add functional tests for identity v3

To make test cases more clearly, split test_identity.py
into test_user.py, test_role, etc. Add more test cases for
user, role, etc. Furthermore, to make functional tests run
repeatedly without raising duplicated error, clean up
resources before exiting each test case.

Change-Id: I1541943ad0b8d4d8d1e72822c159fda243b3d1d7
Implements: blueprint identity-functional-tests

9 files changed, 784 insertions, 60 deletions

diff --git a/functional/common/test.py b/functional/common/test.py
index ef034276..50d59fd1 100644
--- a/functional/common/test.py
+++ b/functional/common/test.py
@@ -89,6 +89,26 @@ class TestCase(testtools.TestCase):
             for key in six.iterkeys(item):
                 self.assertIn(key, field_names)
 
+    def assert_show_structure(self, items, field_names):
+        """Verify that all field_names listed in keys of all items."""
+        if isinstance(items, list):
+            o = {}
+            for d in items:
+                o.update(d)
+        else:
+            o = items
+        item_keys = o.keys()
+        for field in field_names:
+            self.assertIn(field, item_keys)
+
+    def parse_show_as_object(self, raw_output):
+        """Return a dict with values parsed from cli output."""
+        items = self.parse_show(raw_output)
+        o = {}
+        for item in items:
+            o.update(item)
+        return o
+
     def parse_show(self, raw_output):
         """Return list of dicts with item values parsed from cli output."""
 
diff --git a/functional/tests/identity/v3/test_catalog.py b/functional/tests/identity/v3/test_catalog.py
new file mode 100644
index 00000000..ec4d035b
--- /dev/null
+++ b/functional/tests/identity/v3/test_catalog.py
@@ -0,0 +1,42 @@
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from functional.tests.identity.v3 import test_identity
+
+
+class CatalogTests(test_identity.IdentityTests):
+
+    def test_catalog_list(self):
+        raw_output = self.openstack('catalog list')
+        items = self.parse_listing(raw_output)
+        self.assert_table_structure(items, ['Name', 'Type', 'Endpoints'])
+
+    def test_catalog_show(self):
+        """test catalog show command
+
+        The output example:
+        +-----------+-------------------------------------------+
+        | Field     | Value                                     |
+        +-----------+-------------------------------------------+
+        | endpoints | test1                                     |
+        |           |   publicURL: http://localhost:5000/v2.0   |
+        |           |   internalURL: http://localhost:5000/v2.0 |
+        |           |   adminURL: http://localhost:5000/v2.0    |
+        |           |                                           |
+        | name      | keystone                                  |
+        | type      | identity                                  |
+        +-----------+-------------------------------------------+
+        """
+        raw_output = self.openstack('catalog show %s' % 'identity')
+        items = self.parse_show(raw_output)
+        # items may have multiple endpoint urls with empty key
+        self.assert_show_fields(items, ['endpoints', 'name', 'type', '', 'id'])
diff --git a/functional/tests/identity/v3/test_domain.py b/functional/tests/identity/v3/test_domain.py
new file mode 100644
index 00000000..f3ae4e89
--- /dev/null
+++ b/functional/tests/identity/v3/test_domain.py
@@ -0,0 +1,57 @@
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from tempest_lib.common.utils import data_utils
+
+from functional.common import exceptions
+from functional.tests.identity.v3 import test_identity
+
+
+class DomainTests(test_identity.IdentityTests):
+
+    def test_domain_create(self):
+        domain_name = data_utils.rand_name('TestDomain')
+        raw_output = self.openstack('domain create %s' % domain_name)
+        items = self.parse_show(raw_output)
+        self.assert_show_fields(items, self.DOMAIN_FIELDS)
+        # disable domain first before deleting it
+        self.addCleanup(self.openstack,
+                        'domain delete %s' % domain_name)
+        self.addCleanup(self.openstack,
+                        'domain set --disable %s' % domain_name)
+
+    def test_domain_list(self):
+        self._create_dummy_domain()
+        raw_output = self.openstack('domain list')
