuthManager().authenticate(
+                    access,
+                    signature,
+                    auth_params,
+                    req.method,
+                    req.host,
+                    req.path)
+        except exception.Error, ex:
+            logging.debug("Authentication Failure: %s" % ex)
+            raise webob.exc.HTTPForbidden()
+
+        # Authenticated!
+        req.environ['ec2.context'] = context.APIRequestContext(user, project)
+        return self.application
+
+
+class Router(wsgi.Middleware):
+
+    """Add ec2.'controller', .'action', and .'action_args' to WSGI environ."""
+
+    def __init__(self, application):
+        super(Router, self).__init__(application)
+        self.map = routes.Mapper()
+        self.map.connect("/{controller_name}/")
+        self.controllers = dict(Cloud=cloud.CloudController(),
+                                Admin=admin.AdminController())
+
+    @webob.dec.wsgify
+    def __call__(self, req):
+        # Obtain the appropriate controller and action for this request.
+        try:
+            match = self.map.match(req.path_info)
+            controller_name = match['controller_name']
+            controller = self.controllers[controller_name]
+        except:
+            raise webob.exc.HTTPNotFound()
+        non_args = ['Action', 'Signature', 'AWSAccessKeyId', 'SignatureMethod',
+                    'SignatureVersion', 'Version', 'Timestamp']
+        args = dict(req.params)
+        try:
+            action = req.params['Action'] # raise KeyError if omitted
+            for non_arg in non_args:
+                args.pop(non_arg) # remove, but raise KeyError if omitted
+        except:
+            raise webob.exc.HTTPBadRequest()
+
+        _log.debug('action: %s' % action)
+        for key, value in args.items():
+            _log.debug('arg: %s\t\tval: %s' % (key, value))
+
+        # Success!
+        req.environ['ec2.controller'] = controller
+        req.environ['ec2.action'] = action
+        req.environ['ec2.action_args'] = args
+        return self.application
+
+
+class Authorizer(wsgi.Middleware):
+
+    """Authorize an EC2 API request.
+
+    Return a 401 if ec2.controller and ec2.action in WSGI environ may not be
+    executed in ec2.context.
+    """
+
+    def __init__(self, application):
+        super(Authorizer, self).__init__(application)
+        self.action_roles = {
+            'CloudController': {
+                'DescribeAvailabilityzones': ['all'],
+                'DescribeRegions': ['all'],
+                'DescribeSnapshots': ['all'],
+                'DescribeKeyPairs': ['all'],
+                'CreateKeyPair': ['all'],
+                'DeleteKeyPair': ['all'],
+                'DescribeSecurityGroups': ['all'],
+                'CreateSecurityGroup': ['netadmin'],
+                'DeleteSecurityGroup': ['netadmin'],
+                'GetConsoleOutput': ['projectmanager', 'sysadmin'],
+                'DescribeVolumes': ['projectmanager', 'sysadmin'],
+                'CreateVolume': ['projectmanager', 'sysadmin'],
+                'AttachVolume': ['projectmanager', 'sysadmin'],
+                'DetachVolume': ['projectmanager', 'sysadmin'],
+                'DescribeInstances': ['all'],
+                'DescribeAddresses': ['all'],
+                'AllocateAddress': ['netadmin'],
+                'ReleaseAddress': ['netadmin'],
+                'AssociateAddress': ['netadmin'],
+                'DisassociateAddress': ['netadmin'],
+                'RunInstances': ['projectmanager', 'sysadmin'],
+                'TerminateInstances': ['projectmanager', 'sysadmin'],
+                'RebootInstances': ['projectmanager', 'sysadmin'],
+                'DeleteVolume': ['projectmanager', 'sysadmin'],
+                'DescribeImages': ['all'],
+                'DeregisterImage': ['projectmanager', 'sysadmin'],
+                'RegisterImage': ['projectmanager', 'sysadmin'],
+                'DescribeImageAttribute': ['all'],
+                'ModifyImageAttribute': ['projectmanager', 'sysadmin'],
+            },
+            'AdminController': {
+                # All actions have the same permission: ['none'] (the default)
+                # superusers will be allowed to run them
+                # all others will get HTTPUnauthorized.
+            },
+        }
 
-    @staticmethod
     @webob.dec.wsgify
-    def dummy(req):
-        """Temporary dummy controller."""
-        msg = "dummy response -- please hook up __init__() to cloud.py instead"
-        return repr({'dummy': msg,
-                     'kwargs': repr(req.environ['wsgiorg.routing_args'][1])})
+    def __call__(self, req):
+        context = req.environ['ec2.context']
+        controller_name = req.environ['ec2.controller'].__class__.__name__
+        action = req.environ['ec2.action']
+        allowed_roles = self.action_roles[controller_name].get(action, ['none'])
+        if self._matches_any_role(context, allowed_roles):
+            return self.application
+        else:
+            raise webob.exc.HTTPUnauthorized()
+
+    def _matches_any_role(self, context, roles):
+        """Return True if any role in roles is allowed in context."""
+        if context.user.is_superuser():
+            return True
+        if 'all' in roles:
+            return True
+        if 'none' in roles:
+            return False
+        return any(context.project.has_role(context.user.id, role) 
+                   for role in roles)
+    
+
+class Executor(wsgi.Application):
+
+    """Execute an EC2 API request.
+
+    Executes 'ec2.action' upon 'ec2.controller', passing 'ec2.context' and 
+    'ec2.action_args' (all variables in WSGI environ.)  Returns an XML
+    response, or a 400 upon failure.
+    """
+
+    @webob.dec.wsgify
+    def __call__(self, req):
+        context = req.environ['ec2.context']
+        controller = req.environ['ec2.controller']
+        action = req.environ['ec2.action']
+        args = req.environ['ec2.action_args']
+
+        api_request = apirequest.APIRequest(controller, action)
+        try:
+            result = api_request.send(context, **args)
+            req.headers['Content-Type'] = 'text/xml'
+            return result
+        except exception.ApiError as ex:
+
+            if ex.code:
+                return self._error(req, ex.code, ex.message)
+            else:
+                return self._error(req, type(ex).__name__, ex.message)
+        # TODO(vish): do something more useful with unknown exceptions
+        except Exception as ex:
+            return self._error(req, type(ex).__name__, str(ex))
+
+    def _error(self, req, code, message):
+        resp = webob.Response()
+        resp.status = 400
+        resp.headers['Content-Type'] = 'text/xml'
+        resp.body = ('<?xml version="1.0"?>\n'
+                     '<Response><Errors><Error><Code>%s</Code>'
+                     '<Message>%s</Message></Error></Errors>'
+                     '<RequestID>?</RequestID></Response>') % (code, message)
+        return resp
+
diff --git a/nova/endpoint/admin.py b/nova/api/ec2/admin.py
index c6dcb5320..36feae451 100644
--- a/nova/endpoint/admin.py
+++ b/nova/api/ec2/admin.py
@@ -58,46 +58,27 @@ def host_dict(host):
         return {}
 
 
-def admin_only(target):
-    """Decorator for admin-only API calls"""
-    def wrapper(*args, **kwargs):
-        """Internal wrapper method for admin-only API calls"""
-        context = args[1]
-        if context.user.is_admin():
-            return target(*args, **kwargs)
-        else:
-            return {}
-
-    return wrapper
-
-
 class AdminController(object):
     """
     API Controller for users, hosts, nodes, and workers.
-    Trivial admin_only wrapper will be replaced with RBAC,
-    allowing project managers to administer project users.
     """
 
     def __str__(self):
         return 'AdminController'
 
-    @admin_only
     def describe_user(self, _context, name, **_kwargs):
         """Returns user data, including access and secret keys."""
         return user_dict(manager.AuthManager().get_user(name))
 
-    @admin_only
     def describe_users(self, _context, **_kwargs):
         """Returns all users - should be changed to deal with a list."""
         return {'userSet':
             [user_dict(u) for u in manager.AuthManager().get_users()] }
 
-    @admin_only
     def register_user(self, _context, name, **_kwargs):
         """Creates a new user, and returns generated credentials."""
         return user_dict(manager.AuthManager().create_user(name))
 
-    @admin_only
     def deregister_user(self, _context, name, **_kwargs):
         """Deletes a single user (NOT undoable.)
            Should throw an exception if the user has instances,
@@ -107,13 +88,11 @@ class AdminController(object):
 
         return True
 
-    @admin_only
     def describe_roles(self, context, project_roles=True, **kwargs):
         """Returns a list of allowed roles."""
         roles = manager.AuthManager().get_roles(project_roles)
         return { 'roles': [{'role': r} for r in roles]}
 
-    @admin_only
     def describe_user_roles(self, context, user, project=None, **kwargs):
         """Returns a list of roles for the given user.
            Omitting project will return any global roles that the user has.
@@ -122,7 +101,6 @@ class AdminController(object):
         roles = manager.AuthManager().get_user_roles(user, project=project)
         return { 'roles': [{'role': r} for r in roles]}
 
-    @admin_only
     def modify_user_role(self, context, user, role, project=None,
                          operation='add', **kwargs):
         """Add or remove a role for a user and project."""
@@ -135,7 +113,6 @@ class AdminController(object):
 
         return True
 
-    @admin_only
     def generate_x509_for_user(self, _context, name, project=None, **kwargs):
         """Generates and returns an x509 certificate for a single user.
            Is usually called from a client that will wrap this with
@@ -147,19 +124,16 @@ class AdminController(object):
         user = manager.AuthManager().get_user(name)
         return user_dict(user, base64.b64encode(project.get_credentials(user)))
 
-    @admin_only
     def describe_project(self, context, name, **kwargs):
         """Returns project data, including member ids."""
         return project_dict(manager.AuthManager().get_project(name))
 
-    @admin_only
     def describe_projects(self, context, user=None, **kwargs):
         """Returns all projects - should be changed to deal with a list."""
         return {'projectSet':
             [project_dict(u) for u in
             manager.AuthManager().get_projects(user=user)]}
 
-    @admin_only
     def register_project(self, context, name, manager_user, description=None,
                          member_users=None, **kwargs):
         """Creates a new project"""
@@ -170,20 +144,17 @@ class AdminController(object):
                 description=None,
                 member_users=None))
 
-    @admin_only
     def deregister_project(self, context, name):
         """Permanently deletes a project."""
         manager.AuthManager().delete_project(name)
         return True
 
-    @admin_only
     def describe_project_members(self, context, name, **kwargs):
         project = manager.AuthManager().get_project(name)
         result = {
             'members': [{'member': m} for m in project.member_ids]}
         return result
 
-    @admin_only
     def modify_project_member(self, context, user, project, operation, **kwargs):
         """Add or remove a user from a project."""
         if operation =='add':
@@ -196,7 +167,6 @@ class AdminController(object):
 
     # FIXME(vish): these host commands don't work yet, perhaps some of the
     #              required data can be retrieved from service objects?
-    @admin_only
     def describe_hosts(self, _context, **_kwargs):
         """Returns status info for all nodes. Includes:
             * Disk Space
@@ -208,7 +178,6 @@ class AdminController(object):
         """
         return {'hostSet': [host_dict(h) for h in db.host_get_all()]}
 
