Merge "Remove mox usage from test_heat_client"

1 files changed, 378 insertions, 403 deletions

diff --git a/heat/tests/clients/test_heat_client.py b/heat/tests/clients/test_heat_client.py
index 3764aa60a..aa6840819 100644
--- a/heat/tests/clients/test_heat_client.py
+++ b/heat/tests/clients/test_heat_client.py
@@ -24,7 +24,6 @@ from keystoneauth1 import session as ks_session
 from keystoneauth1 import token_endpoint as ks_token_endpoint
 from keystoneclient.v3 import client as kc_v3
 from keystoneclient.v3 import domains as kc_v3_domains
-import mox
 from oslo_config import cfg
 import six
 
@@ -46,15 +45,21 @@ class KeystoneClientTest(common.HeatTestCase):
     def setUp(self):
         super(KeystoneClientTest, self).setUp()
 
-        self.mock_admin_client = self.m.CreateMock(kc_v3.Client)
-        self.mock_ks_v3_client = self.m.CreateMock(kc_v3.Client)
-        self.mock_ks_v3_client_domain_mngr = self.m.CreateMock(
-            kc_v3_domains.DomainManager)
-        self.m.StubOutWithMock(kc_v3, "Client")
-        self.m.StubOutWithMock(ks_auth, 'Password')
-        self.m.StubOutWithMock(ks_token_endpoint, 'Token')
-        self.m.StubOutWithMock(ks_auth_access, 'AccessInfoPlugin')
-        self.m.StubOutWithMock(ks_loading, 'load_auth_from_conf_options')
+        self.mock_ks_v3_client_domain_mngr = self.patchobject(
+            kc_v3_domains, 'DomainManager', spec=kc_v3_domains.DomainManager)
+
+        self.mock_ks_v3_client = mock.Mock()
+        self.mock_ks_v3_client.domains = (
+            self.mock_ks_v3_client_domain_mngr.return_value)
+
+        self.m_client = self.patchobject(kc_v3, 'Client',
+                                         return_value=self.mock_ks_v3_client)
+
+        self.m_password = self.patchobject(ks_auth, 'Password')
+        self.m_token = self.patchobject(ks_token_endpoint, 'Token')
+        self.m_access = self.patchobject(ks_auth_access, 'AccessInfoPlugin')
+        self.m_load_auth = self.patchobject(
+            ks_loading, 'load_auth_from_conf_options')
 
         cfg.CONF.set_override('auth_uri', 'http://server.test:5000/v2.0',
                               group='keystone_authtoken')
@@ -62,98 +67,119 @@ class KeystoneClientTest(common.HeatTestCase):
         cfg.CONF.set_override('stack_domain_admin', 'adminuser123')
         cfg.CONF.set_override('stack_domain_admin_password', 'adminsecret')
 
-        self.addCleanup(self.m.VerifyAll)
-
     def _clear_domain_override(self):
         cfg.CONF.clear_override('stack_user_domain_id')
 
-    def _stub_admin_auth(self, auth_ok=True):
-        mock_ks_auth = self.m.CreateMockAnything()
-
-        a = mock_ks_auth.get_user_id(mox.IsA(ks_session.Session))
-        if auth_ok:
-            a.AndReturn('1234')
-        else:
-            a.AndRaise(kc_exception.Unauthorized)
-
-        m = ks_loading.load_auth_from_conf_options(
-            cfg.CONF, 'trustee', trust_id=None)
-        m.AndReturn(mock_ks_auth)
-
     def _stub_domain_admin_client(self, domain_id=None):
-        mock_ks_auth = self.m.CreateMockAnything()
-        mock_ks_auth.get_token(mox.IsA(ks_session.Session)).AndReturn('tok')
-
-        m = ks_auth.Password(auth_url='http://server.test:5000/v3',
-                             password='adminsecret',
-                             domain_id='adomain123',
-                             domain_name=None,
-                             user_domain_id='adomain123',
-                             user_domain_name=None,
-                             username='adminuser123')
-        m.AndReturn(mock_ks_auth)
-
-        n = kc_v3.Client(session=mox.IsA(ks_session.Session),
-                         auth=mock_ks_auth,
-                         region_name=None)
-        n.AndReturn(self.mock_admin_client)
-
-        self.mock_admin_client.domains = self.mock_ks_v3_client_domain_mngr
+        self.mock_ks_auth = self.m_password.return_value
+        self.mock_ks_auth.get_token.return_value = 'tok'
+
+    def _validate_stub_domain_admin_client(self):
+        self.m_password.assert_called_once_with(
+            auth_url='http://server.test:5000/v3',
+            password='adminsecret',
+            domain_id='adomain123',
+            domain_name=None,
+            user_domain_id='adomain123',
+            user_domain_name=None,
+            username='adminuser123')
+        self.m_client.assert_called_once_with(
+            session=utils.AnyInstance(ks_session.Session),
+            auth=self.mock_ks_auth,
+            region_name=None)
 
     def _stubs_auth(self, method='token', trust_scoped=True,
                     user_id=None, auth_ref=None, client=True, project_id=None,
-                    stub_trust_context=False, version=3):
-        mock_auth_ref = self.m.CreateMockAnything()
-        mock_ks_auth = self.m.CreateMockAnything()
+                    stub_trust_context=False, version=3,
+                    stub_admin_auth=False):
+        self.version = version
+        mock_auth_ref = mock.Mock()
+        mock_ks_auth = mock.Mock()
+        self.method = method
+        self.project_id = project_id
+        self.client = client
+        self.stub_admin_auth = stub_admin_auth
 
         if method == 'token':
-            p = ks_token_endpoint.Token(token='abcd1234',
-                                        endpoint='http://server.test:5000/v3')
-        elif method == 'auth_ref' and version == 3:
-            p = ks_auth_access.AccessInfoPlugin(
-                auth_ref=mox.IsA(ks_access.AccessInfoV3),
-                auth_url='http://server.test:5000/v3')
-        elif method == 'auth_ref' and version == 2:
-            p = ks_auth_access.AccessInfoPlugin(
-                auth_ref=mox.IsA(ks_access.AccessInfoV2),
-                auth_url='http://server.test:5000/v3')
-
+            self.m_token.return_value = mock_ks_auth
+        elif method == 'auth_ref':
+            self.m_access.return_value = mock_ks_auth
         elif method == 'password':
-            p = ks_auth.Password(auth_url='http://server.test:5000/v3',
-                                 username='test_username',
-                                 password='password',
-                                 project_id=project_id or 'test_tenant_id',
-                                 user_domain_id='adomain123')
-
+            ks_auth.Password.return_value = mock_ks_auth
         elif method == 'trust':
-            p = ks_loading.load_auth_from_conf_options(cfg.CONF,
-                                                       'trustee',
-                                                       trust_id='atrust123')
-
             mock_auth_ref.user_id = user_id or 'trustor_user_id'
             mock_auth_ref.project_id = project_id or 'test_tenant_id'
             mock_auth_ref.trust_scoped = trust_scoped
             mock_auth_ref.auth_token = 'atrusttoken'
-
-        p.AndReturn(mock_ks_auth)
+            self.m_load_auth.return_value = mock_ks_auth
 
         if client:
-            c = kc_v3.Client(session=mox.IsA(ks_session.Session),
-                             region_name=None)
-            c.AndReturn(self.mock_ks_v3_client)
 
             if stub_trust_context:
-                m = mock_ks_auth.get_user_id(mox.IsA(ks_session.Session))
-                m.AndReturn(user_id)
+                mock_ks_auth.get_user_id.return_value = user_id
 
-                m = mock_ks_auth.get_project_id(mox.IsA(ks_session.Session))
-                m.AndReturn(project_id)
+                mock_ks_auth.get_project_id.return_value = project_id
 
-            m = mock_ks_auth.get_access(mox.IsA(ks_session.Session))
-            m.AndReturn(mock_auth_ref)
+            mock_ks_auth.get_access.return_value = mock_auth_ref
 
+        if not stub_admin_auth:
+            self.m_load_auth.return_value = mock_ks_auth
+        else:
+            # when authenticate with trusts, we needs to mock get_user_id
+            # to return trustee user
+            self.mock_admin_ks_auth = mock.Mock()
+            self.mock_admin_ks_auth.get_user_id.return_value = '1234'
+            self.m_load_auth.return_value = self.mock_admin_ks_auth
         return mock_ks_auth, mock_auth_ref
 