+        items = self.parse_listing(raw_output)
+        self.assert_table_structure(items, test_identity.BASIC_LIST_HEADERS)
+
+    def test_domain_delete(self):
+        domain_name = self._create_dummy_domain(add_clean_up=False)
+        # cannot delete enabled domain, disable it first
+        raw_output = self.openstack('domain set --disable %s' % domain_name)
+        self.assertEqual(0, len(raw_output))
+        raw_output = self.openstack('domain delete %s' % domain_name)
+        self.assertEqual(0, len(raw_output))
+
+    def test_domain_delete_failure(self):
+        domain_name = self._create_dummy_domain()
+        # cannot delete enabled domain
+        self.assertRaises(exceptions.CommandFailed,
+                          self.openstack,
+                          'domain delete %s' % domain_name)
+
+    def test_domain_show(self):
+        domain_name = self._create_dummy_domain()
+        raw_output = self.openstack('domain show %s' % domain_name)
+        items = self.parse_show(raw_output)
+        self.assert_show_fields(items, self.DOMAIN_FIELDS)
diff --git a/functional/tests/identity/v3/test_group.py b/functional/tests/identity/v3/test_group.py
new file mode 100644
index 00000000..2d7f8f38
--- /dev/null
+++ b/functional/tests/identity/v3/test_group.py
@@ -0,0 +1,178 @@
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from tempest_lib.common.utils import data_utils
+
+from functional.tests.identity.v3 import test_identity
+
+
+class GroupTests(test_identity.IdentityTests):
+
+    def test_group_create(self):
+        self._create_dummy_group()
+
+    def test_group_list(self):
+        group_name = self._create_dummy_group()
+        raw_output = self.openstack('group list')
+        items = self.parse_listing(raw_output)
+        self.assert_table_structure(items, test_identity.BASIC_LIST_HEADERS)
+        self.assertInOutput(group_name, raw_output)
+
+    def test_group_list_with_domain(self):
+        group_name = self._create_dummy_group()
+        raw_output = self.openstack(
+            'group list --domain %s' % self.domain_name)
+        items = self.parse_listing(raw_output)
+        self.assert_table_structure(items, test_identity.BASIC_LIST_HEADERS)
+        self.assertInOutput(group_name, raw_output)
+
+    def test_group_delete(self):
+        group_name = self._create_dummy_group(add_clean_up=False)
+        raw_output = self.openstack(
+            'group delete '
+            '--domain %(domain)s '
+            '%(name)s' % {'domain': self.domain_name,
+                          'name': group_name})
+        self.assertEqual(0, len(raw_output))
+
+    def test_group_show(self):
+        group_name = self._create_dummy_group()
+        raw_output = self.openstack(
+            'group show '
+            '--domain %(domain)s '
+            '%(name)s' % {'domain': self.domain_name,
+                          'name': group_name})
+        items = self.parse_show(raw_output)
+        self.assert_show_fields(items, self.GROUP_FIELDS)
+
+    def test_group_set(self):
+        group_name = self._create_dummy_group()
+        new_group_name = data_utils.rand_name('NewTestGroup')
+        raw_output = self.openstack(
+            'group set '
+            '--domain %(domain)s '
+            '--name %(new_group)s '
+            '%(group)s' % {'domain': self.domain_name,
+                           'new_group': new_group_name,
+                           'group': group_name})
+        self.assertEqual(0, len(raw_output))
+        raw_output = self.openstack(
+            'group show '
+            '--domain %(domain)s '
+            '%(group)s' % {'domain': self.domain_name,
+                           'group': new_group_name})
+        group = self.parse_show_as_object(raw_output)
+        self.assertEqual(new_group_name, group['name'])
+        # reset group name to make sure it will be cleaned up
+        raw_output = self.openstack(
+            'group set '
+            '--domain %(domain)s '
+            '--name %(new_group)s '
+            '%(group)s' % {'domain': self.domain_name,
+                           'new_group': group_name,
+                           'group': new_group_name})
+        self.assertEqual(0, len(raw_output))
+
+    def test_group_add_user(self):
+        group_name = self._create_dummy_group()
+        username = self._create_dummy_user()