-    @admin_only
     def describe_host(self, _context, name, **_kwargs):
         """Returns status info for single node."""
         return host_dict(db.host_get(name))
diff --git a/nova/api/ec2/apirequest.py b/nova/api/ec2/apirequest.py
new file mode 100644
index 000000000..a87c21fb3
--- /dev/null
+++ b/nova/api/ec2/apirequest.py
@@ -0,0 +1,131 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+APIRequest class
+"""
+
+import logging
+import re
+# TODO(termie): replace minidom with etree
+from xml.dom import minidom
+
+_log = logging.getLogger("api")
+_log.setLevel(logging.DEBUG)
+
+
+_c2u = re.compile('(((?<=[a-z])[A-Z])|([A-Z](?![A-Z]|$)))')
+
+
+def _camelcase_to_underscore(str):
+    return _c2u.sub(r'_\1', str).lower().strip('_')
+
+
+def _underscore_to_camelcase(str):
+    return ''.join([x[:1].upper() + x[1:] for x in str.split('_')])
+
+
+def _underscore_to_xmlcase(str):
+    res = _underscore_to_camelcase(str)
+    return res[:1].lower() + res[1:]
+
+
+class APIRequest(object):
+    def __init__(self, controller, action):
+        self.controller = controller
+        self.action = action
+
+    def send(self, context, **kwargs):
+        try:
+            method = getattr(self.controller,
+                             _camelcase_to_underscore(self.action))
+        except AttributeError:
+            _error = ('Unsupported API request: controller = %s,'
+                      'action = %s') % (self.controller, self.action)
+            _log.warning(_error)
+            # TODO: Raise custom exception, trap in apiserver,
+            #       and reraise as 400 error.
+            raise Exception(_error)
+
+        args = {}
+        for key, value in kwargs.items():
+            parts = key.split(".")
+            key = _camelcase_to_underscore(parts[0])
+            if len(parts) > 1:
+                d = args.get(key, {})
+                d[parts[1]] = value
+                value = d
+            args[key] = value
+
+        for key in args.keys():
+            if isinstance(args[key], dict):
+                if args[key] != {} and args[key].keys()[0].isdigit():
+                    s = args[key].items()
+                    s.sort()
+                    args[key] = [v for k, v in s]
+
+        result = method(context, **args)
+        return self._render_response(result, context.request_id)
+
+    def _render_response(self, response_data, request_id):
+        xml = minidom.Document()
+
+        response_el = xml.createElement(self.action + 'Response')
+        response_el.setAttribute('xmlns',
+                                 'http://ec2.amazonaws.com/doc/2009-11-30/')
+        request_id_el = xml.createElement('requestId')
+        request_id_el.appendChild(xml.createTextNode(request_id))
+        response_el.appendChild(request_id_el)
+        if(response_data == True):
+            self._render_dict(xml, response_el, {'return': 'true'})
+        else:
+            self._render_dict(xml, response_el, response_data)
+
+        xml.appendChild(response_el)
+
+        response = xml.toxml()
+        xml.unlink()
+        _log.debug(response)
+        return response
+
+    def _render_dict(self, xml, el, data):
+        try:
+            for key in data.keys():
+                val = data[key]
+                el.appendChild(self._render_data(xml, key, val))
+        except:
+            _log.debug(data)
+            raise
+
+    def _render_data(self, xml, el_name, data):
+        el_name = _underscore_to_xmlcase(el_name)
+        data_el = xml.createElement(el_name)
+
+        if isinstance(data, list):
+            for item in data:
+                data_el.appendChild(self._render_data(xml, 'item', item))
+        elif isinstance(data, dict):
+            self._render_dict(xml, data_el, data)
+        elif hasattr(data, '__dict__'):
+            self._render_dict(xml, data_el, data.__dict__)
+        elif isinstance(data, bool):
+            data_el.appendChild(xml.createTextNode(str(data).lower()))
+        elif data != None:
+            data_el.appendChild(xml.createTextNode(str(data)))
+
+        return data_el
diff --git a/nova/endpoint/cloud.py b/nova/api/ec2/cloud.py
index 261e3e001..367511e3b 100644
--- a/nova/endpoint/cloud.py
+++ b/nova/api/ec2/cloud.py
@@ -28,8 +28,6 @@ import logging
 import os
 import time
 
-from twisted.internet import defer
-
 from nova import crypto
 from nova import db
 from nova import exception
@@ -37,9 +35,8 @@ from nova import flags
 from nova import quota
 from nova import rpc
 from nova import utils
-from nova.auth import rbac
 from nova.compute.instance_types import INSTANCE_TYPES
-from nova.endpoint import images
+from nova.api.ec2 import images
 
 
 FLAGS = flags.FLAGS
@@ -56,25 +53,22 @@ def _gen_key(context, user_id, key_name):
 
     This is a module level method because it is slow and we need to defer
     it into a process pool."""
+    # NOTE(vish): generating key pair is slow so check for legal
+    #             creation before creating key_pair
     try:
-        # NOTE(vish): generating key pair is slow so check for legal
-        #             creation before creating key_pair
-        try:
-            db.key_pair_get(context, user_id, key_name)
-            raise exception.Duplicate("The key_pair %s already exists"
-                                      % key_name)
-        except exception.NotFound:
-            pass
-        private_key, public_key, fingerprint = crypto.generate_key_pair()
-        key = {}
-        key['user_id'] = user_id
-        key['name'] = key_name
-        key['public_key'] = public_key
-        key['fingerprint'] = fingerprint
-        db.key_pair_create(context, key)
-        return {'private_key': private_key, 'fingerprint': fingerprint}
-    except Exception as ex:
-        return {'exception': ex}
+        db.key_pair_get(context, user_id, key_name)
+        raise exception.Duplicate("The key_pair %s already exists"
+                                  % key_name)
+    except exception.NotFound:
+        pass
+    private_key, public_key, fingerprint = crypto.generate_key_pair()
+    key = {}
+    key['user_id'] = user_id
+    key['name'] = key_name
+    key['public_key'] = public_key
+    key['fingerprint'] = fingerprint
+    db.key_pair_create(context, key)
+    return {'private_key': private_key, 'fingerprint': fingerprint}
 
 
 class CloudController(object):
@@ -172,12 +166,10 @@ class CloudController(object):
             data['product-codes'] = []
         return data
 
-    @rbac.allow('all')
     def describe_availability_zones(self, context, **kwargs):
         return {'availabilityZoneInfo': [{'zoneName': 'nova',
                                           'zoneState': 'available'}]}
 
-    @rbac.allow('all')
     def describe_regions(self, context, region_name=None, **kwargs):
         if FLAGS.region_list:
             regions = []
@@ -192,7 +184,6 @@ class CloudController(object):
             regions = [r for r in regions if r['regionName'] in region_name]
         return {'regionInfo': regions }
 
-    @rbac.allow('all')
     def describe_snapshots(self,
                            context,
                            snapshot_id=None,
@@ -208,7 +199,6 @@ class CloudController(object):
                                  'volumeSize': 0,
                                  'description': 'fixme'}]}
 
-    @rbac.allow('all')
     def describe_key_pairs(self, context, key_name=None, **kwargs):
         key_pairs = db.key_pair_get_all_by_user(context, context.user.id)
         if not key_name is None:
@@ -226,23 +216,13 @@ class CloudController(object):
 
         return {'keypairsSet': result}
 
-    @rbac.allow('all')
     def create_key_pair(self, context, key_name, **kwargs):
-        dcall = defer.Deferred()
-        pool = context.handler.application.settings.get('pool')
-        def _complete(kwargs):
-            if 'exception' in kwargs:
-                dcall.errback(kwargs['exception'])
-                return
-            dcall.callback({'keyName': key_name,
-                'keyFingerprint': kwargs['fingerprint'],
-                'keyMaterial': kwargs['private_key']})
+        data = _gen_key(None, context.user.id, key_name)
+        return {'keyName': key_name,
+                'keyFingerprint': data['fingerprint'],
+                'keyMaterial': data['private_key']}
         # TODO(vish): when context is no longer an object, pass it here
-        pool.apply_async(_gen_key, [None, context.user.id, key_name],
-            callback=_complete)
-        return dcall
 
-    @rbac.allow('all')
     def delete_key_pair(self, context, key_name, **kwargs):
         try:
             db.key_pair_destroy(context, context.user.id, key_name)
@@ -251,22 +231,18 @@ class CloudController(object):
             pass
         return True
 
-    @rbac.allow('all')
     def describe_security_groups(self, context, group_names, **kwargs):
         groups = {'securityGroupSet': []}
 
         # Stubbed for now to unblock other things.
         return groups
 
-    @rbac.allow('netadmin')
     def create_security_group(self, context, group_name, **kwargs):
         return True
 
-    @rbac.allow('netadmin')
     def delete_security_group(self, context, group_name, **kwargs):
         return True
 
-    @rbac.allow('projectmanager', 'sysadmin')
     def get_console_output(self, context, instance_id, **kwargs):
         # instance_id is passed in as a list of instances
         instance_ref = db.instance_get_by_str(context, instance_id[0])
@@ -276,7 +252,6 @@ class CloudController(object):
                          "args": {"context": None,
                                   "instance_id": instance_ref['id']}})
 
-    @rbac.allow('projectmanager', 'sysadmin')
     def describe_volumes(self, context, **kwargs):
         if context.user.is_admin():
             volumes = db.volume_get_all(context)
@@ -312,7 +287,6 @@ class CloudController(object):
             v['attachmentSet'] = [{}]
         return v
 
-    @rbac.allow('projectmanager', 'sysadmin')
     def create_volume(self, context, size, **kwargs):
         # check quota
         if quota.allowed_volumes(context, 1, size) < 1:
@@ -339,7 +313,6 @@ class CloudController(object):
         return {'volumeSet': [self._format_volume(context, volume_ref)]}
 
 
-    @rbac.allow('projectmanager', 'sysadmin')
     def attach_volume(self, context, volume_id, instance_id, device, **kwargs):
         volume_ref = db.volume_get_by_str(context, volume_id)
         # TODO(vish): abstract status checking?
@@ -355,14 +328,13 @@ class CloudController(object):
                                           "volume_id": volume_ref['id'],
                                           "instance_id": instance_ref['id'],
                                           "mountpoint": device}})
-        return defer.succeed({'attachTime': volume_ref['attach_time'],
-                              'device': volume_ref['mountpoint'],
-                              'instanceId': instance_ref['id'],
-                              'requestId': context.request_id,
-                              'status': volume_ref['attach_status'],
-                              'volumeId': volume_ref['id']})
-
-    @rbac.allow('projectmanager', 'sysadmin')
+        return {'attachTime': volume_ref['attach_time'],
+                'device': volume_ref['mountpoint'],
+                'instanceId': instance_ref['id'],
+                'requestId': context.request_id,
+                'status': volume_ref['attach_status'],
+                'volumeId': volume_ref['id']}
+
     def detach_volume(self, context, volume_id, **kwargs):
         volume_ref = db.volume_get_by_str(context, volume_id)
         instance_ref = db.volume_get_instance(context, volume_ref['id'])
@@ -382,12 +354,12 @@ class CloudController(object):
             # If the instance doesn't exist anymore,
             # then we need to call detach blind
             db.volume_detached(context)
-        return defer.succeed({'attachTime': volume_ref['attach_time'],
-                              'device': volume_ref['mountpoint'],
-                              'instanceId': instance_ref['str_id'],
-                              'requestId': context.request_id,
-                              'status': volume_ref['attach_status'],
-                              'volumeId': volume_ref['id']})
+        return {'attachTime': volume_ref['attach_time'],
+                'device': volume_ref['mountpoint'],
+                'instanceId': instance_ref['str_id'],
+                'requestId': context.request_id,
+                'status': volume_ref['attach_status'],
+                'volumeId': volume_ref['id']}
 
     def _convert_to_set(self, lst, label):
         if lst == None or lst == []:
@@ -396,9 +368,8 @@ class CloudController(object):
             lst = [lst]
         return [{label: x} for x in lst]
 
-    @rbac.allow('all')
     def describe_instances(self, context, **kwargs):
-        return defer.succeed(self._format_describe_instances(context))
+        return self._format_describe_instances(context)
 
     def _format_describe_instances(self, context):
         return { 'reservationSet': self._format_instances(context) }
@@ -460,7 +431,6 @@ class CloudController(object):
 
         return list(reservations.values())
 
-    @rbac.allow('all')
     def describe_addresses(self, context, **kwargs):
         return self.format_addresses(context)
 
@@ -486,8 +456,6 @@ class CloudController(object):
             addresses.append(address_rv)
         return {'addressesSet': addresses}
 
-    @rbac.allow('netadmin')
-    @defer.inlineCallbacks
     def allocate_address(self, context, **kwargs):
         # check quota
         if quota.allowed_floating_ips(context, 1) < 1:
@@ -495,64 +463,55 @@ class CloudController(object):
                          context.project.id)
             raise QuotaError("Address quota exceeded. You cannot "
                              "allocate any more addresses")
-        network_topic = yield self._get_network_topic(context)
-        public_ip = yield rpc.call(network_topic,
+        network_topic = self._get_network_topic(context)
+        public_ip = rpc.call(network_topic,
                          {"method": "allocate_floating_ip",
                           "args": {"context": None,
                                    "project_id": context.project.id}})
-        defer.returnValue({'addressSet': [{'publicIp': public_ip}]})
+        return {'addressSet': [{'publicIp': public_ip}]}
 