+    def _validate_stub_auth(self):
+
+        if self.method == 'token':
+            self.m_token.assert_called_once_with(
+                token='abcd1234', endpoint='http://server.test:5000/v3')
+        else:
+            self.m_token.assert_not_called()
+        if self.method == 'auth_ref':
+            if self.version == 3:
+                access_type = ks_access.AccessInfoV3
+            else:
+                access_type = ks_access.AccessInfoV2
+            self.m_access.assert_called_once_with(
+                auth_ref=utils.AnyInstance(access_type),
+                auth_url='http://server.test:5000/v3')
+        else:
+            self.m_access.assert_not_called()
+        if self.method == 'password':
+            self.m_password.assert_called_once_with(
+                auth_url='http://server.test:5000/v3',
+                username='test_username',
+                password='password',
+                project_id=self.project_id or 'test_tenant_id',
+                user_domain_id='adomain123')
+        else:
+            self.m_password.assert_not_called()
+
+        if self.method == 'trust':
+            self.m_load_auth.assert_called_once_with(
+                cfg.CONF, 'trustee', trust_id='atrust123')
+        else:
+            self.m_load_auth.assert_not_called()
+        if self.client:
+            self.m_client.assert_any_call(
+                session=utils.AnyInstance(ks_session.Session),
+                region_name=None)
+        if self.stub_admin_auth:
+            self.mock_admin_ks_auth.get_user_id.assert_called_once_with(
+                utils.AnyInstance(ks_session.Session))
+
+    def _stubs_get_user(self, user_id, domain_id=None,
+                        default_project_id=None):
+        mock_user = mock.Mock()
+        mock_user.id = user_id
+        mock_user.domain_id = domain_id
+        mock_user.default_project_id = default_project_id
+        self.mock_ks_v3_client.users.get.return_value = mock_user
+
     def test_username_length(self):
         """Test that user names >255 characters are properly truncated."""
 
@@ -165,30 +191,33 @@ class KeystoneClientTest(common.HeatTestCase):
         # a >255 character user name and the expected version
         long_user_name = 'U' * 255 + 'S'
         good_user_name = 'U' * 254 + 'S'
-        # mock keystone client user functions
-        self.mock_ks_v3_client.users = self.m.CreateMockAnything()
-        mock_user = self.m.CreateMockAnything()
+
+        mock_user = mock.Mock()
         mock_user.id = 'auser123'
         # when keystone is called, the name should have been truncated
         # to the last 255 characters of the long name
-        self.mock_ks_v3_client.users.create(name=good_user_name,
-                                            password='password',
-                                            default_project=ctx.tenant_id
-                                            ).AndReturn(mock_user)
-
-        self.mock_ks_v3_client.roles = self.m.CreateMockAnything()
-        self.mock_ks_v3_client.roles.list(
-            name='heat_stack_user').AndReturn(self._mock_roles_list())
-        self.mock_ks_v3_client.roles.grant(project=ctx.tenant_id,
-                                           role='4546',
-                                           user='auser123').AndReturn(None)
-        self.m.ReplayAll()
+        self.mock_ks_v3_client.users.create.return_value = mock_user
+
+        self.mock_ks_v3_client.roles.list.return_value = self._mock_roles_list(
+        )
+        self.mock_ks_v3_client.roles.grant.return_value = None
         # call create_stack_user with a long user name.
         # the cleanup VerifyAll should verify that though we passed
         # long_user_name, keystone was actually called with a truncated
         # user name
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         heat_ks_client.create_stack_user(long_user_name, password='password')
+        self.mock_ks_v3_client.users.create.assert_called_once_with(
+            name=good_user_name,
+            password='password',
+            default_project=ctx.tenant_id)
+        self.mock_ks_v3_client.roles.list.assert_called_once_with(
+            name='heat_stack_user')
+        self.mock_ks_v3_client.roles.grant.assert_called_once_with(
+            project=ctx.tenant_id,
+            role='4546',
+            user='auser123')
+        self._validate_stub_auth()
 
     def test_create_stack_user_error_norole(self):
         """Test error path when no role is found."""
@@ -198,19 +227,19 @@ class KeystoneClientTest(common.HeatTestCase):
         ctx = utils.dummy_context()
         ctx.trust_id = None
 
-        self.mock_ks_v3_client.roles = self.m.CreateMockAnything()
-        self.mock_ks_v3_client.roles.list(
-            name='heat_stack_user').AndReturn([])
-        self.m.ReplayAll()
+        self.mock_ks_v3_client.roles.list.return_value = []
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         err = self.assertRaises(exception.Error,
                                 heat_ks_client.create_stack_user,
                                 'auser', password='password')
         self.assertIn("Can't find role heat_stack_user", six.text_type(err))
+        self.mock_ks_v3_client.roles.list.assert_called_once_with(
+            name='heat_stack_user')
+        self._validate_stub_auth()
 
     def _mock_roles_list(self, heat_stack_user='heat_stack_user'):
         mock_roles_list = []
-        mock_role = self.m.CreateMockAnything()
+        mock_role = mock.Mock()
         mock_role.id = '4546'
         mock_role.name = heat_stack_user
         mock_roles_list.append(mock_role)
@@ -225,25 +254,25 @@ class KeystoneClientTest(common.HeatTestCase):
 
         # mock keystone client functions
         self._stub_domain_admin_client()
-        self.mock_admin_client.users = self.m.CreateMockAnything()
-        mock_user = self.m.CreateMockAnything()
-        mock_user.id = 'duser123'
-        self.mock_admin_client.users.create(name='duser',
-                                            password=None,
-                                            default_project='aproject',
-                                            domain='adomain123'
-                                            ).AndReturn(mock_user)
-        self.mock_admin_client.roles = self.m.CreateMockAnything()
-        self.mock_admin_client.roles.list(
-            name='heat_stack_user').AndReturn(self._mock_roles_list())
-        self.mock_admin_client.roles.grant(project='aproject',
-                                           role='4546',
-                                           user='duser123').AndReturn(None)
-        self.m.ReplayAll()
-
+        self.mock_ks_v3_client.users.create.return_value.id = 'duser123'
+        self.mock_ks_v3_client.roles.list.return_value = self._mock_roles_list(
+        )
+        self.mock_ks_v3_client.roles.grant.return_value = None
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         heat_ks_client.create_stack_domain_user(username='duser',
                                                 project_id='aproject')
+        self._validate_stub_domain_admin_client()
+        self.mock_ks_v3_client.users.create.assert_called_once_with(
+            name='duser',
+            password=None,
+            default_project='aproject',
+            domain='adomain123')
+        self.mock_ks_v3_client.roles.grant.assert_called_once_with(
+            project='aproject',
+            role='4546',
+            user='duser123')
+        self.mock_ks_v3_client.roles.list.assert_called_once_with(
+            name='heat_stack_user')
 
     def test_create_stack_domain_user_legacy_fallback(self):
         """Test creating a stack domain user, fallback path."""
@@ -251,29 +280,31 @@ class KeystoneClientTest(common.HeatTestCase):
 
         ctx = utils.dummy_context()
         ctx.trust_id = None
+        mock_user = mock.Mock()
+        mock_user.id = 'auser123'
+        self.mock_ks_v3_client.users.create.return_value = mock_user
 
         # mock keystone client functions
         self._stubs_auth()
-        self.mock_ks_v3_client.users = self.m.CreateMockAnything()
-        mock_user = self.m.CreateMockAnything()
-        mock_user.id = 'auser123'
-        self.mock_ks_v3_client.users.create(name='auser',
-                                            password='password',
-                                            default_project=ctx.tenant_id
-                                            ).AndReturn(mock_user)
-
-        self.mock_ks_v3_client.roles = self.m.CreateMockAnything()
-        self.mock_ks_v3_client.roles.list(
-            name='heat_stack_user').AndReturn(self._mock_roles_list())
-        self.mock_ks_v3_client.roles.grant(project=ctx.tenant_id,
-                                           role='4546',
-                                           user='auser123').AndReturn(None)
-        self.m.ReplayAll()
+        self.mock_ks_v3_client.roles.list.return_value = self._mock_roles_list(
+        )
+        self.mock_ks_v3_client.roles.grant.return_value = None
 