+        raw_output = self.openstack(
+            'group add user '
+            '--group-domain %(group_domain)s '
+            '--user-domain %(user_domain)s '
+            '%(group)s %(user)s' % {'group_domain': self.domain_name,
+                                    'user_domain': self.domain_name,
+                                    'group': group_name,
+                                    'user': username})
+        self.assertOutput(
+            '%(user)s added to group %(group)s\n' % {'user': username,
+                                                     'group': group_name},
+            raw_output
+        )
+        self.addCleanup(
+            self.openstack,
+            'group remove user '
+            '--group-domain %(group_domain)s '
+            '--user-domain %(user_domain)s '
+            '%(group)s %(user)s' % {'group_domain': self.domain_name,
+                                    'user_domain': self.domain_name,
+                                    'group': group_name,
+                                    'user': username})
+
+    def test_group_contains_user(self):
+        group_name = self._create_dummy_group()
+        username = self._create_dummy_user()
+        raw_output = self.openstack(
+            'group add user '
+            '--group-domain %(group_domain)s '
+            '--user-domain %(user_domain)s '
+            '%(group)s %(user)s' % {'group_domain': self.domain_name,
+                                    'user_domain': self.domain_name,
+                                    'group': group_name,
+                                    'user': username})
+        self.assertOutput(
+            '%(user)s added to group %(group)s\n' % {'user': username,
+                                                     'group': group_name},
+            raw_output
+        )
+        raw_output = self.openstack(
+            'group contains user '
+            '--group-domain %(group_domain)s '
+            '--user-domain %(user_domain)s '
+            '%(group)s %(user)s' % {'group_domain': self.domain_name,
+                                    'user_domain': self.domain_name,
+                                    'group': group_name,
+                                    'user':  username})
+        self.assertOutput(
+            '%(user)s in group %(group)s\n' % {'user': username,
+                                               'group': group_name},
+            raw_output)
+        self.addCleanup(
+            self.openstack,
+            'group remove user '
+            '--group-domain %(group_domain)s '
+            '--user-domain %(user_domain)s '
+            '%(group)s %(user)s' % {'group_domain': self.domain_name,
+                                    'user_domain': self.domain_name,
+                                    'group': group_name,
+                                    'user': username})
+
+    def test_group_remove_user(self):
+        group_name = self._create_dummy_group()
+        username = self._create_dummy_user()
+        raw_output = self.openstack(
+            'group add user '
+            '--group-domain %(group_domain)s '
+            '--user-domain %(user_domain)s '
+            '%(group)s %(user)s' % {'group_domain': self.domain_name,
+                                    'user_domain': self.domain_name,
+                                    'group': group_name,
+                                    'user': username})
+        self.assertOutput(
+            '%(user)s added to group %(group)s\n' % {'user': username,
+                                                     'group': group_name},
+            raw_output
+        )
+        raw_output = self.openstack(
+            'group remove user '
+            '--group-domain %(group_domain)s '
+            '--user-domain %(user_domain)s '
+            '%(group)s %(user)s' % {'group_domain': self.domain_name,
+                                    'user_domain': self.domain_name,
+                                    'group': group_name,
+                                    'user': username})
+        self.assertOutput(
+            '%(user)s removed from '
+            'group %(group)s\n' % {'user': username,
+                                   'group': group_name},
+            raw_output
+        )
diff --git a/functional/tests/identity/v3/test_identity.py b/functional/tests/identity/v3/test_identity.py