-    @rbac.allow('netadmin')
-    @defer.inlineCallbacks
     def release_address(self, context, public_ip, **kwargs):
         # NOTE(vish): Should we make sure this works?
         floating_ip_ref = db.floating_ip_get_by_address(context, public_ip)
-        network_topic = yield self._get_network_topic(context)
+        network_topic = self._get_network_topic(context)
         rpc.cast(network_topic,
                  {"method": "deallocate_floating_ip",
                   "args": {"context": None,
                            "floating_address": floating_ip_ref['str_id']}})
-        defer.returnValue({'releaseResponse': ["Address released."]})
+        return {'releaseResponse': ["Address released."]}
 
-    @rbac.allow('netadmin')
-    @defer.inlineCallbacks
     def associate_address(self, context, instance_id, public_ip, **kwargs):
         instance_ref = db.instance_get_by_str(context, instance_id)
         fixed_ip_ref = db.fixed_ip_get_by_instance(context, instance_ref['id'])
         floating_ip_ref = db.floating_ip_get_by_address(context, public_ip)
-        network_topic = yield self._get_network_topic(context)
+        network_topic = self._get_network_topic(context)
         rpc.cast(network_topic,
                  {"method": "associate_floating_ip",
                   "args": {"context": None,
                            "floating_address": floating_ip_ref['str_id'],
                            "fixed_address": fixed_ip_ref['str_id']}})
-        defer.returnValue({'associateResponse': ["Address associated."]})
+        return {'associateResponse': ["Address associated."]}
 
-    @rbac.allow('netadmin')
-    @defer.inlineCallbacks
     def disassociate_address(self, context, public_ip, **kwargs):
         floating_ip_ref = db.floating_ip_get_by_address(context, public_ip)
-        network_topic = yield self._get_network_topic(context)
+        network_topic = self._get_network_topic(context)
         rpc.cast(network_topic,
                  {"method": "disassociate_floating_ip",
                   "args": {"context": None,
                            "floating_address": floating_ip_ref['str_id']}})
-        defer.returnValue({'disassociateResponse': ["Address disassociated."]})
+        return {'disassociateResponse': ["Address disassociated."]}
 
-    @defer.inlineCallbacks
     def _get_network_topic(self, context):
         """Retrieves the network host for a project"""
         network_ref = db.project_get_network(context, context.project.id)
         host = network_ref['host']
         if not host:
-            host = yield rpc.call(FLAGS.network_topic,
+            host = rpc.call(FLAGS.network_topic,
                                   {"method": "set_network_host",
                                    "args": {"context": None,
                                             "project_id": context.project.id}})
-        defer.returnValue(db.queue_get_for(context, FLAGS.network_topic, host))
+        return db.queue_get_for(context, FLAGS.network_topic, host)
 
-    @rbac.allow('projectmanager', 'sysadmin')
-    @defer.inlineCallbacks
     def run_instances(self, context, **kwargs):
         instance_type = kwargs.get('instance_type', 'm1.small')
         if instance_type not in INSTANCE_TYPES:
@@ -638,7 +597,7 @@ class CloudController(object):
 
             # TODO(vish): This probably should be done in the scheduler
             #             network is setup when host is assigned
-            network_topic = yield self._get_network_topic(context)
+            network_topic = self._get_network_topic(context)
             rpc.call(network_topic,
                      {"method": "setup_fixed_ip",
                       "args": {"context": None,
@@ -651,12 +610,9 @@ class CloudController(object):
                                "instance_id": inst_id}})
             logging.debug("Casting to scheduler for %s/%s's instance %s" %
                       (context.project.name, context.user.name, inst_id))
-        defer.returnValue(self._format_run_instances(context,
-                                                     reservation_id))
+        return self._format_run_instances(context, reservation_id)
 
 
-    @rbac.allow('projectmanager', 'sysadmin')
-    @defer.inlineCallbacks
     def terminate_instances(self, context, instance_id, **kwargs):
         logging.debug("Going to start terminating instances")
         for id_str in instance_id:
@@ -680,7 +636,7 @@ class CloudController(object):
                 # NOTE(vish): Right now we don't really care if the ip is
                 #             disassociated.  We may need to worry about
                 #             checking this later.  Perhaps in the scheduler?
-                network_topic = yield self._get_network_topic(context)
+                network_topic = self._get_network_topic(context)
                 rpc.cast(network_topic,
                          {"method": "disassociate_floating_ip",
                           "args": {"context": None,
@@ -703,9 +659,8 @@ class CloudController(object):
                                    "instance_id": instance_ref['id']}})
             else:
                 db.instance_destroy(context, instance_ref['id'])
-        defer.returnValue(True)
+        return True
 
-    @rbac.allow('projectmanager', 'sysadmin')
     def reboot_instances(self, context, instance_id, **kwargs):
         """instance_id is a list of instance ids"""
         for id_str in instance_id:
@@ -715,9 +670,8 @@ class CloudController(object):
                      {"method": "reboot_instance",
                       "args": {"context": None,
                                "instance_id": instance_ref['id']}})
-        return defer.succeed(True)
+        return True
 
-    @rbac.allow('projectmanager', 'sysadmin')
     def delete_volume(self, context, volume_id, **kwargs):
         # TODO: return error if not authorized
         volume_ref = db.volume_get_by_str(context, volume_id)
@@ -730,31 +684,26 @@ class CloudController(object):
                             {"method": "delete_volume",
                              "args": {"context": None,
                                       "volume_id": volume_ref['id']}})
-        return defer.succeed(True)
+        return True
 
-    @rbac.allow('all')
     def describe_images(self, context, image_id=None, **kwargs):
         # The objectstore does its own authorization for describe
         imageSet = images.list(context, image_id)
-        return defer.succeed({'imagesSet': imageSet})
+        return {'imagesSet': imageSet}
 
-    @rbac.allow('projectmanager', 'sysadmin')
     def deregister_image(self, context, image_id, **kwargs):
         # FIXME: should the objectstore be doing these authorization checks?
         images.deregister(context, image_id)
-        return defer.succeed({'imageId': image_id})
+        return {'imageId': image_id}
 
-    @rbac.allow('projectmanager', 'sysadmin')
     def register_image(self, context, image_location=None, **kwargs):
         # FIXME: should the objectstore be doing these authorization checks?
         if image_location is None and kwargs.has_key('name'):
             image_location = kwargs['name']
         image_id = images.register(context, image_location)
         logging.debug("Registered %s as %s" % (image_location, image_id))
+        return {'imageId': image_id}
 
-        return defer.succeed({'imageId': image_id})
-
-    @rbac.allow('all')
     def describe_image_attribute(self, context, image_id, attribute, **kwargs):
         if attribute != 'launchPermission':
             raise exception.ApiError('attribute not supported: %s' % attribute)
@@ -765,9 +714,8 @@ class CloudController(object):
         result = {'image_id': image_id, 'launchPermission': []}
         if image['isPublic']:
             result['launchPermission'].append({'group': 'all'})
-        return defer.succeed(result)
+        return result
 
-    @rbac.allow('projectmanager', 'sysadmin')
     def modify_image_attribute(self, context, image_id, attribute, operation_type, **kwargs):
         # TODO(devcamcar): Support users and groups other than 'all'.
         if attribute != 'launchPermission':
@@ -778,5 +726,4 @@ class CloudController(object):
             raise exception.ApiError('only group "all" is supported')
         if not operation_type in ['add', 'remove']:
             raise exception.ApiError('operation_type must be add or remove')
-        result = images.modify(context, image_id, operation_type)
-        return defer.succeed(result)
+        return images.modify(context, image_id, operation_type)
diff --git a/nova/api/ec2/context.py b/nova/api/ec2/context.py
new file mode 100644
index 000000000..c53ba98d9
--- /dev/null
+++ b/nova/api/ec2/context.py
@@ -0,0 +1,33 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""
+APIRequestContext
+"""
+
+import random
+
+
+class APIRequestContext(object):
+    def __init__(self, user, project):
+        self.user = user
+        self.project = project
+        self.request_id = ''.join(
+                [random.choice('ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-')
+                 for x in xrange(20)]
+                )
diff --git a/nova/endpoint/images.py b/nova/api/ec2/images.py
index 4579cd81a..4579cd81a 100644
--- a/nova/endpoint/images.py
+++ b/nova/api/ec2/images.py
diff --git a/nova/api/ec2/metadatarequesthandler.py b/nova/api/ec2/metadatarequesthandler.py
new file mode 100644
index 000000000..08a8040ca
--- /dev/null
+++ b/nova/api/ec2/metadatarequesthandler.py
@@ -0,0 +1,73 @@
+# vim: tabstop=4 shiftwidth=4 softtabstop=4
+
+# Copyright 2010 United States Government as represented by the
+# Administrator of the National Aeronautics and Space Administration.
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+"""Metadata request handler."""
+
+import logging
+
+import webob.dec
+import webob.exc
+
+from nova.api.ec2 import cloud
+
+
+class MetadataRequestHandler(object):
+
+    """Serve metadata from the EC2 API."""
+
+    def print_data(self, data):
+        if isinstance(data, dict):
+            output = ''
+            for key in data:
+                if key == '_name':
+                    continue
+                output += key
+                if isinstance(data[key], dict):
+                    if '_name' in data[key]:
+                        output += '=' + str(data[key]['_name'])
+                    else:
+                        output += '/'
+                output += '\n'
+            return output[:-1] # cut off last \n
+        elif isinstance(data, list):
+            return '\n'.join(data)
+        else:
+            return str(data)
+
+    def lookup(self, path, data):
+        items = path.split('/')
+        for item in items:
+            if item:
+                if not isinstance(data, dict):
+                    return data
+                if not item in data:
+                    return None
+                data = data[item]
+        return data
+
+    @webob.dec.wsgify
+    def __call__(self, req):
+        cc = cloud.CloudController()
+        meta_data = cc.get_metadata(req.remote_addr)
+        if meta_data is None:
+            logging.error('Failed to get metadata for ip: %s' % req.remote_addr)
+            raise webob.exc.HTTPNotFound()
+        data = self.lookup(req.path_info, meta_data)
+        if data is None:
+            raise webob.exc.HTTPNotFound()
+        return self.print_data(data)
diff --git a/nova/api/rackspace/__init__.py b/nova/api/rackspace/__init__.py
index 736486733..63b0edc6a 100644
--- a/nova/api/rackspace/__init__.py
+++ b/nova/api/rackspace/__init__.py
@@ -26,8 +26,10 @@ import time
 import routes
 import webob.dec
 import webob.exc
+import webob
 
 from nova import flags
+from nova import utils
 from nova import wsgi
 from nova.api.rackspace import flavors
 from nova.api.rackspace import images
@@ -37,6 +39,11 @@ from nova.api.rackspace import sharedipgroups
 from nova.auth import manager
 
 
+FLAGS = flags.FLAGS
+flags.DEFINE_string('nova_api_auth',
+    'nova.api.rackspace.auth.BasicApiAuthManager', 
+    'The auth mechanism to use for the Rackspace API implemenation')
+
 class API(wsgi.Middleware):
     """WSGI entry point for all Rackspace API requests."""
 
@@ -44,28 +51,26 @@ class API(wsgi.Middleware):
         app = AuthMiddleware(RateLimitingMiddleware(APIRouter()))
         super(API, self).__init__(app)
 
-
 class AuthMiddleware(wsgi.Middleware):
     """Authorize the rackspace API request or return an HTTP Forbidden."""
 