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         heat_ks_client.create_stack_domain_user(username='auser',
                                                 project_id='aproject',
                                                 password='password')
+        self.mock_ks_v3_client.users.create.assert_called_once_with(
+            name='auser',
+            password='password',
+            default_project=ctx.tenant_id)
+        self.mock_ks_v3_client.roles.grant.assert_called_once_with(
+            project=ctx.tenant_id,
+            role='4546',
+            user='auser123')
+        self.mock_ks_v3_client.roles.list.assert_called_once_with(
+            name='heat_stack_user')
+        self._validate_stub_auth()
 
     def test_create_stack_domain_user_error_norole(self):
         """Test creating a stack domain user, no role error path."""
@@ -284,15 +315,16 @@ class KeystoneClientTest(common.HeatTestCase):
         self._stub_domain_admin_client(domain_id=None)
 
         # mock keystone client functions
-        self.mock_admin_client.roles = self.m.CreateMockAnything()
-        self.mock_admin_client.roles.list(name='heat_stack_user').AndReturn([])
-        self.m.ReplayAll()
+        self.mock_ks_v3_client.roles.list.return_value = []
 
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         err = self.assertRaises(exception.Error,
                                 heat_ks_client.create_stack_domain_user,
                                 username='duser', project_id='aproject')
         self.assertIn("Can't find role heat_stack_user", six.text_type(err))
+        self._validate_stub_domain_admin_client()
+        self.mock_ks_v3_client.roles.list.assert_called_once_with(
+            name='heat_stack_user')
 
     def test_delete_stack_domain_user(self):
         """Test deleting a stack domain user."""
@@ -303,17 +335,12 @@ class KeystoneClientTest(common.HeatTestCase):
 
         # mock keystone client functions
         self._stub_domain_admin_client()
-        self.mock_admin_client.users = self.m.CreateMockAnything()
-        mock_user = self.m.CreateMockAnything()
+        mock_user = mock.Mock()
         mock_user.id = 'duser123'
         mock_user.domain_id = 'adomain123'
         mock_user.default_project_id = 'aproject'
-        self.mock_admin_client.users.get('duser123').AndReturn(mock_user)
-        self.mock_admin_client.users.delete('duser123').AndReturn(None)
-        self.mock_admin_client.users.get('duser123').AndRaise(
-            kc_exception.NotFound)
-
-        self.m.ReplayAll()
+        self.mock_ks_v3_client.users.get.side_effect = [mock_user,
+                                                        kc_exception.NotFound]
 
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         heat_ks_client.delete_stack_domain_user(user_id='duser123',
@@ -321,6 +348,9 @@ class KeystoneClientTest(common.HeatTestCase):
         # Second delete will raise ignored NotFound
         heat_ks_client.delete_stack_domain_user(user_id='duser123',
                                                 project_id='aproject')
+        self._validate_stub_domain_admin_client()
+        self.mock_ks_v3_client.users.get.assert_called_with('duser123')
+        self.mock_ks_v3_client.users.delete.assert_called_once_with('duser123')
 
     def test_delete_stack_domain_user_legacy_fallback(self):
         """Test deleting a stack domain user, fallback path."""
@@ -331,13 +361,13 @@ class KeystoneClientTest(common.HeatTestCase):
 
         # mock keystone client functions
         self._stubs_auth()
-        self.mock_ks_v3_client.users = self.m.CreateMockAnything()
-        self.mock_ks_v3_client.users.delete(user='user123').AndReturn(None)
-        self.m.ReplayAll()
 
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         heat_ks_client.delete_stack_domain_user(user_id='user123',
                                                 project_id='aproject')
+        self.mock_ks_v3_client.users.delete.assert_called_once_with(
+            user='user123')
+        self._validate_stub_auth()
 
     def test_delete_stack_domain_user_error_domain(self):
         """Test deleting a stack domain user, wrong domain."""
@@ -348,19 +378,16 @@ class KeystoneClientTest(common.HeatTestCase):
 
         # mock keystone client functions
         self._stub_domain_admin_client()
-        self.mock_admin_client.users = self.m.CreateMockAnything()
-        mock_user = self.m.CreateMockAnything()
-        mock_user.id = 'duser123'
-        mock_user.domain_id = 'notadomain123'
-        mock_user.default_project_id = 'aproject'
-        self.mock_admin_client.users.get('duser123').AndReturn(mock_user)
-        self.m.ReplayAll()
+        self._stubs_get_user(user_id='duser123', domain_id='notadomain123',
+                             default_project_id='aproject')
 
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         err = self.assertRaises(ValueError,
                                 heat_ks_client.delete_stack_domain_user,
                                 user_id='duser123', project_id='aproject')
         self.assertIn('User delete in invalid domain', err.args)
+        self._validate_stub_domain_admin_client()
+        self.mock_ks_v3_client.users.get.assert_called_once_with('duser123')
 
     def test_delete_stack_domain_user_error_project(self):
         """Test deleting a stack domain user, wrong project."""
@@ -371,19 +398,15 @@ class KeystoneClientTest(common.HeatTestCase):
 
         # mock keystone client functions
         self._stub_domain_admin_client()
-        self.mock_admin_client.users = self.m.CreateMockAnything()
-        mock_user = self.m.CreateMockAnything()
-        mock_user.id = 'duser123'
-        mock_user.domain_id = 'adomain123'
-        mock_user.default_project_id = 'notaproject'
-        self.mock_admin_client.users.get('duser123').AndReturn(mock_user)
-        self.m.ReplayAll()
-
+        self._stubs_get_user(user_id='duser123', domain_id='adomain123',
+                             default_project_id='notaproject')
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         err = self.assertRaises(ValueError,
                                 heat_ks_client.delete_stack_domain_user,
                                 user_id='duser123', project_id='aproject')
         self.assertIn('User delete in invalid project', err.args)
+        self._validate_stub_domain_admin_client()
+        self.mock_ks_v3_client.users.get.assert_called_once_with('duser123')
 
     def test_delete_stack_user(self):
 
@@ -395,23 +418,22 @@ class KeystoneClientTest(common.HeatTestCase):
         ctx.trust_id = None
 
         # mock keystone client delete function
-        self.mock_ks_v3_client.users = self.m.CreateMockAnything()
-        self.mock_ks_v3_client.users.delete(user='atestuser').AndReturn(None)
-        self.mock_ks_v3_client.users.delete(user='atestuser').AndRaise(
-            kc_exception.NotFound)
+        self.mock_ks_v3_client.users.delete.side_effect = [
+            None, kc_exception.NotFound]
 
-        self.m.ReplayAll()
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         heat_ks_client.delete_stack_user('atestuser')
         # Second delete will raise ignored NotFound
         heat_ks_client.delete_stack_user('atestuser')
+        self.mock_ks_v3_client.users.delete.assert_called_with(
+            user='atestuser')
+        self._validate_stub_auth()
 
     def test_init_v3_token(self):
 
         """Test creating the client, token auth."""
 
         self._stubs_auth()
-        self.m.ReplayAll()
 
         ctx = utils.dummy_context()
         ctx.username = None
@@ -420,6 +442,7 @@ class KeystoneClientTest(common.HeatTestCase):
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         heat_ks_client.client
         self.assertIsNotNone(heat_ks_client._client)
+        self._validate_stub_auth()
 
     def test_init_v3_token_auth_ref_v2(self):
 
@@ -430,7 +453,6 @@ class KeystoneClientTest(common.HeatTestCase):
         self._stubs_auth(method='auth_ref',
                          auth_ref=expected_auth_ref,
                          version=2)
-        self.m.ReplayAll()
 
         ctx = utils.dummy_context()
         ctx.username = None
@@ -442,6 +464,7 @@ class KeystoneClientTest(common.HeatTestCase):
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         heat_ks_client.client
         self.assertIsNotNone(heat_ks_client._client)
+        self._validate_stub_auth()
 
     def test_init_v3_token_auth_ref_v3(self):
 
