Moving authentication from keystoneclient to keystoneauth

Currently OpenStackClient uses keystoneclient for authentication.
This change will update OpenStackClient to use keystoneauth for
authentication.

All dependant test have been updated.

Updating how auth_ref is set in the tests to use KSA fixtures had
some racy side-effects.  The user_role_list tests failed when they
picked up an auth_ref that was a fixture.  This exposed a weakness
in ListUserRole that needed to be fixed at the same time re
handling of unscoped tokens and options.

Change-Id: I4ddb2dbbb3bf2ab37494468eaf65cef9213a6e00
Closes-Bug: 1533369

9 files changed, 237 insertions, 69 deletions

diff --git a/openstackclient/tests/common/test_clientmanager.py b/openstackclient/tests/common/test_clientmanager.py
index fa6c3fcc..33485b00 100644
--- a/openstackclient/tests/common/test_clientmanager.py
+++ b/openstackclient/tests/common/test_clientmanager.py
@@ -17,11 +17,11 @@ import json as jsonutils
 import mock
 from requests_mock.contrib import fixture
 
-from keystoneclient.auth.identity import v2 as auth_v2
-from keystoneclient import service_catalog
+from keystoneauth1.access import service_catalog
+from keystoneauth1.identity import v2 as auth_v2
+from keystoneauth1 import token_endpoint
 
 from openstackclient.api import auth
-from openstackclient.api import auth_plugin
 from openstackclient.common import clientmanager
 from openstackclient.common import exceptions as exc
 from openstackclient.tests import fakes
@@ -29,7 +29,6 @@ from openstackclient.tests import utils
 
 
 API_VERSION = {"identity": "2.0"}
-
 AUTH_REF = {'version': 'v2.0'}
 AUTH_REF.update(fakes.TEST_RESPONSE_DICT['access'])
 SERVICE_CATALOG = service_catalog.ServiceCatalogV2(AUTH_REF)
@@ -126,7 +125,7 @@ class TestClientManager(utils.TestCase):
         )
         self.assertIsInstance(
             client_manager.auth,
-            auth_plugin.TokenEndpoint,
+            token_endpoint.Token,
         )
         self.assertFalse(client_manager._insecure)
         self.assertTrue(client_manager._verify)
@@ -205,11 +204,14 @@ class TestClientManager(utils.TestCase):
         )
         self.assertTrue(client_manager._insecure)
         self.assertFalse(client_manager._verify)
-
         # These need to stick around until the old-style clients are gone
         self.assertEqual(
-            AUTH_REF,
-            client_manager.auth_ref,
+            AUTH_REF.pop('version'),
+            client_manager.auth_ref.version,
+        )
+        self.assertEqual(
+            fakes.to_unicode_dict(AUTH_REF),
+            client_manager.auth_ref._data['access'],
         )
         self.assertEqual(
             dir(SERVICE_CATALOG),
@@ -296,9 +298,10 @@ class TestClientManager(utils.TestCase):
     def _select_auth_plugin(self, auth_params, api_version, auth_plugin_name):
         auth_params['auth_type'] = auth_plugin_name
         auth_params['identity_api_version'] = api_version
+
         client_manager = clientmanager.ClientManager(
             cli_options=FakeOptions(**auth_params),
-            api_version=API_VERSION,
+            api_version={"identity": api_version},
             verify=True
         )
         client_manager.setup_auth()
diff --git a/openstackclient/tests/fakes.py b/openstackclient/tests/fakes.py
index ad4705a4..d0cab019 100644
--- a/openstackclient/tests/fakes.py
+++ b/openstackclient/tests/fakes.py
@@ -50,6 +50,21 @@ TEST_RESPONSE_DICT_V3.set_project_scope()
 TEST_VERSIONS = fixture.DiscoveryList(href=AUTH_URL)
 