-    #TODO(gundlach): isn't this the old Nova API's auth?  Should it be replaced
-    #with correct RS API auth?
+    def __init__(self, application):
+        self.auth_driver = utils.import_class(FLAGS.nova_api_auth)()
+        super(AuthMiddleware, self).__init__(application)
 
     @webob.dec.wsgify
     def __call__(self, req):
-        context = {}
-        if "HTTP_X_AUTH_TOKEN" in req.environ:
-            context['user'] = manager.AuthManager().get_user_from_access_key(
-                              req.environ['HTTP_X_AUTH_TOKEN'])
-            if context['user']:
-                context['project'] = manager.AuthManager().get_project(
-                                     context['user'].name)
-        if "user" not in context:
-            return webob.exc.HTTPForbidden()
+        if not req.headers.has_key("X-Auth-Token"):
+            return self.auth_driver.authenticate(req)
+
+        user = self.auth_driver.authorize_token(req.headers["X-Auth-Token"])
+
+        if not user:
+            return webob.exc.HTTPUnauthorized()
+        context = {'user': user}
         req.environ['nova.context'] = context
         return self.application
 
-
 class RateLimitingMiddleware(wsgi.Middleware):
     """Rate limit incoming requests according to the OpenStack rate limits."""
 
diff --git a/nova/api/rackspace/auth.py b/nova/api/rackspace/auth.py
new file mode 100644
index 000000000..ce5a967eb
--- /dev/null
+++ b/nova/api/rackspace/auth.py
@@ -0,0 +1,98 @@
+import datetime
+import json
+import time
+import webob.exc
+import webob.dec
+import hashlib
+from nova import flags
+from nova import auth
+from nova import manager
+from nova import db
+from nova import utils
+
+FLAGS = flags.FLAGS
+
+class Context(object):
+    pass
+
+class BasicApiAuthManager(object):
+    """ Implements a somewhat rudimentary version of Rackspace Auth"""
+
+    def __init__(self, host=None, db_driver=None):
+        if not host:
+            host = FLAGS.host
+        self.host = host                                                                                                                                     
+        if not db_driver:
+            db_driver = FLAGS.db_driver                                                                                                                      
+        self.db = utils.import_object(db_driver)
+        self.auth = auth.manager.AuthManager()
+        self.context = Context()
+        super(BasicApiAuthManager, self).__init__()
+
+    def authenticate(self, req):
+        # Unless the request is explicitly made against /<version>/ don't
+        # honor it
+        path_info = req.path_info
+        if len(path_info) > 1:
+            return webob.exc.HTTPUnauthorized()
+
+        try:
+            username, key = req.headers['X-Auth-User'], \
+                req.headers['X-Auth-Key']
+        except KeyError:
+            return webob.exc.HTTPUnauthorized()
+
+        username, key = req.headers['X-Auth-User'], req.headers['X-Auth-Key']
+        token, user = self._authorize_user(username, key)
+        if user and token:
+            res = webob.Response()
+            res.headers['X-Auth-Token'] = token['token_hash']
+            res.headers['X-Server-Management-Url'] = \
+                token['server_management_url']
+            res.headers['X-Storage-Url'] = token['storage_url']
+            res.headers['X-CDN-Management-Url'] = token['cdn_management_url']
+            res.content_type = 'text/plain'
+            res.status = '204'
+            return res
+        else:
+            return webob.exc.HTTPUnauthorized()
+
+    def authorize_token(self, token_hash):
+        """ retrieves user information from the datastore given a token
+        
+        If the token has expired, returns None
+        If the token is not found, returns None
+        Otherwise returns the token
+
+        This method will also remove the token if the timestamp is older than
+        2 days ago.
+        """
+        token = self.db.auth_get_token(self.context, token_hash) 
+        if token:
+            delta = datetime.datetime.now() - token['created_at']
+            if delta.days >= 2:
+                self.db.auth_destroy_token(self.context, token)
+            else:
+                user = self.auth.get_user(token['user_id'])
+                return { 'id':user['uid'] }
+        return None
+
+    def _authorize_user(self, username, key):
+        """ Generates a new token and assigns it to a user """
+        user = self.auth.get_user_from_access_key(key)
+        if user and user['name'] == username:
+            token_hash = hashlib.sha1('%s%s%f' % (username, key,
+                time.time())).hexdigest()
+            token = {}
+            token['token_hash'] = token_hash
+            token['cdn_management_url'] = ''
+            token['server_management_url'] = self._get_server_mgmt_url()
+            token['storage_url'] = ''
+            token['user_id'] = user['uid']
+            self.db.auth_create_token(self.context, token)
+            return token, user
+        return None, None 
+
+    def _get_server_mgmt_url(self):
+        return 'https://%s/v1.0/' % self.host
+        
diff --git a/nova/api/rackspace/servers.py b/nova/api/rackspace/servers.py
index 761ce2895..3de419e6f 100644
--- a/nova/api/rackspace/servers.py
+++ b/nova/api/rackspace/servers.py
@@ -20,6 +20,7 @@ from nova import db
 from nova import flags
 from nova import rpc
 from nova import utils
+from nova import compute
 from nova.api.rackspace import base
 from webob import exc
 from nova import flags
diff --git a/nova/auth/manager.py b/nova/auth/manager.py
index bc3a8a12e..55fbf42aa 100644
--- a/nova/auth/manager.py
+++ b/nova/auth/manager.py
@@ -44,7 +44,7 @@ flags.DEFINE_list('allowed_roles',
 # NOTE(vish): a user with one of these roles will be a superuser and
 #             have access to all api commands
 flags.DEFINE_list('superuser_roles', ['cloudadmin'],
-                  'Roles that ignore rbac checking completely')
+                  'Roles that ignore authorization checking completely')
 
 # NOTE(vish): a user with one of these roles will have it for every
 #             project, even if he or she is not a member of the project
@@ -266,7 +266,7 @@ class AuthManager(object):
 
         # NOTE(vish): if we stop using project name as id we need better
         #             logic to find a default project for user
-        if project_id is '':
+        if project_id == '':
             project_id = user.name
 
         project = self.get_project(project_id)
@@ -304,7 +304,7 @@ class AuthManager(object):
         return "%s:%s" % (user.access, Project.safe_id(project))
 
     def is_superuser(self, user):
-        """Checks for superuser status, allowing user to bypass rbac
+        """Checks for superuser status, allowing user to bypass authorization
 
         @type user: User or uid
         @param user: User to check.
diff --git a/nova/auth/rbac.py b/nova/auth/rbac.py
deleted file mode 100644
index d157f44b3..000000000
--- a/nova/auth/rbac.py
+++ /dev/null
@@ -1,69 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright 2010 United States Government as represented by the
-# Administrator of the National Aeronautics and Space Administration.
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
-"""Role-based access control decorators to use fpr wrapping other
-methods with."""
-
-from nova import exception
-
-
-def allow(*roles):
-    """Allow the given roles access the wrapped function."""
-
-    def wrap(func): # pylint: disable-msg=C0111
-
-        def wrapped_func(self, context, *args,
-                         **kwargs): # pylint: disable-msg=C0111
-            if context.user.is_superuser():
-                return func(self, context, *args, **kwargs)
-            for role in roles:
-                if __matches_role(context, role):
-                    return func(self, context, *args, **kwargs)
-            raise exception.NotAuthorized()
-
-        return wrapped_func
-
-    return wrap
-
-
-def deny(*roles):
-    """Deny the given roles access the wrapped function."""
-
-    def wrap(func): # pylint: disable-msg=C0111
-
-        def wrapped_func(self, context, *args,
-                         **kwargs): # pylint: disable-msg=C0111
-            if context.user.is_superuser():
-                return func(self, context, *args, **kwargs)
-            for role in roles:
-                if __matches_role(context, role):
-                    raise exception.NotAuthorized()
-            return func(self, context, *args, **kwargs)
-
-        return wrapped_func
-
-    return wrap
-
-
-def __matches_role(context, role):
-    """Check if a role is allowed."""
-    if role == 'all':
-        return True
-    if role == 'none':
-        return False
-    return context.project.has_role(context.user.id, role)
diff --git a/nova/cloudpipe/api.py b/nova/cloudpipe/api.py
deleted file mode 100644
index 56aa89834..000000000
--- a/nova/cloudpipe/api.py
+++ /dev/null
@@ -1,59 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright 2010 United States Government as represented by the
-# Administrator of the National Aeronautics and Space Administration.
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
-"""
-Tornado REST API Request Handlers for CloudPipe
-"""
-
-import logging
-import urllib
-
-import tornado.web
-
-from nova import crypto
-from nova.auth import manager
-
-
-_log = logging.getLogger("api")
-_log.setLevel(logging.DEBUG)
-
-
-class CloudPipeRequestHandler(tornado.web.RequestHandler):
-    def get(self, path):
-        path = self.request.path
-        _log.debug( "Cloudpipe path is %s" % path)
-        if path.endswith("/getca/"):
-            self.send_root_ca()
-        self.finish()
-
-    def get_project_id_from_ip(self, ip):
-        cc = self.application.controllers['Cloud']
-        instance = cc.get_instance_by_ip(ip)
-        instance['project_id']
-
-    def send_root_ca(self):
-        _log.debug( "Getting root ca")
-        project_id = self.get_project_id_from_ip(self.request.remote_ip)
-        self.set_header("Content-Type", "text/plain")
-        self.write(crypto.fetch_ca(project_id))
-
-    def post(self, *args, **kwargs):
-        project_id = self.get_project_id_from_ip(self.request.remote_ip)
-        cert = self.get_argument('cert', '')
-        self.write(crypto.sign_csr(urllib.unquote(cert), project_id))
-        self.finish()
diff --git a/nova/cloudpipe/pipelib.py b/nova/cloudpipe/pipelib.py
index de6a97fb6..706a175d9 100644
--- a/nova/cloudpipe/pipelib.py
+++ b/nova/cloudpipe/pipelib.py
@@ -32,7 +32,9 @@ from nova import exception
 from nova import flags
 from nova import utils
 from nova.auth import manager
-from nova.endpoint import api
+# TODO(eday): Eventually changes these to something not ec2-specific
+from nova.api.ec2 import cloud
+from nova.api.ec2 import context
 
 
 FLAGS = flags.FLAGS
@@ -42,8 +44,8 @@ flags.DEFINE_string('boot_script_template',
 
 
 class CloudPipe(object):
-    def __init__(self, cloud_controller):
-        self.controller = cloud_controller
+    def __init__(self):
+        self.controller = cloud.CloudController()
         self.manager = manager.AuthManager()
 
     def launch_vpn_instance(self, project_id):
@@ -60,7 +62,7 @@ class CloudPipe(object):
 
         key_name = self.setup_key_pair(project.project_manager_id, project_id)
         zippy = open(zippath, "r")
-        context = api.APIRequestContext(handler=None, user=project.project_manager, project=project)
+        context = context.APIRequestContext(user=project.project_manager, project=project)
 
         reservation = self.controller.run_instances(context,
             # run instances expects encoded userdata, it is decoded in the get_metadata_call
diff --git a/nova/db/api.py b/nova/db/api.py
index 8e418f9f0..c1cb1953a 100644
--- a/nova/db/api.py
+++ b/nova/db/api.py
@@ -448,6 +448,21 @@ def export_device_create(context, values):
 
 ###################
 
+def auth_destroy_token(context, token):
+    """Destroy an auth token"""
+    return IMPL.auth_destroy_token(context, token)
+
+def auth_get_token(context, token_hash):
+    """Retrieves a token given the hash representing it"""
+    return IMPL.auth_get_token(context, token_hash)
+
+def auth_create_token(context, token):
+    """Creates a new token"""
+    return IMPL.auth_create_token(context, token_hash, token)
+
+
+###################
+
 
 def quota_create(context, values):
     """Create a quota from the values dictionary."""
diff --git a/nova/db/sqlalchemy/api.py b/nova/db/sqlalchemy/api.py
index 30c550105..2b0dd6ea6 100644
--- a/nova/db/sqlalchemy/api.py
+++ b/nova/db/sqlalchemy/api.py
@@ -681,6 +681,29 @@ def export_device_create(_context, values):
 ###################
 
