Revert "Remove validate_auth_ksc"1.24.0

This reverts commit 1f9e2cd123b38a7e744fb8a784d0ee3b523de95e.

Sad as this makes me, let's revert and come back to it when we figure
out the cliff thing.

Change-Id: I0413d5e3b3d8652833a8e7942ba81926787ba3bf

4 files changed, 76 insertions, 45 deletions

diff --git a/os_client_config/config.py b/os_client_config/config.py
index 22bd00c..9b4a709 100644
--- a/os_client_config/config.py
+++ b/os_client_config/config.py
@@ -609,19 +609,15 @@ class OpenStackConfig(object):
                 'tenant_id', 'tenant-id', 'project_id', 'project-id')
             mappings['project_name'] = (
                 'tenant_name', 'tenant-name', 'project_name', 'project-name')
-        # Special-case username and password so that we don't have to load
-        # the plugins so early
-        mappings['username'] = ('user-name', 'user_name', 'username')
-        mappings['password'] = ('password',)
         for target_key, possible_values in mappings.items():
             target = None
             for key in possible_values:
-                root_target = cloud.pop(key, None)
-                auth_target = cloud['auth'].pop(key, None)
-                if root_target:
-                    target = str(root_target)
-                elif auth_target:
-                    target = str(auth_target)
+                if key in cloud:
+                    target = str(cloud[key])
+                    del cloud[key]
+                if key in cloud['auth']:
+                    target = str(cloud['auth'][key])
+                    del cloud['auth'][key]
             if target:
                 cloud['auth'][target_key] = target
         return cloud
@@ -865,6 +861,59 @@ class OpenStackConfig(object):
             config['auth_type'] = 'admin_token'
         return loading.get_plugin_loader(config['auth_type'])
 
+    def _validate_auth_ksc(self, config, cloud):
+        try:
+            import keystoneclient.auth as ksc_auth
+        except ImportError:
+            return config
+
+        # May throw a keystoneclient.exceptions.NoMatchingPlugin
+        plugin_options = ksc_auth.get_plugin_class(
+            config['auth_type']).get_options()
+
+        for p_opt in plugin_options:
+            # if it's in config.auth, win, kill it from config dict
+            # if it's in config and not in config.auth, move it
+            # deprecated loses to current
+            # provided beats default, deprecated or not
+            winning_value = self._find_winning_auth_value(
+                p_opt,
+                config['auth'],
+            )
+            if not winning_value:
+                winning_value = self._find_winning_auth_value(
+                    p_opt,
+                    config,
+                )
+
+            # if the plugin tells us that this value is required
+            # then error if it's doesn't exist now
+            if not winning_value and p_opt.required:
+                raise exceptions.OpenStackConfigException(
+                    'Unable to find auth information for cloud'
+                    ' {cloud} in config files {files}'
+                    ' or environment variables. Missing value {auth_key}'
+                    ' required for auth plugin {plugin}'.format(
+                        cloud=cloud, files=','.join(self._config_files),
+                        auth_key=p_opt.name, plugin=config.get('auth_type')))
+
+            # Clean up after ourselves
+            for opt in [p_opt.name] + [o.name for o in p_opt.deprecated_opts]:
+                opt = opt.replace('-', '_')
+                config.pop(opt, None)
+                config['auth'].pop(opt, None)
+
+            if winning_value:
+                # Prefer the plugin configuration dest value if the value's key
+                # is marked as depreciated.
+                if p_opt.dest is None:
+                    config['auth'][p_opt.name.replace('-', '_')] = (
+                        winning_value)
+                else:
+                    config['auth'][p_opt.dest] = winning_value
+
+        return config
+
     def _validate_auth(self, config, loader):
         # May throw a keystoneauth1.exceptions.NoMatchingPlugin
 
@@ -972,7 +1021,6 @@ class OpenStackConfig(object):
                 ('auth_token' in config and config['auth_token']) or
                 ('token' in config and config['token'])):
             config.setdefault('token', config.pop('auth_token', None))
-            config.setdefault('auth_type', 'token')
 
         # These backwards compat values are only set via argparse. If it's
         # there, it's because it was passed in explicitly, and should win
@@ -1019,6 +1067,7 @@ class OpenStackConfig(object):
         :raises: keystoneauth1.exceptions.MissingRequiredOptions
             on missing required auth parameters
         """
+
         args = self._fix_args(kwargs, argparse=argparse)
 
         if cloud is None:
diff --git a/os_client_config/tests/test_config.py b/os_client_config/tests/test_config.py
index efab797..ad3685a 100644
--- a/os_client_config/tests/test_config.py
+++ b/os_client_config/tests/test_config.py
@@ -226,7 +226,7 @@ class TestConfig(base.TestCase):
         c = config.OpenStackConfig(config_files=['nonexistent'],
                                    vendor_files=['nonexistent'],
                                    secure_files=[self.secure_yaml])
-        cc = c.get_one_cloud(cloud='_test_cloud_no_vendor', validate=False)
+        cc = c.get_one_cloud(cloud='_test_cloud_no_vendor')
         self.assertEqual('testpass', cc.auth['password'])
 
     def test_get_cloud_names(self):
@@ -366,6 +366,7 @@ class TestConfigArgparse(base.TestCase):
             project_name='project',
             region_name='region2',
             snack_type='cookie',
+            os_auth_token='no-good-things',
         )
 
         self.options = argparse.Namespace(**self.args)
@@ -416,7 +417,7 @@ class TestConfigArgparse(base.TestCase):
         cc = c.get_one_cloud(
             argparse=options, **kwargs)
         self.assertEqual(cc.region_name, 'region2')
-        self.assertEqual(cc.auth['password'], 'argpass')
+        self.assertEqual(cc.auth['password'], 'authpass')
         self.assertEqual(cc.snack_type, 'cookie')
 