index 5d28f189..c72dc9a0 100644
--- a/functional/tests/identity/v3/test_identity.py
+++ b/functional/tests/identity/v3/test_identity.py
@@ -11,11 +11,12 @@
 #    under the License.
 
 import os
-import uuid
 
-from functional.common import exceptions
+from tempest_lib.common.utils import data_utils
+
 from functional.common import test
 
+
 BASIC_LIST_HEADERS = ['ID', 'Name']
 
 
@@ -25,19 +26,18 @@ class IdentityTests(test.TestCase):
     DOMAIN_FIELDS = ['description', 'enabled', 'id', 'name', 'links']
     GROUP_FIELDS = ['description', 'domain_id', 'id', 'name', 'links']
     TOKEN_FIELDS = ['expires', 'id', 'project_id', 'user_id']
-
-    def _create_dummy_group(self):
-        name = uuid.uuid4().hex
-        self.openstack('group create ' + name)
-        return name
-
-    def _create_dummy_domain(self):
-        name = uuid.uuid4().hex
-        self.openstack('domain create ' + name)
-        return name
-
-    def setUp(self):
-        super(IdentityTests, self).setUp()
+    USER_FIELDS = ['email', 'enabled', 'id', 'name', 'name',
+                   'domain_id', 'default_project_id', 'description']
+    PROJECT_FIELDS = ['description', 'id', 'domain_id',
+                      'enabled', 'name', 'parent_id', 'links']
+    ROLE_FIELDS = ['id', 'name', 'links']
+
+    @classmethod
+    def setUpClass(cls):
+        if hasattr(super(IdentityTests, cls), 'setUpClass'):
+            super(IdentityTests, cls).setUpClass()
+
+        # prepare v3 env
         auth_url = os.environ.get('OS_AUTH_URL')
         auth_url = auth_url.replace('v2.0', 'v3')
         os.environ['OS_AUTH_URL'] = auth_url
@@ -45,51 +45,132 @@ class IdentityTests(test.TestCase):
         os.environ['OS_USER_DOMAIN_ID'] = 'default'
         os.environ['OS_PROJECT_DOMAIN_ID'] = 'default'
 
-    def test_group_create(self):
-        raw_output = self.openstack('group create ' + uuid.uuid4().hex)
+        # create dummy domain
+        cls.domain_name = data_utils.rand_name('TestDomain')
+        cls.domain_description = data_utils.rand_name('description')
+        cls.openstack(
+            'domain create '
+            '--description %(description)s '
+            '--enable '
+            '%(name)s' % {'description': cls.domain_description,
+                          'name': cls.domain_name})
+
+        # create dummy project
+        cls.project_name = data_utils.rand_name('TestProject')
+        cls.project_description = data_utils.rand_name('description')
+        cls.openstack(
+            'project create '
+            '--domain %(domain)s '
+            '--description %(description)s '
+            '--enable '
+            '%(name)s' % {'domain': cls.domain_name,
+                          'description': cls.project_description,
+                          'name': cls.project_name})
+
+    @classmethod
+    def tearDownClass(cls):
+        cls.openstack('project delete %s' % cls.project_name)
+        cls.openstack('domain set --disable %s' % cls.domain_name)
+        cls.openstack('domain delete %s' % cls.domain_name)
+
+        if hasattr(super(IdentityTests, cls), 'tearDownClass'):
+            super(IdentityTests, cls).tearDownClass()
+
+    def _create_dummy_user(self, add_clean_up=True):
+        username = data_utils.rand_name('TestUser')
+        password = data_utils.rand_name('password')
+        email = data_utils.rand_name() + '@example.com'
+        description = data_utils.rand_name('description')
+        raw_output = self.openstack(
+            'user create '
+            '--domain %(domain)s '
+            '--project %(project)s '
+            '--password %(password)s '
+            '--email %(email)s '
+            '--description %(description)s '
+            '--enable '
+            '%(name)s' % {'domain': self.domain_name,
+                          'project': self.project_name,
+                          'email': email,
+                          'password': password,
+                          'description': description,
+                          'name': username})
         items = self.parse_show(raw_output)
-        self.assert_show_fields(items, self.GROUP_FIELDS)
-
-    def test_group_list(self):
-        self._create_dummy_group()
-        raw_output = self.openstack('group list')
-        items = self.parse_listing(raw_output)
-        self.assert_table_structure(items, BASIC_LIST_HEADERS)
-
-    def test_group_delete(self):
-        name = self._create_dummy_group()
-        raw_output = self.openstack('group delete ' + name)
-        self.assertEqual(0, len(raw_output))
-