 
+def to_unicode_dict(catalog_dict):
+    """Converts dict to unicode dict
+
+    """
+    if isinstance(catalog_dict, dict):
+        return {to_unicode_dict(key): to_unicode_dict(value)
+                for key, value in catalog_dict.items()}
+    elif isinstance(catalog_dict, list):
+        return [to_unicode_dict(element) for element in catalog_dict]
+    elif isinstance(catalog_dict, str):
+        return catalog_dict + u""
+    else:
+        return catalog_dict
+
+
 class FakeStdout(object):
 
     def __init__(self):
diff --git a/openstackclient/tests/identity/v2_0/fakes.py b/openstackclient/tests/identity/v2_0/fakes.py
index b8093872..c613ad82 100644
--- a/openstackclient/tests/identity/v2_0/fakes.py
+++ b/openstackclient/tests/identity/v2_0/fakes.py
@@ -17,6 +17,9 @@ import copy
 import mock
 import uuid
 
+from keystoneauth1 import access
+from keystoneauth1 import fixture
+
 from openstackclient.tests import fakes
 from openstackclient.tests import utils
 
@@ -109,6 +112,43 @@ ENDPOINT = {
 }
 
 
+def fake_auth_ref(fake_token, fake_service=None):
+    """Create an auth_ref using keystoneauth's fixtures"""
+    token_copy = copy.deepcopy(fake_token)
+    token_copy['token_id'] = token_copy.pop('id')
+    token = fixture.V2Token(**token_copy)
+    # An auth_ref is actually an access info object
+    auth_ref = access.create(body=token)
+
+    # Create a service catalog
+    if fake_service:
+        service = token.add_service(
+            fake_service['type'],
+            fake_service['name'],
+        )
+        # TODO(dtroyer): Add an 'id' element to KSA's _Service fixure
+        service['id'] = fake_service['id']
+        for e in fake_service['endpoints']:
+            # KSA's _Service fixture copies publicURL to internalURL and
+            # adminURL if they do not exist.  Soooo helpful...
+            internal = e.get('internalURL', None)
+            admin = e.get('adminURL', None)
+            region = e.get('region_id') or e.get('region', '<none>')
+            endpoint = service.add_endpoint(
+                public=e['publicURL'],
+                internal=internal,
+                admin=admin,
+                region=region,
+            )
+            # ...so undo that helpfulness
+            if not internal:
+                endpoint['internalURL'] = None
+            if not admin:
+                endpoint['adminURL'] = None
+
+    return auth_ref
+
+
 class FakeIdentityv2Client(object):
 
     def __init__(self, **kwargs):
diff --git a/openstackclient/tests/identity/v2_0/test_catalog.py b/openstackclient/tests/identity/v2_0/test_catalog.py
index d9ae6a80..2fdbafbe 100644
--- a/openstackclient/tests/identity/v2_0/test_catalog.py
+++ b/openstackclient/tests/identity/v2_0/test_catalog.py
@@ -14,6 +14,7 @@
 import mock
 
 from openstackclient.identity.v2_0 import catalog
+from openstackclient.tests.identity.v2_0 import fakes as identity_fakes
 from openstackclient.tests import utils
 
 
@@ -49,7 +50,7 @@ class TestCatalog(utils.TestCommand):
         super(TestCatalog, self).setUp()
 
         self.sc_mock = mock.MagicMock()
-        self.sc_mock.service_catalog.get_data.return_value = [
+        self.sc_mock.service_catalog.catalog.return_value = [
             self.fake_service,
         ]
 
@@ -74,6 +75,13 @@ class TestCatalogList(TestCatalog):
         self.cmd = catalog.ListCatalog(self.app, None)
 
     def test_catalog_list(self):
+        auth_ref = identity_fakes.fake_auth_ref(
+            identity_fakes.TOKEN,
+            fake_service=self.fake_service,
+        )
+        self.ar_mock = mock.PropertyMock(return_value=auth_ref)
+        type(self.app.client_manager).auth_ref = self.ar_mock
+
         arglist = []
         verifylist = []
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -82,7 +90,6 @@ class TestCatalogList(TestCatalog):
         # returns a tuple containing the column names and an iterable
         # containing the data to be listed.
         columns, data = self.cmd.take_action(parsed_args)
-        self.sc_mock.service_catalog.get_data.assert_called_with()
 