 
+def auth_destroy_token(_context, token):
+    session = get_session()
+    session.delete(token)
+
+def auth_get_token(_context, token_hash):
+    session = get_session()
+    tk = session.query(models.AuthToken
+                ).filter_by(token_hash=token_hash)
+    if not tk:
+        raise exception.NotFound('Token %s does not exist' % token_hash)
+    return tk
+
+def auth_create_token(_context, token):
+    tk = models.AuthToken()
+    for k,v in token.iteritems():
+        tk[k] = v
+    tk.save()
+    return tk
+    
+
+###################
+
+
 def quota_create(_context, values):
     quota_ref = models.Quota()
     for (key, value) in values.iteritems():
diff --git a/nova/db/sqlalchemy/models.py b/nova/db/sqlalchemy/models.py
index f62b79af8..f6ba7953f 100644
--- a/nova/db/sqlalchemy/models.py
+++ b/nova/db/sqlalchemy/models.py
@@ -214,6 +214,7 @@ class Instance(BASE, NovaBase):
     image_id = Column(String(255))
     kernel_id = Column(String(255))
     ramdisk_id = Column(String(255))
+
 #    image_id = Column(Integer, ForeignKey('images.id'), nullable=True)
 #    kernel_id = Column(Integer, ForeignKey('images.id'), nullable=True)
 #    ramdisk_id = Column(Integer, ForeignKey('images.id'), nullable=True)
@@ -396,6 +397,18 @@ class NetworkIndex(BASE, NovaBase):
     network = relationship(Network, backref=backref('network_index',
                                                     uselist=False))
 
+class AuthToken(BASE, NovaBase):
+    """Represents an authorization token for all API transactions. Fields 
+    are a string representing the actual token and a user id for mapping 
+    to the actual user"""
+    __tablename__ = 'auth_tokens'
+    token_hash = Column(String(255), primary_key=True)
+    user_id = Column(Integer)
+    server_manageent_url = Column(String(255))
+    storage_url = Column(String(255))
+    cdn_management_url = Column(String(255))
+
+
 
 # TODO(vish): can these both come from the same baseclass?
 class FixedIp(BASE, NovaBase):
@@ -463,7 +476,8 @@ def register_models():
     """Register Models and create metadata"""
     from sqlalchemy import create_engine
     models = (Service, Instance, Volume, ExportDevice,
-              FixedIp, FloatingIp, Network, NetworkIndex)  # , Image, Host)
+              FixedIp, FloatingIp, Network, NetworkIndex,
+              AuthToken)  # , Image, Host)
     engine = create_engine(FLAGS.sql_connection, echo=False)
     for model in models:
         model.metadata.create_all(engine)
diff --git a/nova/endpoint/__init__.py b/nova/endpoint/__init__.py
deleted file mode 100644
index e69de29bb..000000000
--- a/nova/endpoint/__init__.py
+++ /dev/null
diff --git a/nova/endpoint/api.py b/nova/endpoint/api.py
deleted file mode 100755
index 12eedfe67..000000000
--- a/nova/endpoint/api.py
+++ /dev/null
@@ -1,347 +0,0 @@
-# vim: tabstop=4 shiftwidth=4 softtabstop=4
-
-# Copyright 2010 United States Government as represented by the
-# Administrator of the National Aeronautics and Space Administration.
-# All Rights Reserved.
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
-"""
-Tornado REST API Request Handlers for Nova functions
-Most calls are proxied into the responsible controller.
-"""
-
-import logging
-import multiprocessing
-import random
-import re
-import urllib
-# TODO(termie): replace minidom with etree
-from xml.dom import minidom
-
-import tornado.web
-from twisted.internet import defer
-
-from nova import crypto
-from nova import exception
-from nova import flags
-from nova import utils
-from nova.auth import manager
-import nova.cloudpipe.api
-from nova.endpoint import cloud
-
-
-FLAGS = flags.FLAGS
-flags.DEFINE_integer('cc_port', 8773, 'cloud controller port')
-
-
-_log = logging.getLogger("api")
-_log.setLevel(logging.DEBUG)
-
-
-_c2u = re.compile('(((?<=[a-z])[A-Z])|([A-Z](?![A-Z]|$)))')
-
-
-def _camelcase_to_underscore(str):
-    return _c2u.sub(r'_\1', str).lower().strip('_')
-
-
-def _underscore_to_camelcase(str):
-    return ''.join([x[:1].upper() + x[1:] for x in str.split('_')])
-
-
-def _underscore_to_xmlcase(str):
-    res = _underscore_to_camelcase(str)
-    return res[:1].lower() + res[1:]
-
-
-class APIRequestContext(object):
-    def __init__(self, handler, user, project):
-        self.handler = handler
-        self.user = user
-        self.project = project
-        self.request_id = ''.join(
-                [random.choice('ABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890-')
-                 for x in xrange(20)]
-                )
-
-
-class APIRequest(object):
-    def __init__(self, controller, action):
-        self.controller = controller
-        self.action = action
-
-    def send(self, context, **kwargs):
-
-        try:
-            method = getattr(self.controller,
-                             _camelcase_to_underscore(self.action))
-        except AttributeError:
-            _error = ('Unsupported API request: controller = %s,'
-                      'action = %s') % (self.controller, self.action)
-            _log.warning(_error)
-            # TODO: Raise custom exception, trap in apiserver,
-            #       and reraise as 400 error.
-            raise Exception(_error)
-
-        args = {}
-        for key, value in kwargs.items():
-            parts = key.split(".")
-            key = _camelcase_to_underscore(parts[0])
-            if len(parts) > 1:
-                d = args.get(key, {})
-                d[parts[1]] = value[0]
-                value = d
-            else:
-                value = value[0]
-            args[key] = value
-
-        for key in args.keys():
-            if isinstance(args[key], dict):
-                if args[key] != {} and args[key].keys()[0].isdigit():
-                    s = args[key].items()
-                    s.sort()
-                    args[key] = [v for k, v in s]
-
-        d = defer.maybeDeferred(method, context, **args)
-        d.addCallback(self._render_response, context.request_id)
-        return d
-
-    def _render_response(self, response_data, request_id):
-        xml = minidom.Document()
-
-        response_el = xml.createElement(self.action + 'Response')
-        response_el.setAttribute('xmlns',
-                                 'http://ec2.amazonaws.com/doc/2009-11-30/')
-        request_id_el = xml.createElement('requestId')
-        request_id_el.appendChild(xml.createTextNode(request_id))
-        response_el.appendChild(request_id_el)
-        if(response_data == True):
-            self._render_dict(xml, response_el, {'return': 'true'})
-        else:
-            self._render_dict(xml, response_el, response_data)
-
-        xml.appendChild(response_el)
-
-        response = xml.toxml()
-        xml.unlink()
-        _log.debug(response)
-        return response
-
-    def _render_dict(self, xml, el, data):
-        try:
-            for key in data.keys():
-                val = data[key]
-                el.appendChild(self._render_data(xml, key, val))
-        except:
-            _log.debug(data)
-            raise
-
-    def _render_data(self, xml, el_name, data):
-        el_name = _underscore_to_xmlcase(el_name)
-        data_el = xml.createElement(el_name)
-
-        if isinstance(data, list):
-            for item in data:
-                data_el.appendChild(self._render_data(xml, 'item', item))
-        elif isinstance(data, dict):
-            self._render_dict(xml, data_el, data)
-        elif hasattr(data, '__dict__'):
-            self._render_dict(xml, data_el, data.__dict__)
-        elif isinstance(data, bool):
-            data_el.appendChild(xml.createTextNode(str(data).lower()))
-        elif data != None:
-            data_el.appendChild(xml.createTextNode(str(data)))
-
-        return data_el
-
-
-class RootRequestHandler(tornado.web.RequestHandler):
-    def get(self):
-        # available api versions
-        versions = [
-            '1.0',
-            '2007-01-19',
-            '2007-03-01',
-            '2007-08-29',
-            '2007-10-10',
-            '2007-12-15',
-            '2008-02-01',
-            '2008-09-01',
-            '2009-04-04',
-        ]
-        for version in versions:
-            self.write('%s\n' % version)
-        self.finish()
-
-
-class MetadataRequestHandler(tornado.web.RequestHandler):
-    def print_data(self, data):
-        if isinstance(data, dict):
-            output = ''
-            for key in data:
-                if key == '_name':
-                    continue
-                output += key
-                if isinstance(data[key], dict):
-                    if '_name' in data[key]:
-                        output += '=' + str(data[key]['_name'])
-                    else:
-                        output += '/'
-                output += '\n'
-            self.write(output[:-1]) # cut off last \n
-        elif isinstance(data, list):
-            self.write('\n'.join(data))
-        else:
-            self.write(str(data))
-
-    def lookup(self, path, data):
-        items = path.split('/')
-        for item in items:
-            if item:
-                if not isinstance(data, dict):
-                    return data
-                if not item in data:
-                    return None
-                data = data[item]
-        return data
-
-    def get(self, path):
-        cc = self.application.controllers['Cloud']
-        meta_data = cc.get_metadata(self.request.remote_ip)
-        if meta_data is None:
-            _log.error('Failed to get metadata for ip: %s' %
-                        self.request.remote_ip)
-            raise tornado.web.HTTPError(404)
-        data = self.lookup(path, meta_data)
-        if data is None:
-            raise tornado.web.HTTPError(404)
-        self.print_data(data)
-        self.finish()
-
-
-class APIRequestHandler(tornado.web.RequestHandler):
-    def get(self, controller_name):
-        self.execute(controller_name)
-
-    @tornado.web.asynchronous
-    def execute(self, controller_name):
-        # Obtain the appropriate controller for this request.
-        try:
-            controller = self.application.controllers[controller_name]
-        except KeyError:
-            self._error('unhandled', 'no controller named %s' % controller_name)
-            return
-
-        args = self.request.arguments
-
-        # Read request signature.
-        try:
-            signature = args.pop('Signature')[0]
-        except:
-            raise tornado.web.HTTPError(400)
-
-        # Make a copy of args for authentication and signature verification.
-        auth_params = {}
-        for key, value in args.items():
-            auth_params[key] = value[0]
-
-        # Get requested action and remove authentication args for final request.
-        try:
-            action = args.pop('Action')[0]
-            access = args.pop('AWSAccessKeyId')[0]
-            args.pop('SignatureMethod')
-            args.pop('SignatureVersion')
-            args.pop('Version')
-            args.pop('Timestamp')
-        except:
-            raise tornado.web.HTTPError(400)
-
-        # Authenticate the request.
-        try:
-            (user, project) = manager.AuthManager().authenticate(
-                access,
-                signature,
-                auth_params,
-                self.request.method,
-                self.request.host,
-                self.request.path
-            )
-
-        except exception.Error, ex:
-            logging.debug("Authentication Failure: %s" % ex)
-            raise tornado.web.HTTPError(403)
-
-        _log.debug('action: %s' % action)
-
-        for key, value in args.items():
-            _log.debug('arg: %s\t\tval: %s' % (key, value))
-
-        request = APIRequest(controller, action)
-        context = APIRequestContext(self, user, project)
-        d = request.send(context, **args)
-        # d.addCallback(utils.debug)
-
-        # TODO: Wrap response in AWS XML format
-        d.addCallbacks(self._write_callback, self._error_callback)
-
-    def _write_callback(self, data):
-        self.set_header('Content-Type', 'text/xml')
-        self.write(data)
-        self.finish()
-
-    def _error_callback(self, failure):
-        try:
-            failure.raiseException()
-        except exception.ApiError as ex:
-            if ex.code:
-                self._error(ex.code, ex.message)
-            else:
-                self._error(type(ex).__name__, ex.message)
-        # TODO(vish): do something more useful with unknown exceptions
-        except Exception as ex:
-            self._error(type(ex).__name__, str(ex))
-            raise
-
-    def post(self, controller_name):
-        self.execute(controller_name)
-
-    def _error(self, code, message):
-        self._status_code = 400
-        self.set_header('Content-Type', 'text/xml')
-        self.write('<?xml version="1.0"?>\n')
-        self.write('<Response><Errors><Error><Code>%s</Code>'
-                   '<Message>%s</Message></Error></Errors>'
-                   '<RequestID>?</RequestID></Response>' % (code, message))
-        self.finish()
-
-
-class APIServerApplication(tornado.web.Application):
-    def __init__(self, controllers):
-        tornado.web.Application.__init__(self, [
-            (r'/', RootRequestHandler),
-            (r'/cloudpipe/(.*)', nova.cloudpipe.api.CloudPipeRequestHandler),
-            (r'/cloudpipe', nova.cloudpipe.api.CloudPipeRequestHandler),
-            (r'/services/([A-Za-z0-9]+)/', APIRequestHandler),
-            (r'/latest/([-A-Za-z0-9/]*)', MetadataRequestHandler),
-            (r'/2009-04-04/([-A-Za-z0-9/]*)', MetadataRequestHandler),
-            (r'/2008-09-01/([-A-Za-z0-9/]*)', MetadataRequestHandler),
-            (r'/2008-02-01/([-A-Za-z0-9/]*)', MetadataRequestHandler),
-            (r'/2007-12-15/([-A-Za-z0-9/]*)', MetadataRequestHandler),
-            (r'/2007-10-10/([-A-Za-z0-9/]*)', MetadataRequestHandler),
-            (r'/2007-08-29/([-A-Za-z0-9/]*)', MetadataRequestHandler),
-            (r'/2007-03-01/([-A-Za-z0-9/]*)', MetadataRequestHandler),
-            (r'/2007-01-19/([-A-Za-z0-9/]*)', MetadataRequestHandler),
-            (r'/1.0/([-A-Za-z0-9/]*)', MetadataRequestHandler),
-        ], pool=multiprocessing.Pool(4))
-        self.controllers = controllers
diff --git a/nova/objectstore/handler.py b/nova/objectstore/handler.py
index 5c3dc286b..aabf6831f 100644
--- a/nova/objectstore/handler.py
+++ b/nova/objectstore/handler.py
@@ -55,7 +55,7 @@ from twisted.web import static
 from nova import exception
 from nova import flags
 from nova.auth import manager
-from nova.endpoint import api
+from nova.api.ec2 import context
 from nova.objectstore import bucket
 from nova.objectstore import image
 