-    def test_group_show(self):
-        name = self._create_dummy_group()
-        raw_output = self.openstack('group show ' + name)
-        items = self.parse_show(raw_output)
-        self.assert_show_fields(items, self.GROUP_FIELDS)
-
-    def test_domain_create(self):
-        raw_output = self.openstack('domain create ' + uuid.uuid4().hex)
+        self.assert_show_fields(items, self.USER_FIELDS)
+        if add_clean_up:
+            self.addCleanup(
+                self.openstack,
+                'user delete %s' % self.parse_show_as_object(raw_output)['id'])
+        return username
+
+    def _create_dummy_role(self, add_clean_up=True):
+        role_name = data_utils.rand_name('TestRole')
+        raw_output = self.openstack('role create %s' % role_name)
         items = self.parse_show(raw_output)
-        self.assert_show_fields(items, self.DOMAIN_FIELDS)
-
-    def test_domain_list(self):
-        self._create_dummy_domain()
-        raw_output = self.openstack('domain list')
-        items = self.parse_listing(raw_output)
-        self.assert_table_structure(items, BASIC_LIST_HEADERS)
-
-    def test_domain_delete(self):
-        name = self._create_dummy_domain()
-        self.assertRaises(exceptions.CommandFailed,
-                          self.openstack, 'domain delete ' + name)
-
-    def test_domain_show(self):
-        name = self._create_dummy_domain()
-        raw_output = self.openstack('domain show ' + name)
+        self.assert_show_fields(items, self.ROLE_FIELDS)
+        role = self.parse_show_as_object(raw_output)
+        self.assertEqual(role_name, role['name'])
+        if add_clean_up:
+            self.addCleanup(
+                self.openstack,
+                'role delete %s' % role['id'])
+        return role_name
+
+    def _create_dummy_group(self, add_clean_up=True):
+        group_name = data_utils.rand_name('TestGroup')
+        description = data_utils.rand_name('description')
+        raw_output = self.openstack(
+            'group create '
+            '--domain %(domain)s '
+            '--description %(description)s '
+            '%(name)s' % {'domain': self.domain_name,
+                          'description': description,
+                          'name': group_name})
         items = self.parse_show(raw_output)
-        self.assert_show_fields(items, self.DOMAIN_FIELDS)
-
-    def test_token_issue(self):
-        raw_output = self.openstack('token issue')
-        items = self.parse_show(raw_output)
-        self.assert_show_fields(items, self.TOKEN_FIELDS)
+        self.assert_show_fields(items, self.GROUP_FIELDS)
+        if add_clean_up:
+            self.addCleanup(
+                self.openstack,
+                'group delete '
+                '--domain %(domain)s '
+                '%(name)s' % {'domain': self.domain_name,
+                              'name': group_name})
+        return group_name
+
+    def _create_dummy_domain(self, add_clean_up=True):
+        domain_name = data_utils.rand_name('TestDomain')
+        domain_description = data_utils.rand_name('description')
+        self.openstack(
+            'domain create '
+            '--description %(description)s '
+            '--enable %(name)s' % {'description': domain_description,
+                                   'name': domain_name})
+        if add_clean_up:
+            self.addCleanup(
+                self.openstack,
+                'domain delete %s' % domain_name
+            )
+            self.addCleanup(
+                self.openstack,
+                'domain set --disable %s' % domain_name
+            )
+        return domain_name
+
+    def _create_dummy_project(self, add_clean_up=True):
+        project_name = data_utils.rand_name('TestProject')
+        project_description = data_utils.rand_name('description')
+        self.openstack(
+            'project create '
+            '--domain %(domain)s '
+            '--description %(description)s '
+            '--enable %(name)s' % {'domain': self.domain_name,
+                                   'description': project_description,
+                                   'name': project_name})
+        if add_clean_up:
+            self.addCleanup(
+                self.openstack,
+                'project delete '
+                '--domain %(domain)s '
+                '%(name)s' % {'domain': self.domain_name,
+                              'name': project_name})
+        return project_name
diff --git a/functional/tests/identity/v3/test_project.py b/functional/tests/identity/v3/test_project.py