         self.assertEqual(self.columns, columns)
         datalist = ((
@@ -117,9 +124,12 @@ class TestCatalogList(TestCatalog):
                 },
             ],
         }
-        self.sc_mock.service_catalog.get_data.return_value = [
-            fake_service,
-        ]
+        auth_ref = identity_fakes.fake_auth_ref(
+            identity_fakes.TOKEN,
+            fake_service=fake_service,
+        )
+        self.ar_mock = mock.PropertyMock(return_value=auth_ref)
+        type(self.app.client_manager).auth_ref = self.ar_mock
 
         arglist = []
         verifylist = []
@@ -129,7 +139,6 @@ class TestCatalogList(TestCatalog):
         # returns a tuple containing the column names and an iterable
         # containing the data to be listed.
         columns, data = self.cmd.take_action(parsed_args)
-        self.sc_mock.service_catalog.get_data.assert_called_with()
 
         self.assertEqual(self.columns, columns)
         datalist = ((
@@ -151,6 +160,13 @@ class TestCatalogShow(TestCatalog):
         self.cmd = catalog.ShowCatalog(self.app, None)
 
     def test_catalog_show(self):
+        auth_ref = identity_fakes.fake_auth_ref(
+            identity_fakes.UNSCOPED_TOKEN,
+            fake_service=self.fake_service,
+        )
+        self.ar_mock = mock.PropertyMock(return_value=auth_ref)
+        type(self.app.client_manager).auth_ref = self.ar_mock
+
         arglist = [
             'compute',
         ]
@@ -163,7 +179,6 @@ class TestCatalogShow(TestCatalog):
         # returns a two-part tuple with a tuple of column names and a tuple of
         # data to be shown.
         columns, data = self.cmd.take_action(parsed_args)
-        self.sc_mock.service_catalog.get_data.assert_called_with()
 
         collist = ('endpoints', 'id', 'name', 'type')
         self.assertEqual(collist, columns)
diff --git a/openstackclient/tests/identity/v2_0/test_role.py b/openstackclient/tests/identity/v2_0/test_role.py
index 3c4b79a4..486a4a2a 100644
--- a/openstackclient/tests/identity/v2_0/test_role.py
+++ b/openstackclient/tests/identity/v2_0/test_role.py
@@ -26,6 +26,13 @@ from openstackclient.tests.identity.v2_0 import fakes as identity_fakes
 
 class TestRole(identity_fakes.TestIdentityv2):
 
+    fake_service = copy.deepcopy(identity_fakes.SERVICE)
+    fake_service['endpoints'] = [
+        {
+            'publicURL': identity_fakes.ENDPOINT['publicurl'],
+        },
+    ]
+
     def setUp(self):
         super(TestRole, self).setUp()
 
@@ -41,6 +48,13 @@ class TestRole(identity_fakes.TestIdentityv2):
         self.roles_mock = self.app.client_manager.identity.roles
         self.roles_mock.reset_mock()
 
+        auth_ref = identity_fakes.fake_auth_ref(
+            identity_fakes.TOKEN,
+            fake_service=self.fake_service,
+        )
+        self.ar_mock = mock.PropertyMock(return_value=auth_ref)
+        type(self.app.client_manager).auth_ref = self.ar_mock
+
 
 class TestRoleAdd(TestRole):
 
@@ -320,7 +334,14 @@ class TestUserRoleList(TestRole):
         # Get the command object to test
         self.cmd = role.ListUserRole(self.app, None)
 
-    def test_user_role_list_no_options(self):
+    def test_user_role_list_no_options_unscoped_token(self):
+        auth_ref = identity_fakes.fake_auth_ref(
+            identity_fakes.UNSCOPED_TOKEN,
+            fake_service=self.fake_service,
+        )
+        self.ar_mock = mock.PropertyMock(return_value=auth_ref)
+        type(self.app.client_manager).auth_ref = self.ar_mock
+
         arglist = []
         verifylist = []
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -332,11 +353,7 @@ class TestUserRoleList(TestRole):
             parsed_args,
         )
 
-    def test_user_role_list_no_options_def_creds(self):
-        auth_ref = self.app.client_manager.auth_ref = mock.MagicMock()
-        auth_ref.project_id.return_value = identity_fakes.project_id
-        auth_ref.user_id.return_value = identity_fakes.user_id
-
+    def test_user_role_list_no_options_scoped_token(self):
         arglist = []
         verifylist = []
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -361,7 +378,14 @@ class TestUserRoleList(TestRole):
         ), )
         self.assertEqual(datalist, tuple(data))
 