@@ -452,7 +475,6 @@ class KeystoneClientTest(common.HeatTestCase):
                              'version': 'v3',
                              'methods': []}
         self._stubs_auth(method='auth_ref', auth_ref=expected_auth_ref)
-        self.m.ReplayAll()
 
         ctx = utils.dummy_context()
         ctx.username = None
@@ -463,13 +485,13 @@ class KeystoneClientTest(common.HeatTestCase):
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         heat_ks_client.client
         self.assertIsNotNone(heat_ks_client._client)
+        self._validate_stub_auth()
 
     def test_init_v3_password(self):
 
         """Test creating the client, password auth."""
 
         self._stubs_auth(method='password')
-        self.m.ReplayAll()
 
         ctx = utils.dummy_context()
         ctx.auth_token = None
@@ -480,6 +502,7 @@ class KeystoneClientTest(common.HeatTestCase):
         client = heat_ks_client.client
         self.assertIsNotNone(client)
         self.assertIsNone(ctx.trust_id)
+        self._validate_stub_auth()
 
     def test_init_v3_bad_nocreds(self):
 
@@ -499,7 +522,6 @@ class KeystoneClientTest(common.HeatTestCase):
 
         self._stubs_auth(method='trust')
         cfg.CONF.set_override('deferred_auth_method', 'trusts')
-        self.m.ReplayAll()
 
         ctx = utils.dummy_context()
         ctx.trust_id = 'atrust123'
@@ -508,6 +530,7 @@ class KeystoneClientTest(common.HeatTestCase):
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         trust_context = heat_ks_client.create_trust_context()
         self.assertEqual(ctx.to_dict(), trust_context.to_dict())
+        self._validate_stub_auth()
 
     def test_create_trust_context_trust_create_deletegate_subset_roles(self):
         delegate_roles = ['heat_stack_owner']
@@ -523,10 +546,10 @@ class KeystoneClientTest(common.HeatTestCase):
         class MockTrust(object):
             id = 'atrust123'
 
-        self._stub_admin_auth()
         mock_ks_auth, mock_auth_ref = self._stubs_auth(user_id='5678',
                                                        project_id='42',
-                                                       stub_trust_context=True)
+                                                       stub_trust_context=True,
+                                                       stub_admin_auth=True)
 
         cfg.CONF.set_override('deferred_auth_method', 'trusts')
         if delegate_roles:
@@ -534,21 +557,10 @@ class KeystoneClientTest(common.HeatTestCase):
 
         trustor_roles = ['heat_stack_owner', 'admin', '__member__']
         trustee_roles = delegate_roles or trustor_roles
-
-        self.mock_ks_v3_client.trusts = self.m.CreateMockAnything()
-
         mock_auth_ref.user_id = '5678'
         mock_auth_ref.project_id = '42'
 
-        self.mock_ks_v3_client.trusts = self.m.CreateMockAnything()
-        self.mock_ks_v3_client.trusts.create(
-            trustor_user='5678',
-            trustee_user='1234',
-            project='42',
-            impersonation=True,
-            role_names=trustee_roles).AndReturn(MockTrust())
-
-        self.m.ReplayAll()
+        self.mock_ks_v3_client.trusts.create.return_value = MockTrust()
 
         ctx = utils.dummy_context(roles=trustor_roles)
         ctx.trust_id = None
@@ -556,29 +568,29 @@ class KeystoneClientTest(common.HeatTestCase):
         trust_context = heat_ks_client.create_trust_context()
         self.assertEqual('atrust123', trust_context.trust_id)
         self.assertEqual('5678', trust_context.trustor_user_id)
+        self.m_load_auth.assert_called_once_with(
+            cfg.CONF, 'trustee', trust_id=None)
+        self.mock_ks_v3_client.trusts.create.assert_called_once_with(
+            trustor_user='5678',
+            trustee_user='1234',
+            project='42',
+            impersonation=True,
+            role_names=trustee_roles)
 
     def test_create_trust_context_trust_create_norole(self):
 
         """Test create_trust_context when creating a trust."""
 
-        self._stub_admin_auth()
-
         mock_auth, mock_auth_ref = self._stubs_auth(user_id='5678',
                                                     project_id='42',
-                                                    stub_trust_context=True)
+                                                    stub_trust_context=True,
+                                                    stub_admin_auth=True)
 
         cfg.CONF.set_override('deferred_auth_method', 'trusts')
         cfg.CONF.set_override('trusts_delegated_roles', ['heat_stack_owner'])
 
-        self.mock_ks_v3_client.trusts = self.m.CreateMockAnything()
-        self.mock_ks_v3_client.trusts.create(
-            trustor_user='5678',
-            trustee_user='1234',
-            project='42',
-            impersonation=True,
-            role_names=['heat_stack_owner']).AndRaise(kc_exception.NotFound())
-
-        self.m.ReplayAll()
+        exc = kc_exception.NotFound
+        self.mock_ks_v3_client.trusts.create.side_effect = exc
 
         ctx = utils.dummy_context()
         ctx.trust_id = None
@@ -587,6 +599,14 @@ class KeystoneClientTest(common.HeatTestCase):
                                 heat_ks_client.create_trust_context)
         expected = "Missing required credential: roles ['heat_stack_owner']"
         self.assertIn(expected, six.text_type(exc))
+        self.m_load_auth.assert_called_with(
+            cfg.CONF, 'trustee', trust_id=None)
+        self.mock_ks_v3_client.trusts.create.assert_called_once_with(
+            trustor_user='5678',
+            trustee_user='1234',
+            project='42',
+            impersonation=True,
+            role_names=['heat_stack_owner'])
 
     def test_init_domain_cfg_not_set_fallback(self):
         """Test error path when config lacks domain config."""
@@ -623,7 +643,6 @@ class KeystoneClientTest(common.HeatTestCase):
 
         self._stubs_auth(method='trust')
         cfg.CONF.set_override('deferred_auth_method', 'trusts')
-        self.m.ReplayAll()
 
         ctx = utils.dummy_context()
         ctx.username = None
@@ -634,6 +653,7 @@ class KeystoneClientTest(common.HeatTestCase):
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         self.assertIsNotNone(heat_ks_client.client)
         self.assertIsNone(ctx.auth_token)
+        self._validate_stub_auth()
 
     def test_trust_init_fail(self):
 
@@ -641,7 +661,6 @@ class KeystoneClientTest(common.HeatTestCase):
 
         self._stubs_auth(method='trust', trust_scoped=False)
         cfg.CONF.set_override('deferred_auth_method', 'trusts')
-        self.m.ReplayAll()
 
         ctx = utils.dummy_context()
         ctx.username = None
@@ -651,6 +670,7 @@ class KeystoneClientTest(common.HeatTestCase):
         ctx.trustor_user_id = 'trustor_user_id'
         self.assertRaises(exception.AuthorizationFailure,
                           heat_keystoneclient.KeystoneClient, ctx)
+        self._validate_stub_auth()
 
     def test_trust_init_fail_impersonation(self):
 
@@ -658,7 +678,6 @@ class KeystoneClientTest(common.HeatTestCase):
 
         self._stubs_auth(method='trust', user_id='wrong_user_id')
         cfg.CONF.set_override('deferred_auth_method', 'trusts')
-        self.m.ReplayAll()
 
         ctx = utils.dummy_context()
         ctx.username = 'heat'
@@ -668,13 +687,13 @@ class KeystoneClientTest(common.HeatTestCase):
         ctx.trustor_user_id = 'trustor_user_id'
         self.assertRaises(exception.AuthorizationFailure,
                           heat_keystoneclient.KeystoneClient, ctx)
+        self._validate_stub_auth()
 
     def test_trust_init_pw(self):
 
         """Test trust_id is takes precedence username/password specified."""
 
         self._stubs_auth(method='trust')
-        self.m.ReplayAll()
 
         ctx = utils.dummy_context()
         ctx.auth_token = None
@@ -682,13 +701,13 @@ class KeystoneClientTest(common.HeatTestCase):
         ctx.trustor_user_id = 'trustor_user_id'
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         self.assertIsNotNone(heat_ks_client._client)
+        self._validate_stub_auth()
 
     def test_trust_init_token(self):
 