new file mode 100644
index 00000000..204a8d14
--- /dev/null
+++ b/functional/tests/identity/v3/test_project.py
@@ -0,0 +1,113 @@
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from tempest_lib.common.utils import data_utils
+
+from functional.tests.identity.v3 import test_identity
+
+
+class ProjectTests(test_identity.IdentityTests):
+
+    def test_project_create(self):
+        project_name = data_utils.rand_name('TestProject')
+        description = data_utils.rand_name('description')
+        raw_output = self.openstack(
+            'project create '
+            '--domain %(domain)s '
+            '--description %(description)s '
+            '--enable '
+            '--property k1=v1 '
+            '--property k2=v2 '
+            '%(name)s' % {'domain': self.domain_name,
+                          'description': description,
+                          'name': project_name})
+        self.addCleanup(
+            self.openstack,
+            'project delete '
+            '--domain %(domain)s '
+            '%(name)s' % {'domain': self.domain_name,
+                          'name': project_name}
+        )
+        items = self.parse_show(raw_output)
+        show_fields = list(self.PROJECT_FIELDS)
+        show_fields.extend(['k1', 'k2'])
+        self.assert_show_fields(items, show_fields)
+        project = self.parse_show_as_object(raw_output)
+        self.assertEqual('v1', project['k1'])
+        self.assertEqual('v2', project['k2'])
+
+    def test_project_delete(self):
+        project_name = self._create_dummy_project(add_clean_up=False)
+        raw_output = self.openstack(
+            'project delete '
+            '--domain %(domain)s '
+            '%(name)s' % {'domain': self.domain_name,
+                          'name': project_name})
+        self.assertEqual(0, len(raw_output))
+
+    def test_project_list(self):
+        raw_output = self.openstack('project list')
+        items = self.parse_listing(raw_output)
+        self.assert_table_structure(items, test_identity.BASIC_LIST_HEADERS)
+
+    def test_project_list_with_domain(self):
+        project_name = self._create_dummy_project()
+        raw_output = self.openstack(
+            'project list --domain %s' % self.domain_name)
+        items = self.parse_listing(raw_output)
+        self.assert_table_structure(items, test_identity.BASIC_LIST_HEADERS)
+        self.assertInOutput(project_name, raw_output)
+        self.assertTrue(len(items) > 0)
+
+    def test_project_set(self):
+        project_name = self._create_dummy_project()
+        new_project_name = data_utils.rand_name('NewTestProject')
+        raw_output = self.openstack(
+            'project set '
+            '--name %(new_name)s '
+            '--disable '
+            '--property k0=v0 '
+            '%(name)s' % {'new_name': new_project_name,
+                          'domain': self.domain_name,
+                          'name': project_name})
+        self.assertEqual(0, len(raw_output))
+        # check project details
+        raw_output = self.openstack(
+            'project show '
+            '--domain %(domain)s '
+            '%(name)s' % {'domain': self.domain_name,
+                          'name': new_project_name}
+        )
+        items = self.parse_show(raw_output)
+        fields = list(self.PROJECT_FIELDS)
+        fields.extend(['k0'])
+        self.assert_show_fields(items, fields)
+        project = self.parse_show_as_object(raw_output)
+        self.assertEqual(new_project_name, project['name'])
+        self.assertEqual('False', project['enabled'])
+        self.assertEqual('v0', project['k0'])
+        # reset project to make sure it will be cleaned up
+        self.openstack(
+            'project set '
+            '--name %(new_name)s '
+            '--enable '
+            '%(name)s' % {'new_name': project_name,
+                          'name': new_project_name})
+
+    def test_project_show(self):
+        raw_output = self.openstack(
+            'project show '
+            '--domain %(domain)s '
+            '%(name)s' % {'domain': self.domain_name,
+                          'name': self.project_name})
+        items = self.parse_show(raw_output)
+        self.assert_show_fields(items, self.PROJECT_FIELDS)
diff --git a/functional/tests/identity/v3/test_role.py b/functional/tests/identity/v3/test_role.py
new file mode 100644
index 00000000..7e0cf76e
--- /dev/null
+++ b/functional/tests/identity/v3/test_role.py
@@ -0,0 +1,145 @@
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from tempest_lib.common.utils import data_utils