-    def test_user_role_list_project(self):
+    def test_user_role_list_project_unscoped_token(self):
+        auth_ref = identity_fakes.fake_auth_ref(
+            identity_fakes.UNSCOPED_TOKEN,
+            fake_service=self.fake_service,
+        )
+        self.ar_mock = mock.PropertyMock(return_value=auth_ref)
+        type(self.app.client_manager).auth_ref = self.ar_mock
+
         self.projects_mock.get.return_value = fakes.FakeResource(
             None,
             copy.deepcopy(identity_fakes.PROJECT_2),
@@ -375,18 +399,26 @@ class TestUserRoleList(TestRole):
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
 
-        # This argument combination should raise a CommandError
-        self.assertRaises(
-            exceptions.CommandError,
-            self.cmd.take_action,
-            parsed_args,
+        # In base command class Lister in cliff, abstract method take_action()
+        # returns a tuple containing the column names and an iterable
+        # containing the data to be listed.
+        columns, data = self.cmd.take_action(parsed_args)
+
+        self.roles_mock.roles_for_user.assert_called_with(
+            identity_fakes.user_id,
+            identity_fakes.PROJECT_2['id'],
         )
 
-    def test_user_role_list_project_def_creds(self):
-        auth_ref = self.app.client_manager.auth_ref = mock.MagicMock()
-        auth_ref.project_id.return_value = identity_fakes.project_id
-        auth_ref.user_id.return_value = identity_fakes.user_id
+        self.assertEqual(columns, columns)
+        datalist = ((
+            identity_fakes.role_id,
+            identity_fakes.role_name,
+            identity_fakes.PROJECT_2['name'],
+            identity_fakes.user_name,
+        ), )
+        self.assertEqual(datalist, tuple(data))
 
+    def test_user_role_list_project_scoped_token(self):
         self.projects_mock.get.return_value = fakes.FakeResource(
             None,
             copy.deepcopy(identity_fakes.PROJECT_2),
diff --git a/openstackclient/tests/identity/v2_0/test_token.py b/openstackclient/tests/identity/v2_0/test_token.py
index 613139dd..96f08e87 100644
--- a/openstackclient/tests/identity/v2_0/test_token.py
+++ b/openstackclient/tests/identity/v2_0/test_token.py
@@ -24,10 +24,9 @@ class TestToken(identity_fakes.TestIdentityv2):
     def setUp(self):
         super(TestToken, self).setUp()
 
-        # Get a shortcut to the Service Catalog Mock
-        self.sc_mock = mock.Mock()
-        self.app.client_manager.auth_ref = mock.Mock()
-        self.app.client_manager.auth_ref.service_catalog = self.sc_mock
+        # Get a shortcut to the Auth Ref Mock
+        self.ar_mock = mock.PropertyMock()
+        type(self.app.client_manager).auth_ref = self.ar_mock
 
 
 class TestTokenIssue(TestToken):
@@ -35,10 +34,15 @@ class TestTokenIssue(TestToken):
     def setUp(self):
         super(TestTokenIssue, self).setUp()
 
-        self.sc_mock.get_token.return_value = identity_fakes.TOKEN
         self.cmd = token.IssueToken(self.app, None)
 
     def test_token_issue(self):
+        auth_ref = identity_fakes.fake_auth_ref(
+            identity_fakes.TOKEN,
+        )
+        self.ar_mock = mock.PropertyMock(return_value=auth_ref)
+        type(self.app.client_manager).auth_ref = self.ar_mock
+
         arglist = []
         verifylist = []
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -48,12 +52,10 @@ class TestTokenIssue(TestToken):
         # data to be shown.
         columns, data = self.cmd.take_action(parsed_args)
 