@@ -131,7 +131,7 @@ def get_context(request):
                                           request.uri,
                                           headers=request.getAllHeaders(),
                                           check_type='s3')
-        return api.APIRequestContext(None, user, project)
+        return context.APIRequestContext(user, project)
     except exception.Error as ex:
         logging.debug("Authentication Failure: %s", ex)
         raise exception.NotAuthorized
diff --git a/nova/rpc.py b/nova/rpc.py
index 84a9b5590..6363335ea 100644
--- a/nova/rpc.py
+++ b/nova/rpc.py
@@ -46,9 +46,9 @@ LOG.setLevel(logging.DEBUG)
 class Connection(carrot_connection.BrokerConnection):
     """Connection instance object"""
     @classmethod
-    def instance(cls):
+    def instance(cls, new=False):
         """Returns the instance"""
-        if not hasattr(cls, '_instance'):
+        if new or not hasattr(cls, '_instance'):
             params = dict(hostname=FLAGS.rabbit_host,
                           port=FLAGS.rabbit_port,
                           userid=FLAGS.rabbit_userid,
@@ -60,7 +60,10 @@ class Connection(carrot_connection.BrokerConnection):
 
             # NOTE(vish): magic is fun!
             # pylint: disable-msg=W0142
-            cls._instance = cls(**params)
+            if new:
+                return cls(**params)
+            else:
+                cls._instance = cls(**params)
         return cls._instance
 
     @classmethod
@@ -94,8 +97,6 @@ class Consumer(messaging.Consumer):
         injected.start()
         return injected
 
-    attachToTornado = attach_to_tornado
-
     def fetch(self, no_ack=None, auto_ack=None, enable_callbacks=False):
         """Wraps the parent fetch with some logic for failed connections"""
         # TODO(vish): the logic for failed connections and logging should be
@@ -265,28 +266,32 @@ def call(topic, msg):
     msg.update({'_msg_id': msg_id})
     LOG.debug("MSG_ID is %s" % (msg_id))
 
-    conn = Connection.instance()
-    d = defer.Deferred()
-    consumer = DirectConsumer(connection=conn, msg_id=msg_id)
-
-    def deferred_receive(data, message):
-        """Acks message and callbacks or errbacks"""
-        message.ack()
-        if data['failure']:
-            return d.errback(RemoteError(*data['failure']))
-        else:
-            return d.callback(data['result'])
+    class WaitMessage(object):
 
-    consumer.register_callback(deferred_receive)
-    injected = consumer.attach_to_tornado()
+        def __call__(self, data, message):
+            """Acks message and sets result."""
+            message.ack()
+            if data['failure']:
+                self.result = RemoteError(*data['failure'])
+            else:
+                self.result = data['result']
 
-    # clean up after the injected listened and return x
-    d.addCallback(lambda x: injected.stop() and x or x)
+    wait_msg = WaitMessage()
+    conn = Connection.instance(True)
+    consumer = DirectConsumer(connection=conn, msg_id=msg_id)
+    consumer.register_callback(wait_msg)
 
+    conn = Connection.instance()
     publisher = TopicPublisher(connection=conn, topic=topic)
     publisher.send(msg)
     publisher.close()
-    return d
+
+    try:
+        consumer.wait(limit=1)
+    except StopIteration:
+        pass
+    consumer.close()
+    return wait_msg.result
 
 
 def cast(topic, msg):
diff --git a/nova/scheduler/driver.py b/nova/scheduler/driver.py
index 2e6a5a835..c89d25a47 100644
--- a/nova/scheduler/driver.py
+++ b/nova/scheduler/driver.py
@@ -42,7 +42,8 @@ class Scheduler(object):
     def service_is_up(service):
         """Check whether a service is up based on last heartbeat."""
         last_heartbeat = service['updated_at'] or service['created_at']
-        elapsed = datetime.datetime.now() - last_heartbeat
+        # Timestamps in DB are UTC.
+        elapsed = datetime.datetime.utcnow() - last_heartbeat
         return elapsed < datetime.timedelta(seconds=FLAGS.service_down_time)
 
     def hosts_up(self, context, topic):
diff --git a/nova/tests/access_unittest.py b/nova/tests/access_unittest.py
index 59e1683db..c8a49d2ca 100644
--- a/nova/tests/access_unittest.py
+++ b/nova/tests/access_unittest.py
@@ -18,12 +18,13 @@
 
 import unittest
 import logging
+import webob
 
 from nova import exception
 from nova import flags
 from nova import test
+from nova.api import ec2
 from nova.auth import manager
-from nova.auth import rbac
 
 
 FLAGS = flags.FLAGS
@@ -72,9 +73,17 @@ class AccessTestCase(test.BaseTestCase):
         try:
             self.project.add_role(self.testsys, 'sysadmin')
         except: pass
-        self.context = Context()
-        self.context.project = self.project
         #user is set in each test
+        def noopWSGIApp(environ, start_response):
+            start_response('200 OK', [])
+            return ['']
+        self.mw = ec2.Authorizer(noopWSGIApp)
+        self.mw.action_roles = {'str': {
+                '_allow_all': ['all'],
+                '_allow_none': [],
+                '_allow_project_manager': ['projectmanager'],
+                '_allow_sys_and_net': ['sysadmin', 'netadmin'],
+                '_allow_sysadmin': ['sysadmin']}}
 
     def tearDown(self):
         um = manager.AuthManager()
@@ -87,76 +96,46 @@ class AccessTestCase(test.BaseTestCase):
         um.delete_user('testsys')
         super(AccessTestCase, self).tearDown()
 
+    def response_status(self, user, methodName):
+        context = Context()
+        context.project = self.project
+        context.user = user
+        environ = {'ec2.context' : context,
+                   'ec2.controller': 'some string',
+                   'ec2.action': methodName}
+        req = webob.Request.blank('/', environ)
+        resp = req.get_response(self.mw)
+        return resp.status_int
+
+    def shouldAllow(self, user, methodName):
+        self.assertEqual(200, self.response_status(user, methodName))
+
+    def shouldDeny(self, user, methodName):
+        self.assertEqual(401, self.response_status(user, methodName))
+
     def test_001_allow_all(self):
-        self.context.user = self.testadmin
-        self.assertTrue(self._allow_all(self.context))
-        self.context.user = self.testpmsys
-        self.assertTrue(self._allow_all(self.context))
-        self.context.user = self.testnet
-        self.assertTrue(self._allow_all(self.context))
-        self.context.user = self.testsys
-        self.assertTrue(self._allow_all(self.context))
+        users = [self.testadmin, self.testpmsys, self.testnet, self.testsys]
+        for user in users:
+            self.shouldAllow(user, '_allow_all')
 
     def test_002_allow_none(self):
-        self.context.user = self.testadmin
-        self.assertTrue(self._allow_none(self.context))
-        self.context.user = self.testpmsys
-        self.assertRaises(exception.NotAuthorized, self._allow_none, self.context)
-        self.context.user = self.testnet
-        self.assertRaises(exception.NotAuthorized, self._allow_none, self.context)
-        self.context.user = self.testsys
-        self.assertRaises(exception.NotAuthorized, self._allow_none, self.context)
+        self.shouldAllow(self.testadmin, '_allow_none')
+        users = [self.testpmsys, self.testnet, self.testsys]
+        for user in users:
+            self.shouldDeny(user, '_allow_none')
 
     def test_003_allow_project_manager(self):
-        self.context.user = self.testadmin
-        self.assertTrue(self._allow_project_manager(self.context))
-        self.context.user = self.testpmsys
-        self.assertTrue(self._allow_project_manager(self.context))
-        self.context.user = self.testnet
-        self.assertRaises(exception.NotAuthorized, self._allow_project_manager, self.context)
-        self.context.user = self.testsys
-        self.assertRaises(exception.NotAuthorized, self._allow_project_manager, self.context)
+        for user in [self.testadmin, self.testpmsys]:
+            self.shouldAllow(user, '_allow_project_manager')
+        for user in [self.testnet, self.testsys]:
+            self.shouldDeny(user, '_allow_project_manager')
 
     def test_004_allow_sys_and_net(self):
-        self.context.user = self.testadmin
-        self.assertTrue(self._allow_sys_and_net(self.context))
-        self.context.user = self.testpmsys # doesn't have the per project sysadmin
-        self.assertRaises(exception.NotAuthorized, self._allow_sys_and_net, self.context)
-        self.context.user = self.testnet
-        self.assertTrue(self._allow_sys_and_net(self.context))
-        self.context.user = self.testsys
-        self.assertTrue(self._allow_sys_and_net(self.context))
-
-    def test_005_allow_sys_no_pm(self):
-        self.context.user = self.testadmin
-        self.assertTrue(self._allow_sys_no_pm(self.context))
-        self.context.user = self.testpmsys
-        self.assertRaises(exception.NotAuthorized, self._allow_sys_no_pm, self.context)
-        self.context.user = self.testnet
-        self.assertRaises(exception.NotAuthorized, self._allow_sys_no_pm, self.context)
-        self.context.user = self.testsys
-        self.assertTrue(self._allow_sys_no_pm(self.context))
-
-    @rbac.allow('all')
-    def _allow_all(self, context):
-        return True
-
-    @rbac.allow('none')
-    def _allow_none(self, context):
-        return True
-
-    @rbac.allow('projectmanager')
-    def _allow_project_manager(self, context):
-        return True
-
-    @rbac.allow('sysadmin', 'netadmin')
-    def _allow_sys_and_net(self, context):
-        return True
-
-    @rbac.allow('sysadmin')
-    @rbac.deny('projectmanager')
-    def _allow_sys_no_pm(self, context):
-        return True
+        for user in [self.testadmin, self.testnet, self.testsys]:
+            self.shouldAllow(user, '_allow_sys_and_net')
+        # denied because it doesn't have the per project sysadmin
+        for user in [self.testpmsys]:
+            self.shouldDeny(user, '_allow_sys_and_net')
 
 if __name__ == "__main__":
     # TODO: Implement use_fake as an option
diff --git a/nova/tests/api/__init__.py b/nova/tests/api/__init__.py
index 4682c094e..fc1ab9ae2 100644
--- a/nova/tests/api/__init__.py
+++ b/nova/tests/api/__init__.py
@@ -25,6 +25,7 @@ import stubout
 import webob
 import webob.dec
 