+
+from functional.tests.identity.v3 import test_identity
+
+
+class RoleTests(test_identity.IdentityTests):
+
+    def test_role_create(self):
+        self._create_dummy_role()
+
+    def test_role_delete(self):
+        role_name = self._create_dummy_role(add_clean_up=False)
+        raw_output = self.openstack('role delete %s' % role_name)
+        self.assertEqual(0, len(raw_output))
+
+    def test_role_list(self):
+        self._create_dummy_role()
+        raw_output = self.openstack('role list')
+        items = self.parse_listing(raw_output)
+        self.assert_table_structure(items, test_identity.BASIC_LIST_HEADERS)
+
+    def test_role_list_with_user_project(self):
+        role_name = self._create_dummy_role()
+        username = self._create_dummy_user()
+        raw_output = self.openstack(
+            'role add '
+            '--project %(project)s '
+            '--project-domain %(project_domain)s '
+            '--user %(user)s '
+            '--user-domain %(user_domain)s '
+            '%(role)s' % {'project': self.project_name,
+                          'project_domain': self.domain_name,
+                          'user': username,
+                          'user_domain': self.domain_name,
+                          'role': role_name})
+        self.assertEqual(0, len(raw_output))
+        raw_output = self.openstack(
+            'role list '
+            '--project %(project)s '
+            '--project-domain %(project_domain)s '
+            '--user %(user)s '
+            '--user-domain %(user_domain)s '
+            '' % {'project': self.project_name,
+                  'project_domain': self.domain_name,
+                  'user': username,
+                  'user_domain': self.domain_name})
+        items = self.parse_listing(raw_output)
+        self.assert_table_structure(items, test_identity.BASIC_LIST_HEADERS)
+        self.assertEqual(1, len(items))
+        self.addCleanup(
+            self.openstack,
+            'role remove '
+            '--project %(project)s '
+            '--project-domain %(project_domain)s '
+            '--user %(user)s '
+            '--user-domain %(user_domain)s '
+            '%(role)s' % {'project': self.project_name,
+                          'project_domain': self.domain_name,
+                          'user': username,
+                          'user_domain': self.domain_name,
+                          'role': role_name})
+
+    def test_role_show(self):
+        role_name = self._create_dummy_role()
+        raw_output = self.openstack('role show %s' % role_name)
+        items = self.parse_show(raw_output)
+        self.assert_show_fields(items, self.ROLE_FIELDS)
+
+    def test_role_set(self):
+        role_name = self._create_dummy_role()
+        new_role_name = data_utils.rand_name('NewTestRole')
+        raw_output = self.openstack(
+            'role set --name %s %s' % (new_role_name, role_name))
+        self.assertEqual(0, len(raw_output))
+        raw_output = self.openstack('role show %s' % new_role_name)
+        role = self.parse_show_as_object(raw_output)
+        self.assertEqual(new_role_name, role['name'])
+
+    def test_role_add(self):
+        role_name = self._create_dummy_role()
+        username = self._create_dummy_user()
+        raw_output = self.openstack(
+            'role add '
+            '--project %(project)s '
+            '--project-domain %(project_domain)s '
+            '--user %(user)s '
+            '--user-domain %(user_domain)s '
+            '%(role)s' % {'project': self.project_name,
+                          'project_domain': self.domain_name,
+                          'user': username,
+                          'user_domain': self.domain_name,
+                          'role': role_name})
+        self.assertEqual(0, len(raw_output))
+        self.addCleanup(
+            self.openstack,
+            'role remove '
+            '--project %(project)s '
+            '--project-domain %(project_domain)s '
+            '--user %(user)s '
+            '--user-domain %(user_domain)s '
+            '%(role)s' % {'project': self.project_name,
+                          'project_domain': self.domain_name,
+                          'user': username,
+                          'user_domain': self.domain_name,
+                          'role': role_name})
+
+    def test_role_remove(self):
+        role_name = self._create_dummy_role()
+        username = self._create_dummy_user()
+        raw_output = self.openstack(