-        self.sc_mock.get_token.assert_called_with()
-
         collist = ('expires', 'id', 'project_id', 'user_id')
         self.assertEqual(collist, columns)
         datalist = (
-            identity_fakes.token_expires,
+            auth_ref.expires,
             identity_fakes.token_id,
             identity_fakes.project_id,
             identity_fakes.user_id,
@@ -61,8 +63,11 @@ class TestTokenIssue(TestToken):
         self.assertEqual(datalist, data)
 
     def test_token_issue_with_unscoped_token(self):
-        # make sure we return an unscoped token
-        self.sc_mock.get_token.return_value = identity_fakes.UNSCOPED_TOKEN
+        auth_ref = identity_fakes.fake_auth_ref(
+            identity_fakes.UNSCOPED_TOKEN,
+        )
+        self.ar_mock = mock.PropertyMock(return_value=auth_ref)
+        type(self.app.client_manager).auth_ref = self.ar_mock
 
         arglist = []
         verifylist = []
@@ -71,12 +76,14 @@ class TestTokenIssue(TestToken):
         # DisplayCommandBase.take_action() returns two tuples
         columns, data = self.cmd.take_action(parsed_args)
 
-        self.sc_mock.get_token.assert_called_with()
-
-        collist = ('expires', 'id', 'user_id')
+        collist = (
+            'expires',
+            'id',
+            'user_id',
+        )
         self.assertEqual(collist, columns)
         datalist = (
-            identity_fakes.token_expires,
+            auth_ref.expires,
             identity_fakes.token_id,
             identity_fakes.user_id,
         )
diff --git a/openstackclient/tests/identity/v3/fakes.py b/openstackclient/tests/identity/v3/fakes.py
index 1422166a..cd1b4bd7 100644
--- a/openstackclient/tests/identity/v3/fakes.py
+++ b/openstackclient/tests/identity/v3/fakes.py
@@ -13,8 +13,12 @@
 #   under the License.
 #
 
+import copy
 import mock
 
+from keystoneauth1 import access
+from keystoneauth1 import fixture
+
 from openstackclient.tests import fakes
 from openstackclient.tests import utils
 
@@ -419,6 +423,36 @@ OAUTH_VERIFIER = {
 }
 
 
+def fake_auth_ref(fake_token, fake_service=None):
+    """Create an auth_ref using keystoneauth's fixtures"""
+    token_copy = copy.deepcopy(fake_token)
+    token_id = token_copy.pop('id')
+    token = fixture.V3Token(**token_copy)
+    # An auth_ref is actually an access info object
+    auth_ref = access.create(
+        body=token,
+        auth_token=token_id,
+    )
+
+    # Create a service catalog
+    if fake_service:
+        service = token.add_service(
+            fake_service['type'],
+            fake_service['name'],
+        )
+        # TODO(dtroyer): Add an 'id' element to KSA's _Service fixure
+        service['id'] = fake_service['id']
+        for e in fake_service['endpoints']:
+            region = e.get('region_id') or e.get('region', '<none>')
+            service.add_endpoint(
+                e['interface'],
+                e['url'],
+                region=region,
+            )
+
+    return auth_ref
+
+
 class FakeAuth(object):
 
     def __init__(self, auth_method_class=None):
diff --git a/openstackclient/tests/identity/v3/test_catalog.py b/openstackclient/tests/identity/v3/test_catalog.py
index 1b8fa085..e3c5ed3d 100644
--- a/openstackclient/tests/identity/v3/test_catalog.py
+++ b/openstackclient/tests/identity/v3/test_catalog.py
@@ -14,6 +14,7 @@
 import mock
 
 from openstackclient.identity.v3 import catalog
+from openstackclient.tests.identity.v3 import fakes as identity_fakes
 from openstackclient.tests import utils
 
 
@@ -50,7 +51,7 @@ class TestCatalog(utils.TestCommand):
         super(TestCatalog, self).setUp()
 
         self.sc_mock = mock.MagicMock()
-        self.sc_mock.service_catalog.get_data.return_value = [
+        self.sc_mock.service_catalog.catalog.return_value = [
             self.fake_service,
         ]
 