+import nova.exception
 from nova import api
 from nova.tests.api.test_helper import *
 
@@ -36,25 +37,46 @@ class Test(unittest.TestCase):
     def tearDown(self): # pylint: disable-msg=C0103
         self.stubs.UnsetAll()
 
+    def _request(self, url, subdomain, **kwargs):
+        environ_keys = {'HTTP_HOST': '%s.example.com' % subdomain}
+        environ_keys.update(kwargs)
+        req = webob.Request.blank(url, environ_keys)
+        return req.get_response(api.API())
+
     def test_rackspace(self):
         self.stubs.Set(api.rackspace, 'API', APIStub)
-        result = webob.Request.blank('/v1.0/cloud').get_response(api.API())
+        result = self._request('/v1.0/cloud', 'rs')
         self.assertEqual(result.body, "/cloud")
 
     def test_ec2(self):
         self.stubs.Set(api.ec2, 'API', APIStub)
-        result = webob.Request.blank('/ec2/cloud').get_response(api.API())
+        result = self._request('/services/cloud', 'ec2')
         self.assertEqual(result.body, "/cloud")
 
     def test_not_found(self):
         self.stubs.Set(api.ec2, 'API', APIStub)
         self.stubs.Set(api.rackspace, 'API', APIStub)
-        result = webob.Request.blank('/test/cloud').get_response(api.API())
+        result = self._request('/test/cloud', 'ec2')
         self.assertNotEqual(result.body, "/cloud")
 
     def test_query_api_versions(self):
-        result = webob.Request.blank('/').get_response(api.API())
+        result = self._request('/', 'rs')
         self.assertTrue('CURRENT' in result.body)
 
+    def test_metadata(self):
+        def go(url):
+            result = self._request(url, 'ec2', 
+                                   REMOTE_ADDR='128.192.151.2')
+        # Each should get to the ORM layer and fail to find the IP
+        self.assertRaises(nova.exception.NotFound, go, '/latest/')
+        self.assertRaises(nova.exception.NotFound, go, '/2009-04-04/')
+        self.assertRaises(nova.exception.NotFound, go, '/1.0/')
+
+    def test_ec2_root(self):
+        result = self._request('/', 'ec2')
+        self.assertTrue('2007-12-15\n' in result.body)
+
+
+
 if __name__ == '__main__':
     unittest.main()
diff --git a/nova/tests/api/rackspace/auth.py b/nova/tests/api/rackspace/auth.py
new file mode 100644
index 000000000..429c22ad2
--- /dev/null
+++ b/nova/tests/api/rackspace/auth.py
@@ -0,0 +1,106 @@
+import webob
+import webob.dec
+import unittest
+import stubout
+import nova.api
+import nova.api.rackspace.auth
+from nova import auth
+from nova.tests.api.rackspace import test_helper
+import datetime
+
+class Test(unittest.TestCase):
+    def setUp(self):
+        self.stubs = stubout.StubOutForTesting()
+        self.stubs.Set(nova.api.rackspace.auth.BasicApiAuthManager,
+            '__init__', test_helper.fake_auth_init)
+        test_helper.FakeAuthManager.auth_data = {}
+        test_helper.FakeAuthDatabase.data = {}
+        self.stubs.Set(nova.api.rackspace, 'RateLimitingMiddleware',
+            test_helper.FakeRateLimiter)
+
+    def tearDown(self):
+        self.stubs.UnsetAll()
+        test_helper.fake_data_store = {}
+
+    def test_authorize_user(self):
+        f = test_helper.FakeAuthManager()
+        f.add_user('derp', { 'uid': 1, 'name':'herp' } )
+
+        req = webob.Request.blank('/v1.0/')
+        req.headers['X-Auth-User'] = 'herp'
+        req.headers['X-Auth-Key'] = 'derp'
+        result = req.get_response(nova.api.API())
+        self.assertEqual(result.status, '204 No Content')
+        self.assertEqual(len(result.headers['X-Auth-Token']), 40)
+        self.assertEqual(result.headers['X-CDN-Management-Url'],
+            "")
+        self.assertEqual(result.headers['X-Storage-Url'], "")
+
+    def test_authorize_token(self):
+        f = test_helper.FakeAuthManager()
+        f.add_user('derp', { 'uid': 1, 'name':'herp' } )
+            
+        req = webob.Request.blank('/v1.0/')
+        req.headers['X-Auth-User'] = 'herp'
+        req.headers['X-Auth-Key'] = 'derp'
+        result = req.get_response(nova.api.API())
+        self.assertEqual(result.status, '204 No Content')
+        self.assertEqual(len(result.headers['X-Auth-Token']), 40)
+        self.assertEqual(result.headers['X-Server-Management-Url'],
+            "https://foo/v1.0/")
+        self.assertEqual(result.headers['X-CDN-Management-Url'],
+            "")
+        self.assertEqual(result.headers['X-Storage-Url'], "")
+
+        token = result.headers['X-Auth-Token']
+        self.stubs.Set(nova.api.rackspace, 'APIRouter',
+            test_helper.FakeRouter)
+        req = webob.Request.blank('/v1.0/fake')
+        req.headers['X-Auth-Token'] = token
+        result = req.get_response(nova.api.API())
+        self.assertEqual(result.status, '200 OK')
+        self.assertEqual(result.headers['X-Test-Success'], 'True')
+    
+    def test_token_expiry(self):
+        self.destroy_called = False
+        token_hash = 'bacon'
+
+        def destroy_token_mock(meh, context, token):
+            self.destroy_called = True
+        
+        def bad_token(meh, context, token_hash):
+            return { 'token_hash':token_hash,  
+                     'created_at':datetime.datetime(1990, 1, 1) }
+
+        self.stubs.Set(test_helper.FakeAuthDatabase, 'auth_destroy_token',
+            destroy_token_mock)
+
+        self.stubs.Set(test_helper.FakeAuthDatabase, 'auth_get_token',
+            bad_token)
+
+        req = webob.Request.blank('/v1.0/')
+        req.headers['X-Auth-Token'] = 'bacon'
+        result = req.get_response(nova.api.API())
+        self.assertEqual(result.status, '401 Unauthorized')
+        self.assertEqual(self.destroy_called, True)
+
+    def test_bad_user(self):
+        req = webob.Request.blank('/v1.0/')
+        req.headers['X-Auth-User'] = 'herp'
+        req.headers['X-Auth-Key'] = 'derp'
+        result = req.get_response(nova.api.API())
+        self.assertEqual(result.status, '401 Unauthorized')
+
+    def test_no_user(self):
+        req = webob.Request.blank('/v1.0/')
+        result = req.get_response(nova.api.API())
+        self.assertEqual(result.status, '401 Unauthorized')
+
+    def test_bad_token(self):
+        req = webob.Request.blank('/v1.0/')
+        req.headers['X-Auth-Token'] = 'baconbaconbacon'
+        result = req.get_response(nova.api.API())
+        self.assertEqual(result.status, '401 Unauthorized')
+
+if __name__ == '__main__':
+    unittest.main()
diff --git a/nova/tests/api/rackspace/servers.py b/nova/tests/api/rackspace/servers.py
index 6d628e78a..2cfb8d45f 100644
--- a/nova/tests/api/rackspace/servers.py
+++ b/nova/tests/api/rackspace/servers.py
@@ -16,19 +16,25 @@
 #    under the License.
 
 import unittest
-
+import stubout
 from nova.api.rackspace import servers
+import nova.api.rackspace
 from nova.tests.api.test_helper import *
+from nova.tests.api.rackspace import test_helper
 
 class ServersTest(unittest.TestCase):
     def setUp(self):
         self.stubs = stubout.StubOutForTesting()
+        test_helper.FakeAuthManager.auth_data = {}
+        test_helper.FakeAuthDatabase.data = {}
+        test_helper.stub_out_auth(self.stubs)
 
     def tearDown(self):
         self.stubs.UnsetAll()
 
     def test_get_server_list(self):
-        pass
+        req = webob.Request.blank('/v1.0/servers')
+        req.get_response(nova.api.API())
 
     def test_create_instance(self):
         pass
@@ -56,3 +62,6 @@ class ServersTest(unittest.TestCase):
 
     def test_delete_server_instance(self):
         pass
+
+if __name__ == "__main__":
+    unittest.main()
diff --git a/nova/tests/api/rackspace/test_helper.py b/nova/tests/api/rackspace/test_helper.py
new file mode 100644
index 000000000..1fb2a19cc
--- /dev/null
+++ b/nova/tests/api/rackspace/test_helper.py
@@ -0,0 +1,87 @@
+import webob
+import webob.dec
+import datetime
+from nova.wsgi import Router
+from nova import auth
+import nova.api.rackspace.auth
+
+class Context(object): 
+    pass
+
+class FakeRouter(Router):
+    def __init__(self):
+        pass
+
+    @webob.dec.wsgify
+    def __call__(self, req):
+        res = webob.Response()
+        res.status = '200'
+        res.headers['X-Test-Success'] = 'True'
+        return res
+
+def fake_auth_init(self):
+    self.db = FakeAuthDatabase()
+    self.context = Context()
+    self.auth = FakeAuthManager()
+    self.host = 'foo'
+
+def stub_out_auth(stubs):
+    def fake_auth_init(self, app):
+        self.application = app
+
+    def fake_rate_init(self, app):
+        super(nova.api.rackspace.RateLimitingMiddleware, self).__init__(app)
+        self.application = app
+
+    @webob.dec.wsgify
+    def fake_wsgi(self, req):
+        return self.application
+    
+    stubs.Set(nova.api.rackspace.AuthMiddleware, 
+        '__init__', fake_auth_init) 
+    stubs.Set(nova.api.rackspace.RateLimitingMiddleware,
+        '__init__', fake_rate_init)
+    stubs.Set(nova.api.rackspace.AuthMiddleware, 
+        '__call__', fake_wsgi) 
+    stubs.Set(nova.api.rackspace.RateLimitingMiddleware,
+        '__call__', fake_wsgi)
+
+class FakeAuthDatabase(object):
+    data = {}
+
+    @staticmethod
+    def auth_get_token(context, token_hash):
+        return FakeAuthDatabase.data.get(token_hash, None)
+
+    @staticmethod
+    def auth_create_token(context, token):
+        token['created_at'] = datetime.datetime.now()
+        FakeAuthDatabase.data[token['token_hash']] = token
+
+    @staticmethod
+    def auth_destroy_token(context, token):
+        if FakeAuthDatabase.data.has_key(token['token_hash']):
+            del FakeAuthDatabase.data['token_hash']
+
+class FakeAuthManager(object):
+    auth_data = {}
+
+    def add_user(self, key, user):        
+        FakeAuthManager.auth_data[key] = user
+
+    def get_user(self, uid):
+        for k, v in FakeAuthManager.auth_data.iteritems():
+            if v['uid'] == uid:
+                return v
+        return None
+
+    def get_user_from_access_key(self, key):
+        return FakeAuthManager.auth_data.get(key, None)
+
+class FakeRateLimiter(object):
+    def __init__(self, application):
+        self.application = application
+
+    @webob.dec.wsgify
+    def __call__(self, req):
+        return self.application
diff --git a/nova/tests/api_unittest.py b/nova/tests/api_unittest.py
index fdb9e21d8..c040cdad3 100644
--- a/nova/tests/api_unittest.py
+++ b/nova/tests/api_unittest.py
@@ -23,60 +23,17 @@ from boto.ec2 import regioninfo
 import httplib
 import random
 import StringIO
-from tornado import httpserver
-from twisted.internet import defer
+import webob
 
 from nova import flags
 from nova import test
+from nova import api
+from nova.api.ec2 import cloud
 from nova.auth import manager
-from nova.endpoint import api
-from nova.endpoint import cloud
 