         """Test trust_id takes precedence when token specified."""
 
         self._stubs_auth(method='trust')
-        self.m.ReplayAll()
 
         ctx = utils.dummy_context()
         ctx.username = None
@@ -697,20 +716,19 @@ class KeystoneClientTest(common.HeatTestCase):
         ctx.trustor_user_id = 'trustor_user_id'
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         self.assertIsNotNone(heat_ks_client._client)
+        self._validate_stub_auth()
 
     def _test_delete_trust(self, raise_ext=None):
         self._stubs_auth()
         cfg.CONF.set_override('deferred_auth_method', 'trusts')
-        self.mock_ks_v3_client.trusts = self.m.CreateMockAnything()
-        if raise_ext is None:
-            self.mock_ks_v3_client.trusts.delete('atrust123').AndReturn(None)
-        else:
-            self.mock_ks_v3_client.trusts.delete('atrust123').AndRaise(
-                raise_ext)
-        self.m.ReplayAll()
+        if raise_ext is not None:
+            self.mock_ks_v3_client.trusts.delete.side_effect = raise_ext
         ctx = utils.dummy_context()
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         self.assertIsNone(heat_ks_client.delete_trust(trust_id='atrust123'))
+        self.mock_ks_v3_client.trusts.delete.assert_called_once_with(
+            'atrust123')
+        self._validate_stub_auth()
 
     def test_delete_trust(self):
 
@@ -739,13 +757,11 @@ class KeystoneClientTest(common.HeatTestCase):
         ctx = utils.dummy_context()
         ctx.trust_id = None
 
-        # mock keystone client update function
-        self.mock_ks_v3_client.users = self.m.CreateMockAnything()
-        self.mock_ks_v3_client.users.update(user='atestuser', enabled=False
-                                            ).AndReturn(None)
-        self.m.ReplayAll()
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         heat_ks_client.disable_stack_user('atestuser')
+        self.mock_ks_v3_client.users.update.assert_called_once_with(
+            user='atestuser', enabled=False)
+        self._validate_stub_auth()
 
     def test_enable_stack_user(self):
 
@@ -756,22 +772,11 @@ class KeystoneClientTest(common.HeatTestCase):
         ctx = utils.dummy_context()
         ctx.trust_id = None
 
-        # mock keystone client update function
-        self.mock_ks_v3_client.users = self.m.CreateMockAnything()
-        self.mock_ks_v3_client.users.update(user='atestuser', enabled=True
-                                            ).AndReturn(None)
-        self.m.ReplayAll()
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         heat_ks_client.enable_stack_user('atestuser')
-
-    def _stub_admin_user_get(self, user_id, domain_id, project_id):
-        self.mock_admin_client.users = self.m.CreateMockAnything()
-        mock_user = self.m.CreateMockAnything()
-        mock_user.id = user_id
-        mock_user.domain_id = domain_id
-        mock_user.default_project_id = project_id
-        self.mock_admin_client.users.get(user_id).AndReturn(mock_user)
-        return mock_user
+        self.mock_ks_v3_client.users.update.assert_called_once_with(
+            user='atestuser', enabled=True)
+        self._validate_stub_auth()
 
     def test_enable_stack_domain_user(self):
         """Test enabling a stack domain user."""
@@ -782,14 +787,15 @@ class KeystoneClientTest(common.HeatTestCase):
 
         # mock keystone client functions
         self._stub_domain_admin_client()
-        self._stub_admin_user_get('duser123', 'adomain123', 'aproject')
-        self.mock_admin_client.users.update(user='duser123', enabled=True
-                                            ).AndReturn(None)
-        self.m.ReplayAll()
+        self._stubs_get_user('duser123', 'adomain123', 'aproject')
 
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         heat_ks_client.enable_stack_domain_user(user_id='duser123',
                                                 project_id='aproject')
+        self._validate_stub_domain_admin_client()
+        self.mock_ks_v3_client.users.get.assert_called_once_with('duser123')
+        self.mock_ks_v3_client.users.update.assert_called_once_with(
+            user='duser123', enabled=True)
 
     def test_enable_stack_domain_user_legacy_fallback(self):
         """Test enabling a stack domain user, fallback path."""
@@ -800,14 +806,13 @@ class KeystoneClientTest(common.HeatTestCase):
 
         # mock keystone client functions
         self._stubs_auth()
-        self.mock_ks_v3_client.users = self.m.CreateMockAnything()
-        self.mock_ks_v3_client.users.update(user='user123', enabled=True
-                                            ).AndReturn(None)
-        self.m.ReplayAll()
 
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         heat_ks_client.enable_stack_domain_user(user_id='user123',
                                                 project_id='aproject')
+        self.mock_ks_v3_client.users.update.assert_called_once_with(
+            user='user123', enabled=True)
+        self._validate_stub_auth()
 
     def test_enable_stack_domain_user_error_project(self):
         """Test enabling a stack domain user, wrong project."""
@@ -818,12 +823,13 @@ class KeystoneClientTest(common.HeatTestCase):
 
         # mock keystone client functions
         self._stub_domain_admin_client()
-        self._stub_admin_user_get('duser123', 'adomain123', 'notaproject')
-        self.m.ReplayAll()
+        self._stubs_get_user('duser123', 'adomain123', 'notaproject')
 
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         self.assertRaises(ValueError, heat_ks_client.enable_stack_domain_user,
                           user_id='duser123', project_id='aproject')
+        self._validate_stub_domain_admin_client()
+        self.mock_ks_v3_client.users.get.assert_called_once_with('duser123')
 
     def test_enable_stack_domain_user_error_domain(self):
         """Test enabling a stack domain user, wrong domain."""
@@ -834,12 +840,13 @@ class KeystoneClientTest(common.HeatTestCase):
 
         # mock keystone client functions
         self._stub_domain_admin_client()
-        self._stub_admin_user_get('duser123', 'notadomain123', 'aproject')
-        self.m.ReplayAll()
+        self._stubs_get_user('duser123', 'notadomain123', 'aproject')
 
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         self.assertRaises(ValueError, heat_ks_client.enable_stack_domain_user,
                           user_id='duser123', project_id='aproject')
+        self._validate_stub_domain_admin_client()
+        self.mock_ks_v3_client.users.get.assert_called_once_with('duser123')
 
     def test_disable_stack_domain_user(self):
         """Test disabling a stack domain user."""
@@ -850,14 +857,14 @@ class KeystoneClientTest(common.HeatTestCase):
 
         # mock keystone client functions
         self._stub_domain_admin_client()
-        self._stub_admin_user_get('duser123', 'adomain123', 'aproject')
-        self.mock_admin_client.users.update(user='duser123', enabled=False
-                                            ).AndReturn(None)
-        self.m.ReplayAll()
-
+        self._stubs_get_user('duser123', 'adomain123', 'aproject')
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         heat_ks_client.disable_stack_domain_user(user_id='duser123',
                                                  project_id='aproject')
+        self._validate_stub_domain_admin_client()
+        self.mock_ks_v3_client.users.get.assert_called_once_with('duser123')
+        self.mock_ks_v3_client.users.update.assert_called_once_with(
+            user='duser123', enabled=False)
 
     def test_disable_stack_domain_user_legacy_fallback(self):
         """Test enabling a stack domain user, fallback path."""
@@ -868,14 +875,12 @@ class KeystoneClientTest(common.HeatTestCase):
 
         # mock keystone client functions
         self._stubs_auth()
-        self.mock_ks_v3_client.users = self.m.CreateMockAnything()
-        self.mock_ks_v3_client.users.update(user='user123', enabled=False
-                                            ).AndReturn(None)
-        self.m.ReplayAll()
-
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         heat_ks_client.disable_stack_domain_user(user_id='user123',
                                                  project_id='aproject')
+        self.mock_ks_v3_client.users.update.assert_called_once_with(
+            user='user123', enabled=False)
+        self._validate_stub_auth()
 
     def test_disable_stack_domain_user_error_project(self):
         """Test disabling a stack domain user, wrong project."""
@@ -886,12 +891,13 @@ class KeystoneClientTest(common.HeatTestCase):
 