+            'role add '
+            '--project %(project)s '
+            '--project-domain %(project_domain)s '
+            '--user %(user)s '
+            '--user-domain %(user_domain)s '
+            '%(role)s' % {'project': self.project_name,
+                          'project_domain': self.domain_name,
+                          'user': username,
+                          'user_domain': self.domain_name,
+                          'role': role_name})
+        self.assertEqual(0, len(raw_output))
+        raw_output = self.openstack(
+            'role remove '
+            '--project %(project)s '
+            '--project-domain %(project_domain)s '
+            '--user %(user)s '
+            '--user-domain %(user_domain)s '
+            '%(role)s' % {'project': self.project_name,
+                          'project_domain': self.domain_name,
+                          'user': username,
+                          'user_domain': self.domain_name,
+                          'role': role_name})
+        self.assertEqual(0, len(raw_output))
diff --git a/functional/tests/identity/v3/test_token.py b/functional/tests/identity/v3/test_token.py
new file mode 100644
index 00000000..67fddccf
--- /dev/null
+++ b/functional/tests/identity/v3/test_token.py
@@ -0,0 +1,21 @@
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from functional.tests.identity.v3 import test_identity
+
+
+class TokenTests(test_identity.IdentityTests):
+
+    def test_token_issue(self):
+        raw_output = self.openstack('token issue')
+        items = self.parse_show(raw_output)
+        self.assert_show_fields(items, self.TOKEN_FIELDS)
diff --git a/functional/tests/identity/v3/test_user.py b/functional/tests/identity/v3/test_user.py
new file mode 100644
index 00000000..69420b96
--- /dev/null
+++ b/functional/tests/identity/v3/test_user.py
@@ -0,0 +1,67 @@
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from tempest_lib.common.utils import data_utils
+
+from functional.tests.identity.v3 import test_identity
+
+
+class UserTests(test_identity.IdentityTests):
+
+    def test_user_create(self):
+        self._create_dummy_user()
+
+    def test_user_delete(self):
+        username = self._create_dummy_user(add_clean_up=False)
+        raw_output = self.openstack('user delete '
+                                    '--domain %(domain)s '
+                                    '%(name)s' % {'domain': self.domain_name,
+                                                  'name': username})
+        self.assertEqual(0, len(raw_output))
+
+    def test_user_list(self):
+        raw_output = self.openstack('user list')
+        items = self.parse_listing(raw_output)
+        self.assert_table_structure(items, test_identity.BASIC_LIST_HEADERS)
+
+    def test_user_set(self):
+        username = self._create_dummy_user()
+        raw_output = self.openstack('user show '
+                                    '--domain %(domain)s '
+                                    '%(name)s' % {'domain': self.domain_name,
+                                                  'name': username})
+        user = self.parse_show_as_object(raw_output)
+        new_username = data_utils.rand_name('NewTestUser')
+        new_email = data_utils.rand_name() + '@example.com'
+        raw_output = self.openstack('user set '
+                                    '--email %(email)s '
+                                    '--name %(new_name)s '
+                                    '%(id)s' % {'email': new_email,
+                                                'new_name': new_username,
+                                                'id': user['id']})
+        self.assertEqual(0, len(raw_output))
+        raw_output = self.openstack('user show '
+                                    '--domain %(domain)s '
+                                    '%(name)s' % {'domain': self.domain_name,
+                                                  'name': new_username})
+        new_user = self.parse_show_as_object(raw_output)
+        self.assertEqual(user['id'], new_user['id'])
+        self.assertEqual(new_email, new_user['email'])
+
+    def test_user_show(self):
+        username = self._create_dummy_user()
+        raw_output = self.openstack('user show '
+                                    '--domain %(domain)s '
+                                    '%(name)s' % {'domain': self.domain_name,
+                                                  'name': username})
+        items = self.parse_show(raw_output)
+        self.assert_show_fields(items, self.USER_FIELDS)