 
 FLAGS = flags.FLAGS
-
-
-# NOTE(termie): These are a bunch of helper methods and classes to short
-#               circuit boto calls and feed them into our tornado handlers,
-#               it's pretty damn circuitous so apologies if you have to fix
-#               a bug in it
-# NOTE(jaypipes) The pylint disables here are for R0913 (too many args) which
-#                isn't controllable since boto's HTTPRequest needs that many
-#                args, and for the version-differentiated import of tornado's
-#                httputil.
-# NOTE(jaypipes): The disable-msg=E1101 and E1103 below is because pylint is
-#                 unable to introspect the deferred's return value properly
-
-def boto_to_tornado(method, path, headers, data, # pylint: disable-msg=R0913
-                    host, connection=None):
-    """ translate boto requests into tornado requests
-
-    connection should be a FakeTornadoHttpConnection instance
-    """
-    try:
-        headers = httpserver.HTTPHeaders()
-    except AttributeError:
-        from tornado import httputil # pylint: disable-msg=E0611
-        headers = httputil.HTTPHeaders()
-    for k, v in headers.iteritems():
-        headers[k] = v
-
-    req = httpserver.HTTPRequest(method=method,
-                                 uri=path,
-                                 headers=headers,
-                                 body=data,
-                                 host=host,
-                                 remote_ip='127.0.0.1',
-                                 connection=connection)
-    return req
-
-
-def raw_to_httpresponse(response_string):
-    """translate a raw tornado http response into an httplib.HTTPResponse"""
-    sock = FakeHttplibSocket(response_string)
-    resp = httplib.HTTPResponse(sock)
-    resp.begin()
-    return resp
+FLAGS.FAKE_subdomain = 'ec2'
 
 
 class FakeHttplibSocket(object):
@@ -89,85 +46,35 @@ class FakeHttplibSocket(object):
         return self._buffer
 
 
-class FakeTornadoStream(object):
-    """a fake stream to satisfy tornado's assumptions, trivial"""
-    def set_close_callback(self, _func):
-        """Dummy callback for stream"""
-        pass
-
-
-class FakeTornadoConnection(object):
-    """A fake connection object for tornado to pass to its handlers
-
-    web requests are expected to write to this as they get data and call
-    finish when they are done with the request, we buffer the writes and
-    kick off a callback when it is done so that we can feed the result back
-    into boto.
-    """
-    def __init__(self, deferred):
-        self._deferred = deferred
-        self._buffer = StringIO.StringIO()
-
-    def write(self, chunk):
-        """Writes a chunk of data to the internal buffer"""
-        self._buffer.write(chunk)
-
-    def finish(self):
-        """Finalizes the connection and returns the buffered data via the
-        deferred callback.
-        """
-        data = self._buffer.getvalue()
-        self._deferred.callback(data)
-
-    xheaders = None
-
-    @property
-    def stream(self): # pylint: disable-msg=R0201
-        """Required property for interfacing with tornado"""
-        return FakeTornadoStream()
-
-
 class FakeHttplibConnection(object):
     """A fake httplib.HTTPConnection for boto to use
 
     requests made via this connection actually get translated and routed into
-    our tornado app, we then wait for the response and turn it back into
+    our WSGI app, we then wait for the response and turn it back into
     the httplib.HTTPResponse that boto expects.
     """
     def __init__(self, app, host, is_secure=False):
         self.app = app
         self.host = host
-        self.deferred = defer.Deferred()
 
     def request(self, method, path, data, headers):
-        """Creates a connection to a fake tornado and sets
-        up a deferred request with the supplied data and
-        headers"""
-        conn = FakeTornadoConnection(self.deferred)
-        request = boto_to_tornado(connection=conn,
-                                  method=method,
-                                  path=path,
-                                  headers=headers,
-                                  data=data,
-                                  host=self.host)
-        self.app(request)
-        self.deferred.addCallback(raw_to_httpresponse)
+        req = webob.Request.blank(path)
+        req.method = method
+        req.body = data
+        req.headers = headers
+        req.headers['Accept'] = 'text/html'
+        req.host = self.host
+        # Call the WSGI app, get the HTTP response
+        resp = str(req.get_response(self.app))
+        # For some reason, the response doesn't have "HTTP/1.0 " prepended; I
+        # guess that's a function the web server usually provides.
+        resp = "HTTP/1.0 %s" % resp
+        sock = FakeHttplibSocket(resp)
+        self.http_response = httplib.HTTPResponse(sock)
+        self.http_response.begin()
 
     def getresponse(self):
-        """A bit of deferred magic for catching the response
-        from the previously deferred request"""
-        @defer.inlineCallbacks
-        def _waiter():
-            """Callback that simply yields the deferred's
-            return value."""
-            result = yield self.deferred
-            defer.returnValue(result)
-        d = _waiter()
-        # NOTE(termie): defer.returnValue above should ensure that
-        #               this deferred has already been called by the time
-        #               we get here, we are going to cheat and return
-        #               the result of the callback
-        return d.result # pylint: disable-msg=E1101
+        return self.http_response
 
     def close(self):
         """Required for compatibility with boto/tornado"""
@@ -180,17 +87,16 @@ class ApiEc2TestCase(test.BaseTestCase):
         super(ApiEc2TestCase, self).setUp()
 
         self.manager = manager.AuthManager()
-        self.cloud = cloud.CloudController()
 
         self.host = '127.0.0.1'
 
-        self.app = api.APIServerApplication({'Cloud': self.cloud})
+        self.app = api.API()
         self.ec2 = boto.connect_ec2(
                 aws_access_key_id='fake',
                 aws_secret_access_key='fake',
                 is_secure=False,
                 region=regioninfo.RegionInfo(None, 'test', self.host),
-                port=FLAGS.cc_port,
+                port=8773,
                 path='/services/Cloud')
 
         self.mox.StubOutWithMock(self.ec2, 'new_http_connection')
@@ -198,7 +104,7 @@ class ApiEc2TestCase(test.BaseTestCase):
     def expect_http(self, host=None, is_secure=False):
         """Returns a new EC2 connection"""
         http = FakeHttplibConnection(
-                self.app, '%s:%d' % (self.host, FLAGS.cc_port), False)
+                self.app, '%s:8773' % (self.host), False)
         # pylint: disable-msg=E1103
         self.ec2.new_http_connection(host, is_secure).AndReturn(http)
         return http
diff --git a/nova/tests/auth_unittest.py b/nova/tests/auth_unittest.py
index cbf7b22e2..3235dea39 100644
--- a/nova/tests/auth_unittest.py
+++ b/nova/tests/auth_unittest.py
@@ -24,7 +24,7 @@ from nova import crypto
 from nova import flags
 from nova import test
 from nova.auth import manager
-from nova.endpoint import cloud
+from nova.api.ec2 import cloud
 
 FLAGS = flags.FLAGS
 
diff --git a/nova/tests/cloud_unittest.py b/nova/tests/cloud_unittest.py
index 317200e01..756ce519e 100644
--- a/nova/tests/cloud_unittest.py
+++ b/nova/tests/cloud_unittest.py
@@ -22,7 +22,6 @@ from M2Crypto import RSA
 import StringIO
 import time
 
-from tornado import ioloop
 from twisted.internet import defer
 import unittest
 from xml.etree import ElementTree
@@ -35,8 +34,8 @@ from nova import test
 from nova import utils
 from nova.auth import manager
 from nova.compute import power_state
-from nova.endpoint import api
-from nova.endpoint import cloud
+from nova.api.ec2 import context
+from nova.api.ec2 import cloud
 
 
 FLAGS = flags.FLAGS
@@ -63,9 +62,8 @@ class CloudTestCase(test.BaseTestCase):
         self.manager = manager.AuthManager()
         self.user = self.manager.create_user('admin', 'admin', 'admin', True)
         self.project = self.manager.create_project('proj', 'admin', 'proj')
-        self.context = api.APIRequestContext(handler=None,
-                                             user=self.user,
-                                             project=self.project)
+        self.context = context.APIRequestContext(user=self.user,
+                                                 project=self.project)
 
     def tearDown(self):
         self.manager.delete_project(self.project)
diff --git a/nova/tests/network_unittest.py b/nova/tests/network_unittest.py
index dc5277f02..da65b50a2 100644
--- a/nova/tests/network_unittest.py
+++ b/nova/tests/network_unittest.py
@@ -28,7 +28,7 @@ from nova import flags
 from nova import test
 from nova import utils
 from nova.auth import manager
-from nova.endpoint import api
+from nova.api.ec2 import context
 
 FLAGS = flags.FLAGS
 
@@ -49,7 +49,7 @@ class NetworkTestCase(test.TrialTestCase):
         self.user = self.manager.create_user('netuser', 'netuser', 'netuser')
         self.projects = []
         self.network = utils.import_object(FLAGS.network_manager)
-        self.context = api.APIRequestContext(None, project=None, user=self.user)
+        self.context = context.APIRequestContext(project=None, user=self.user)
         for i in range(5):
             name = 'project%s' % i
             self.projects.append(self.manager.create_project(name,
diff --git a/nova/tests/quota_unittest.py b/nova/tests/quota_unittest.py
index cab9f663d..370ccd506 100644
--- a/nova/tests/quota_unittest.py
+++ b/nova/tests/quota_unittest.py
@@ -25,8 +25,8 @@ from nova import quota
 from nova import test
 from nova import utils
 from nova.auth import manager
-from nova.endpoint import cloud
-from nova.endpoint import api
+from nova.api.ec2 import cloud
+from nova.api.ec2 import context
 
 
 FLAGS = flags.FLAGS
@@ -48,9 +48,8 @@ class QuotaTestCase(test.TrialTestCase):
         self.user = self.manager.create_user('admin', 'admin', 'admin', True)
         self.project = self.manager.create_project('admin', 'admin', 'admin')
         self.network = utils.import_object(FLAGS.network_manager)
-        self.context = api.APIRequestContext(handler=None,
-                                             project=self.project,
-                                             user=self.user)
+        self.context = context.APIRequestContext(project=self.project,
+                                                 user=self.user)
 
     def tearDown(self):  # pylint: disable-msg=C0103
         manager.AuthManager().delete_project(self.project)
@@ -95,11 +94,11 @@ class QuotaTestCase(test.TrialTestCase):
         for i in range(FLAGS.quota_instances):
             instance_id = self._create_instance()
             instance_ids.append(instance_id)
-        self.assertFailure(self.cloud.run_instances(self.context,
-                                                    min_count=1,
-                                                    max_count=1,
-                                                    instance_type='m1.small'),
-                           cloud.QuotaError)
+        self.assertRaises(cloud.QuotaError, self.cloud.run_instances, 
+                                            self.context,
+                                            min_count=1,
+                                            max_count=1,
+                                            instance_type='m1.small')
         for instance_id in instance_ids:
             db.instance_destroy(self.context, instance_id)
 
@@ -107,11 +106,11 @@ class QuotaTestCase(test.TrialTestCase):
         instance_ids = []
         instance_id = self._create_instance(cores=4)
         instance_ids.append(instance_id)
-        self.assertFailure(self.cloud.run_instances(self.context,
-                                                    min_count=1,
-                                                    max_count=1,
-                                                    instance_type='m1.small'),
-                           cloud.QuotaError)
+        self.assertRaises(cloud.QuotaError, self.cloud.run_instances, 
+                                            self.context,
+                                            min_count=1,
+                                            max_count=1,
+                                            instance_type='m1.small')
         for instance_id in instance_ids:
             db.instance_destroy(self.context, instance_id)
 
@@ -120,10 +119,9 @@ class QuotaTestCase(test.TrialTestCase):
         for i in range(FLAGS.quota_volumes):
             volume_id = self._create_volume()
             volume_ids.append(volume_id)
-        self.assertRaises(cloud.QuotaError,
-                          self.cloud.create_volume,
-                          self.context,
-                          size=10)
+        self.assertRaises(cloud.QuotaError, self.cloud.create_volume,
+                                            self.context,
+                                            size=10)
         for volume_id in volume_ids:
             db.volume_destroy(self.context, volume_id)
 
@@ -151,5 +149,4 @@ class QuotaTestCase(test.TrialTestCase):
         #             make an rpc.call, the test just finishes with OK. It
         #             appears to be something in the magic inline callbacks
         #             that is breaking.
-        self.assertFailure(self.cloud.allocate_address(self.context),
-                           cloud.QuotaError)
+        self.assertRaises(cloud.QuotaError, self.cloud.allocate_address, self.context)