         # mock keystone client functions
         self._stub_domain_admin_client()
-        self._stub_admin_user_get('duser123', 'adomain123', 'notaproject')
-        self.m.ReplayAll()
+        self._stubs_get_user('duser123', 'adomain123', 'notaproject')
 
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         self.assertRaises(ValueError, heat_ks_client.disable_stack_domain_user,
                           user_id='duser123', project_id='aproject')
+        self._validate_stub_domain_admin_client()
+        self.mock_ks_v3_client.users.get.assert_called_once_with('duser123')
 
     def test_disable_stack_domain_user_error_domain(self):
         """Test disabling a stack domain user, wrong domain."""
@@ -902,12 +908,13 @@ class KeystoneClientTest(common.HeatTestCase):
 
         # mock keystone client functions
         self._stub_domain_admin_client()
-        self._stub_admin_user_get('duser123', 'notadomain123', 'aproject')
-        self.m.ReplayAll()
+        self._stubs_get_user('duser123', 'notadomain123', 'aproject')
 
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         self.assertRaises(ValueError, heat_ks_client.disable_stack_domain_user,
                           user_id='duser123', project_id='aproject')
+        self._validate_stub_domain_admin_client()
+        self.mock_ks_v3_client.users.get.assert_called_once_with('duser123')
 
     def test_delete_stack_domain_user_keypair(self):
         ctx = utils.dummy_context()
@@ -916,15 +923,10 @@ class KeystoneClientTest(common.HeatTestCase):
 
         # mock keystone client functions
         self._stub_domain_admin_client()
-        user = self._stub_admin_user_get('duser123', 'adomain123', 'aproject')
-        self.mock_admin_client.credentials = self.m.CreateMockAnything()
-        self.mock_admin_client.credentials.delete(
-            'acredentialid').AndReturn(None)
+        self._stubs_get_user('duser123', 'adomain123', 'aproject')
 
-        self.mock_admin_client.users.get('duser123').AndReturn(user)
-        self.mock_admin_client.credentials.delete(
-            'acredentialid').AndRaise(kc_exception.NotFound)
-        self.m.ReplayAll()
+        exc = kc_exception.NotFound
+        self.mock_ks_v3_client.credentials.delete.side_effect = [None, exc]
 
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         heat_ks_client.delete_stack_domain_user_keypair(
@@ -934,6 +936,10 @@ class KeystoneClientTest(common.HeatTestCase):
         heat_ks_client.delete_stack_domain_user_keypair(
             user_id='duser123', project_id='aproject',
             credential_id='acredentialid')
+        self._validate_stub_domain_admin_client()
+        self.mock_ks_v3_client.users.get.assert_called_with('duser123')
+        self.mock_ks_v3_client.credentials.delete.assert_called_with(
+            'acredentialid')
 
     def test_delete_stack_domain_user_keypair_legacy_fallback(self):
         self._clear_domain_override()
@@ -943,15 +949,14 @@ class KeystoneClientTest(common.HeatTestCase):
 
         # mock keystone client functions
         self._stubs_auth()
-        self.mock_ks_v3_client.credentials = self.m.CreateMockAnything()
-        self.mock_ks_v3_client.credentials.delete(
-            'acredentialid').AndReturn(None)
-        self.m.ReplayAll()
 
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         heat_ks_client.delete_stack_domain_user_keypair(
             user_id='user123', project_id='aproject',
             credential_id='acredentialid')
+        self.mock_ks_v3_client.credentials.delete.assert_called_once_with(
+            'acredentialid')
+        self._validate_stub_auth()
 
     def test_delete_stack_domain_user_keypair_error_project(self):
         ctx = utils.dummy_context()
@@ -960,14 +965,15 @@ class KeystoneClientTest(common.HeatTestCase):
 
         # mock keystone client functions
         self._stub_domain_admin_client()
-        self._stub_admin_user_get('duser123', 'adomain123', 'notaproject')
-        self.m.ReplayAll()
+        self._stubs_get_user('duser123', 'adomain123', 'notaproject')
 
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         self.assertRaises(ValueError,
                           heat_ks_client.delete_stack_domain_user_keypair,
                           user_id='duser123', project_id='aproject',
                           credential_id='acredentialid')
+        self._validate_stub_domain_admin_client()
+        self.mock_ks_v3_client.users.get.assert_called_once_with('duser123')
 
     def test_delete_stack_domain_user_keypair_error_domain(self):
         ctx = utils.dummy_context()
@@ -976,14 +982,15 @@ class KeystoneClientTest(common.HeatTestCase):
 
         # mock keystone client functions
         self._stub_domain_admin_client()
-        self._stub_admin_user_get('duser123', 'notadomain123', 'aproject')
-        self.m.ReplayAll()
+        self._stubs_get_user('duser123', 'notadomain123', 'aproject')
 
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         self.assertRaises(ValueError,
                           heat_ks_client.delete_stack_domain_user_keypair,
                           user_id='duser123', project_id='aproject',
                           credential_id='acredentialid')
+        self._validate_stub_domain_admin_client()
+        self.mock_ks_v3_client.users.get.assert_called_once_with('duser123')
 
     def _stub_gen_creds(self, access, secret):
         # stub UUID.hex to return the values specified
@@ -1010,23 +1017,23 @@ class KeystoneClientTest(common.HeatTestCase):
         self._stub_gen_creds('dummy_access', 'dummy_secret')
 
         # mock keystone client credentials functions
-        self.mock_ks_v3_client.credentials = self.m.CreateMockAnything()
-        mock_credential = self.m.CreateMockAnything()
-        mock_credential.id = '123456'
-        mock_credential.user_id = 'atestuser'
-        mock_credential.blob = ex_data_json
-        mock_credential.type = 'ec2'
+        mock_cred = mock.Mock()
+        mock_cred.id = '123456'
+        mock_cred.user_id = 'atestuser'
+        mock_cred.blob = ex_data_json
+        mock_cred.type = 'ec2'
 
         # mock keystone client create function
-        self.mock_ks_v3_client.credentials.create(
-            user='atestuser', type='ec2', blob=ex_data_json,
-            project=ctx.tenant_id).AndReturn(mock_credential)
-        self.m.ReplayAll()
+        self.mock_ks_v3_client.credentials.create.return_value = mock_cred
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         ec2_cred = heat_ks_client.create_ec2_keypair(user_id='atestuser')
         self.assertEqual('123456', ec2_cred.id)
         self.assertEqual('dummy_access', ec2_cred.access)
         self.assertEqual('dummy_secret', ec2_cred.secret)
+        self.mock_ks_v3_client.credentials.create.assert_called_once_with(
+            user='atestuser', type='ec2', blob=ex_data_json,
+            project=ctx.tenant_id)
+        self._validate_stub_auth()
 
     def test_create_stack_domain_user_keypair(self):
 
@@ -1046,24 +1053,24 @@ class KeystoneClientTest(common.HeatTestCase):
         self._stub_gen_creds('dummy_access2', 'dummy_secret2')
 
         # mock keystone client credentials functions
-        self.mock_admin_client.credentials = self.m.CreateMockAnything()
-        mock_credential = self.m.CreateMockAnything()
-        mock_credential.id = '1234567'
-        mock_credential.user_id = 'atestuser2'
-        mock_credential.blob = ex_data_json
-        mock_credential.type = 'ec2'
+        mock_cred = mock.Mock()
+        mock_cred.id = '1234567'
+        mock_cred.user_id = 'atestuser2'
+        mock_cred.blob = ex_data_json
+        mock_cred.type = 'ec2'
 
         # mock keystone client create function
-        self.mock_admin_client.credentials.create(
-            user='atestuser2', type='ec2', blob=ex_data_json,
-            project='aproject').AndReturn(mock_credential)
-        self.m.ReplayAll()
+        self.mock_ks_v3_client.credentials.create.return_value = mock_cred
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         ec2_cred = heat_ks_client.create_stack_domain_user_keypair(
             user_id='atestuser2', project_id='aproject')
         self.assertEqual('1234567', ec2_cred.id)
         self.assertEqual('dummy_access2', ec2_cred.access)
         self.assertEqual('dummy_secret2', ec2_cred.secret)
+        self._validate_stub_domain_admin_client()
+        self.mock_ks_v3_client.credentials.create.assert_called_once_with(
+            user='atestuser2', type='ec2', blob=ex_data_json,
+            project='aproject')
 
     def test_create_stack_domain_user_keypair_legacy_fallback(self):
 