     def test_get_one_cloud_precedence_osc(self):
@@ -473,7 +474,7 @@ class TestConfigArgparse(base.TestCase):
 
         cc = c.get_one_cloud(**kwargs)
         self.assertEqual(cc.region_name, 'kwarg_region')
-        self.assertEqual(cc.auth['password'], 'ansible_password')
+        self.assertEqual(cc.auth['password'], 'authpass')
         self.assertIsNone(cc.password)
 
     def test_get_one_cloud_just_argparse(self):
@@ -648,30 +649,11 @@ class TestConfigArgparse(base.TestCase):
         parser.add_argument('--os-auth-token')
         opts, _remain = parser.parse_known_args(
             ['--os-auth-token', 'very-bad-things',
-             '--os-auth-type', 'token',
-             '--os-auth-url', 'http://example.com/v2',
-             '--os-project-name', 'project'])
+             '--os-auth-type', 'token'])
         cc = c.get_one_cloud(argparse=opts)
         self.assertEqual(cc.config['auth_type'], 'token')
         self.assertEqual(cc.config['auth']['token'], 'very-bad-things')
 
-    def test_argparse_username_token(self):
-        c = config.OpenStackConfig(config_files=[self.cloud_yaml],
-                                   vendor_files=[self.vendor_yaml])
-
-        parser = argparse.ArgumentParser()
-        c.register_argparse_arguments(parser, [])
-        # novaclient will add this
-        parser.add_argument('--os-auth-token')
-        opts, _remain = parser.parse_known_args(
-            ['--os-auth-token', 'very-bad-things',
-             '--os-auth-type', 'token',
-             '--os-auth-url', 'http://example.com/v2',
-             '--os-username', 'user',
-             '--os-project-name', 'project'])
-        self.assertRaises(
-            TypeError, c.get_one_cloud, argparse=opts)
-
     def test_argparse_underscores(self):
         c = config.OpenStackConfig(config_files=[self.no_yaml],
                                    vendor_files=[self.no_yaml],
diff --git a/os_client_config/tests/test_environ.py b/os_client_config/tests/test_environ.py
index 9cece48..35ce2f2 100644
--- a/os_client_config/tests/test_environ.py
+++ b/os_client_config/tests/test_environ.py
@@ -19,7 +19,6 @@ from os_client_config import exceptions
 from os_client_config.tests import base
 
 import fixtures
-import keystoneauth1.exceptions
 
 
 class TestEnviron(base.TestCase):
@@ -145,11 +144,13 @@ class TestEnvvars(base.TestCase):
             fixtures.EnvironmentVariable('NOVA_USERNAME', 'nova'))
         self.useFixture(
             fixtures.EnvironmentVariable('OS_USERNAME', 'user'))
-        c = config.OpenStackConfig(
-            config_files=[self.cloud_yaml], vendor_files=[self.vendor_yaml])
-        self.assertRaises(
-            keystoneauth1.exceptions.auth_plugins.MissingRequiredOptions,
-            c.get_one_cloud, 'envvars')
+        config.OpenStackConfig(config_files=[self.cloud_yaml],
+                               vendor_files=[self.vendor_yaml])
+        # This is broken due to an issue that's fixed in a subsequent patch
+        # commenting it out in this patch to keep the patch size reasonable
+        # self.assertRaises(
+        #     keystoneauth1.exceptions.auth_plugins.MissingRequiredOptions,
+        #     c.get_one_cloud, 'envvars')
 
     def test_have_envvars(self):
         self.useFixture(
@@ -164,7 +165,7 @@ class TestEnvvars(base.TestCase):
             fixtures.EnvironmentVariable('OS_PROJECT_NAME', 'project'))
         c = config.OpenStackConfig(config_files=[self.cloud_yaml],
                                    vendor_files=[self.vendor_yaml])
-        cc = c.get_one_cloud('envvars', validate=False)
+        cc = c.get_one_cloud('envvars')
         self.assertEqual(cc.config['auth']['username'], 'user')
 
     def test_old_envvars(self):
@@ -180,5 +181,5 @@ class TestEnvvars(base.TestCase):
         c = config.OpenStackConfig(config_files=[self.cloud_yaml],
                                    vendor_files=[self.vendor_yaml],
                                    envvar_prefix='NOVA_')
-        cc = c.get_one_cloud('envvars', validate=False)
+        cc = c.get_one_cloud('envvars')
         self.assertEqual(cc.config['auth']['username'], 'nova')
diff --git a/os_client_config/tests/test_init.py b/os_client_config/tests/test_init.py
index 76ad485..15d57f7 100644
--- a/os_client_config/tests/test_init.py
+++ b/os_client_config/tests/test_init.py
@@ -18,8 +18,7 @@ from os_client_config.tests import base
 
 class TestInit(base.TestCase):
     def test_get_config_without_arg_parser(self):
-        cloud_config = os_client_config.get_config(
-            options=None, validate=False)
+        cloud_config = os_client_config.get_config(options=None)
         self.assertIsInstance(
             cloud_config,
             os_client_config.cloud_config.CloudConfig
@@ -27,7 +26,7 @@ class TestInit(base.TestCase):
 
     def test_get_config_with_arg_parser(self):
         cloud_config = os_client_config.get_config(
-            options=argparse.ArgumentParser(), validate=False)
+            options=argparse.ArgumentParser())
         self.assertIsInstance(
             cloud_config,
             os_client_config.cloud_config.CloudConfig