@@ -1083,24 +1090,24 @@ class KeystoneClientTest(common.HeatTestCase):
         self._stub_gen_creds('dummy_access2', 'dummy_secret2')
 
         # mock keystone client credentials functions
-        self.mock_ks_v3_client.credentials = self.m.CreateMockAnything()
-        mock_credential = self.m.CreateMockAnything()
-        mock_credential.id = '1234567'
-        mock_credential.user_id = 'atestuser2'
-        mock_credential.blob = ex_data_json
-        mock_credential.type = 'ec2'
+        mock_cred = mock.Mock()
+        mock_cred.id = '1234567'
+        mock_cred.user_id = 'atestuser2'
+        mock_cred.blob = ex_data_json
+        mock_cred.type = 'ec2'
 
         # mock keystone client create function
-        self.mock_ks_v3_client.credentials.create(
-            user='atestuser2', type='ec2', blob=ex_data_json,
-            project=ctx.tenant_id).AndReturn(mock_credential)
-        self.m.ReplayAll()
+        self.mock_ks_v3_client.credentials.create.return_value = mock_cred
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         ec2_cred = heat_ks_client.create_stack_domain_user_keypair(
             user_id='atestuser2', project_id='aproject')
         self.assertEqual('1234567', ec2_cred.id)
         self.assertEqual('dummy_access2', ec2_cred.access)
         self.assertEqual('dummy_secret2', ec2_cred.secret)
+        self.mock_ks_v3_client.credentials.create.assert_called_once_with(
+            user='atestuser2', type='ec2', blob=ex_data_json,
+            project=ctx.tenant_id)
+        self._validate_stub_auth()
 
     def test_get_ec2_keypair_id(self):
 
@@ -1118,39 +1125,37 @@ class KeystoneClientTest(common.HeatTestCase):
 
         # Create a mock credential response
         credential_id = 'acredential123'
-        mock_credential = self.m.CreateMockAnything()
-        mock_credential.id = credential_id
-        mock_credential.user_id = user_id
-        mock_credential.blob = ex_data_json
-        mock_credential.type = 'ec2'
+        mock_cred = mock.Mock()
+        mock_cred.id = credential_id
+        mock_cred.user_id = user_id
+        mock_cred.blob = ex_data_json
+        mock_cred.type = 'ec2'
 
         # mock keystone client get function
-        self.mock_ks_v3_client.credentials = self.m.CreateMockAnything()
-        self.mock_ks_v3_client.credentials.get(
-            credential_id).AndReturn(mock_credential)
-        self.m.ReplayAll()
+        self.mock_ks_v3_client.credentials.get.return_value = mock_cred
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         ec2_cred = heat_ks_client.get_ec2_keypair(credential_id=credential_id)
         self.assertEqual(credential_id, ec2_cred.id)
         self.assertEqual('access123', ec2_cred.access)
         self.assertEqual('secret456', ec2_cred.secret)
+        self.mock_ks_v3_client.credentials.get.assert_called_once_with(
+            credential_id)
+        self._validate_stub_auth()
 
     def _mock_credential_list(self, user_id):
         """Create a mock credential list response."""
-        mock_credential_list = []
+        mock_cred_list = []
         for x in (1, 2, 3):
-            mock_credential = self.m.CreateMockAnything()
+            mock_credential = mock.Mock()
             mock_credential.id = 'credential_id%s' % x
             mock_credential.user_id = user_id
             mock_credential.blob = json.dumps({'access': 'access%s' % x,
                                                'secret': 'secret%s' % x})
             mock_credential.type = 'ec2'
-            mock_credential_list.append(mock_credential)
+            mock_cred_list.append(mock_credential)
 
         # mock keystone client list function
-        self.mock_ks_v3_client.credentials = self.m.CreateMockAnything()
-        self.mock_ks_v3_client.credentials.list().AndReturn(
-            mock_credential_list)
+        self.mock_ks_v3_client.credentials.list.return_value = mock_cred_list
 
     def test_get_ec2_keypair_access(self):
 
@@ -1163,12 +1168,12 @@ class KeystoneClientTest(common.HeatTestCase):
         ctx.trust_id = None
 
         self._mock_credential_list(user_id=user_id)
-        self.m.ReplayAll()
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         ec2_cred = heat_ks_client.get_ec2_keypair(access='access2')
         self.assertEqual('credential_id2', ec2_cred.id)
         self.assertEqual('access2', ec2_cred.access)
         self.assertEqual('secret2', ec2_cred.secret)
+        self._validate_stub_auth()
 
     def test_get_ec2_keypair_error(self):
 
@@ -1191,22 +1196,20 @@ class KeystoneClientTest(common.HeatTestCase):
         ctx = utils.dummy_context()
         ctx.trust_id = None
 
-        # mock keystone client credentials functions
         credential_id = 'acredential123'
-        self.mock_ks_v3_client.credentials = self.m.CreateMockAnything()
 
         # mock keystone client delete function
-        self.mock_ks_v3_client.credentials = self.m.CreateMockAnything()
-        self.mock_ks_v3_client.credentials.delete(credential_id)
-        self.mock_ks_v3_client.credentials.delete(credential_id).AndRaise(
-            kc_exception.NotFound)
-        self.m.ReplayAll()
+        exc = kc_exception.NotFound
+        self.mock_ks_v3_client.credentials.delete.side_effect = exc
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         self.assertIsNone(heat_ks_client.delete_ec2_keypair(
                           credential_id=credential_id))
         # Second delete will raise ignored NotFound
         self.assertIsNone(heat_ks_client.delete_ec2_keypair(
                           credential_id=credential_id))
+        self.mock_ks_v3_client.credentials.delete.assert_called_with(
+            credential_id)
+        self._validate_stub_auth()
 
     def test_delete_ec2_keypair_access(self):
 
@@ -1220,12 +1223,11 @@ class KeystoneClientTest(common.HeatTestCase):
 
         self._mock_credential_list(user_id=user_id)
 
-        # mock keystone client delete function
-        self.mock_ks_v3_client.credentials.delete(
-            'credential_id2').AndReturn(None)
-        self.m.ReplayAll()
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         self.assertIsNone(heat_ks_client.delete_ec2_keypair(access='access2'))
+        self.mock_ks_v3_client.credentials.delete.assert_called_once_with(
+            'credential_id2')
+        self._validate_stub_auth()
 
     def test_deleting_ec2_keypair_error(self):
 
@@ -1235,7 +1237,6 @@ class KeystoneClientTest(common.HeatTestCase):
         self.patchobject(ctx, '_create_auth_plugin')
         ctx.trust_id = None
 
-        self.m.ReplayAll()
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         self.assertRaises(ValueError, heat_ks_client.delete_ec2_keypair)
 
@@ -1249,18 +1250,18 @@ class KeystoneClientTest(common.HeatTestCase):
         expected_name = '%s-astack' % ctx.tenant_id
 
         self._stub_domain_admin_client()
-        self.mock_admin_client.projects = self.m.CreateMockAnything()
-        dummy = self.m.CreateMockAnything()
+        dummy = mock.Mock()
         dummy.id = 'aproject123'
-        self.mock_admin_client.projects.create(
-            name=expected_name,
-            domain='adomain123',
-            description='Heat stack user project').AndReturn(dummy)
-        self.m.ReplayAll()
+        self.mock_ks_v3_client.projects.create.return_value = dummy
 
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         self.assertEqual('aproject123',
                          heat_ks_client.create_stack_domain_project('astack'))
+        self._validate_stub_domain_admin_client()
+        self.mock_ks_v3_client.projects.create.assert_called_once_with(
+            name=expected_name,
+            domain='adomain123',
+            description='Heat stack user project')
 
     def test_create_stack_domain_project_legacy_fallback(self):
         """Test the create_stack_domain_project function, fallback path."""
@@ -1278,71 +1279,71 @@ class KeystoneClientTest(common.HeatTestCase):
         """Test the delete_stack_domain_project function."""
 
         self._stub_domain_admin_client()
-        self.mock_admin_client.projects = self.m.CreateMockAnything()
-        dummy = self.m.CreateMockAnything()
+        dummy = mock.Mock()
         dummy.id = 'aproject123'
         dummy.domain_id = 'adomain123'
-        dummy.delete().AndReturn(None)
-        self.mock_admin_client.projects.get(project='aprojectid').AndReturn(
-            dummy)
-        self.m.ReplayAll()
+        self.mock_ks_v3_client.projects.get.return_value = dummy
 
         ctx = utils.dummy_context()
         self.patchobject(ctx, '_create_auth_plugin')
         ctx.trust_id = None
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         heat_ks_client.delete_stack_domain_project(project_id='aprojectid')
+        self._validate_stub_domain_admin_client()
+        self.mock_ks_v3_client.projects.get.assert_called_once_with(
+            project='aprojectid')
 
     def test_delete_stack_domain_project_notfound(self):
 
         """Test the delete_stack_domain_project function."""
 
         self._stub_domain_admin_client(domain_id=None)
-        self.mock_admin_client.projects = self.m.CreateMockAnything()
-        self.mock_admin_client.projects.get(project='aprojectid').AndRaise(
-            kc_exception.NotFound)
-        self.m.ReplayAll()
+        self.mock_ks_v3_client.projects.get.side_effect = kc_exception.NotFound
 
         ctx = utils.dummy_context()
         self.patchobject(ctx, '_create_auth_plugin')
         ctx.trust_id = None
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         heat_ks_client.delete_stack_domain_project(project_id='aprojectid')
+        self._validate_stub_domain_admin_client()
+        self.mock_ks_v3_client.projects.get.assert_called_once_with(
+            project='aprojectid')
 
     def test_delete_stack_domain_project_forbidden(self):
 
         """Test the delete_stack_domain_project function."""
 
         self._stub_domain_admin_client(domain_id=None)
-        self.mock_admin_client.projects = self.m.CreateMockAnything()
-        self.mock_admin_client.projects.get(project='aprojectid').AndRaise(
-            kc_exception.Forbidden)
-        self.m.ReplayAll()
+        exc = kc_exception.Forbidden
+        self.mock_ks_v3_client.projects.get.side_effect = exc
 
         ctx = utils.dummy_context()
         self.patchobject(ctx, '_create_auth_plugin')
         ctx.trust_id = None
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         heat_ks_client.delete_stack_domain_project(project_id='aprojectid')
+        self._validate_stub_domain_admin_client()
+        self.mock_ks_v3_client.projects.get.assert_called_once_with(
+            project='aprojectid')
 
     def test_delete_stack_domain_project_wrongdomain(self):
 
         """Test the delete_stack_domain_project function."""
 
         self._stub_domain_admin_client()
-        self.mock_admin_client.projects = self.m.CreateMockAnything()
-        dummy = self.m.CreateMockAnything()
+        dummy = mock.Mock()
         dummy.id = 'aproject123'
         dummy.domain_id = 'default'
-        self.mock_admin_client.projects.get(project='aprojectid').AndReturn(
-            dummy)
-        self.m.ReplayAll()
+        self.mock_ks_v3_client.projects.get.return_value = dummy
 
         ctx = utils.dummy_context()
         self.patchobject(ctx, '_create_auth_plugin')
         ctx.trust_id = None
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         heat_ks_client.delete_stack_domain_project(project_id='aprojectid')
+        self._validate_stub_domain_admin_client()
+        self.mock_ks_v3_client.projects.get.assert_called_once_with(
+            project='aprojectid')
 
     def test_delete_stack_domain_project_nodomain(self):
 
@@ -1356,27 +1357,14 @@ class KeystoneClientTest(common.HeatTestCase):
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
         heat_ks_client.delete_stack_domain_project(project_id='aprojectid')
 
-    def _stub_domain_user_pw_auth(self):
-        ks_auth.Password(auth_url='http://server.test:5000/v3',
-                         user_id='duser',
-                         password='apassw',
-                         project_id='aproject',
-                         user_domain_id='adomain123').AndReturn('dummyauth')
-
     def test_stack_domain_user_token(self):
         """Test stack_domain_user_token function."""
         dum_tok = 'dummytoken'
         ctx = utils.dummy_context()
-        mock_ks_auth = self.m.CreateMockAnything()
-        mock_ks_auth.get_token(mox.IsA(ks_session.Session)).AndReturn(dum_tok)
+        mock_ks_auth = mock.Mock()
+        mock_ks_auth.get_token.return_value = dum_tok
         self.patchobject(ctx, '_create_auth_plugin')
-        m = ks_auth.Password(auth_url='http://server.test:5000/v3',
-                             password='apassw',
-                             project_id='aproject',
-                             user_id='duser')
-        m.AndReturn(mock_ks_auth)
-
-        self.m.ReplayAll()
+        ks_auth.Password.return_value = mock_ks_auth
 
         ctx.trust_id = None
         heat_ks_client = heat_keystoneclient.KeystoneClient(ctx)
@@ -1384,6 +1372,13 @@ class KeystoneClientTest(common.HeatTestCase):
                                                        project_id='aproject',
                                                        password='apassw')
         self.assertEqual(dum_tok, token)
+        ks_auth.Password.assert_called_once_with(
+            auth_url='http://server.test:5000/v3',
+            password='apassw',
+            project_id='aproject',
+            user_id='duser')
+        mock_ks_auth.get_token.assert_called_once_with(
+            utils.AnyInstance(ks_session.Session))
 
     def test_stack_domain_user_token_err_nodomain(self):
         """Test stack_domain_user_token error path."""
@@ -1420,46 +1415,26 @@ class KeystoneClientTestDomainName(KeystoneClientTest):
     def _clear_domain_override(self):
         cfg.CONF.clear_override('stack_user_domain_name')
 
-    def _stub_domain_admin_client_domain_get(self):
-        dummy_domain = self.m.CreateMockAnything()
-        dummy_domain.id = 'adomain123'
-        self.mock_ks_v3_client_domain_mngr.list(
-            name='fake_domain_name').AndReturn([dummy_domain])
+    def _validate_stub_domain_admin_client(self):
+        ks_auth.Password.assert_called_once_with(
+            auth_url='http://server.test:5000/v3',
+            password='adminsecret',
+            domain_id=None,
+            domain_name='fake_domain_name',
+            user_domain_id=None,
+            user_domain_name='fake_domain_name',
+            username='adminuser123')
+
+        self.m_client.assert_called_once_with(
+            session=utils.AnyInstance(ks_session.Session),
+            auth=self.mock_ks_auth,
+            region_name=None)
 
     def _stub_domain_admin_client(self, domain_id='adomain123'):
-        mock_ks_auth = self.m.CreateMockAnything()
-        mock_ks_auth.get_token(mox.IsA(ks_session.Session)).AndReturn('tok')
+        super(KeystoneClientTestDomainName, self)._stub_domain_admin_client()
 
         if domain_id:
-            a = self.m.CreateMockAnything()
-            a.domain_id = domain_id
-            mock_ks_auth.get_access(
-                mox.IsA(ks_session.Session)).AndReturn(a)
-
-        m = ks_auth.Password(auth_url='http://server.test:5000/v3',
-                             password='adminsecret',
-                             domain_id=None,
-                             domain_name='fake_domain_name',
-                             user_domain_id=None,
-                             user_domain_name='fake_domain_name',
-                             username='adminuser123')
-
-        m.AndReturn(mock_ks_auth)
-
-        n = kc_v3.Client(session=mox.IsA(ks_session.Session),
-                         auth=mock_ks_auth,
-                         region_name=None)
-        n.AndReturn(self.mock_admin_client)
-
-        self.mock_admin_client.domains = self.mock_ks_v3_client_domain_mngr
-
-    def _stub_domain_user_pw_auth(self):
-        ks_auth.Password(auth_url='http://server.test:5000/v3',
-                         user_id='duser',
-                         password='apassw',
-                         project_id='aproject',
-                         user_domain_name='fake_domain_name'
-                         ).AndReturn('dummyauth')
+            self.mock_ks_auth.get_access.return_value.domain_id = domain_id
 
     def test_enable_stack_domain_user_error_project(self):
         p = super(KeystoneClientTestDomainName, self)