@@ -69,6 +70,13 @@ class TestCatalogList(TestCatalog):
         self.cmd = catalog.ListCatalog(self.app, None)
 
     def test_catalog_list(self):
+        auth_ref = identity_fakes.fake_auth_ref(
+            identity_fakes.TOKEN_WITH_PROJECT_ID,
+            fake_service=self.fake_service,
+        )
+        self.ar_mock = mock.PropertyMock(return_value=auth_ref)
+        type(self.app.client_manager).auth_ref = self.ar_mock
+
         arglist = []
         verifylist = []
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -77,7 +85,6 @@ class TestCatalogList(TestCatalog):
         # returns a tuple containing the column names and an iterable
         # containing the data to be listed.
         columns, data = self.cmd.take_action(parsed_args)
-        self.sc_mock.service_catalog.get_data.assert_called_with()
 
         collist = ('Name', 'Type', 'Endpoints')
         self.assertEqual(collist, columns)
@@ -101,6 +108,13 @@ class TestCatalogShow(TestCatalog):
         self.cmd = catalog.ShowCatalog(self.app, None)
 
     def test_catalog_show(self):
+        auth_ref = identity_fakes.fake_auth_ref(
+            identity_fakes.TOKEN_WITH_PROJECT_ID,
+            fake_service=self.fake_service,
+        )
+        self.ar_mock = mock.PropertyMock(return_value=auth_ref)
+        type(self.app.client_manager).auth_ref = self.ar_mock
+
         arglist = [
             'compute',
         ]
@@ -113,7 +127,6 @@ class TestCatalogShow(TestCatalog):
         # returns a two-part tuple with a tuple of column names and a tuple of
         # data to be shown.
         columns, data = self.cmd.take_action(parsed_args)
-        self.sc_mock.service_catalog.get_data.assert_called_with()
 
         collist = ('endpoints', 'id', 'name', 'type')
         self.assertEqual(collist, columns)
diff --git a/openstackclient/tests/identity/v3/test_token.py b/openstackclient/tests/identity/v3/test_token.py
index b68bc242..9728c6e1 100644
--- a/openstackclient/tests/identity/v3/test_token.py
+++ b/openstackclient/tests/identity/v3/test_token.py
@@ -24,10 +24,9 @@ class TestToken(identity_fakes.TestIdentityv3):
     def setUp(self):
         super(TestToken, self).setUp()
 
-        # Get a shortcut to the Service Catalog Mock
-        self.sc_mock = mock.Mock()
-        self.app.client_manager.auth_ref = mock.Mock()
-        self.app.client_manager.auth_ref.service_catalog = self.sc_mock
+        # Get a shortcut to the Auth Ref Mock
+        self.ar_mock = mock.PropertyMock()
+        type(self.app.client_manager).auth_ref = self.ar_mock
 
 
 class TestTokenIssue(TestToken):
@@ -38,23 +37,25 @@ class TestTokenIssue(TestToken):
         self.cmd = token.IssueToken(self.app, None)
 
     def test_token_issue_with_project_id(self):
+        auth_ref = identity_fakes.fake_auth_ref(
+            identity_fakes.TOKEN_WITH_PROJECT_ID,
+        )
+        self.ar_mock = mock.PropertyMock(return_value=auth_ref)
+        type(self.app.client_manager).auth_ref = self.ar_mock
+
         arglist = []
         verifylist = []
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
-        self.sc_mock.get_token.return_value = \
-            identity_fakes.TOKEN_WITH_PROJECT_ID
 
         # In base command class ShowOne in cliff, abstract method take_action()
         # returns a two-part tuple with a tuple of column names and a tuple of
         # data to be shown.
         columns, data = self.cmd.take_action(parsed_args)
 
-        self.sc_mock.get_token.assert_called_with()
-
         collist = ('expires', 'id', 'project_id', 'user_id')
         self.assertEqual(collist, columns)
         datalist = (
-            identity_fakes.token_expires,
+            auth_ref.expires,
             identity_fakes.token_id,
             identity_fakes.project_id,
             identity_fakes.user_id,
@@ -62,45 +63,53 @@ class TestTokenIssue(TestToken):
         self.assertEqual(datalist, data)
 
     def test_token_issue_with_domain_id(self):
+        auth_ref = identity_fakes.fake_auth_ref(
+            identity_fakes.TOKEN_WITH_DOMAIN_ID,
+        )
+        self.ar_mock = mock.PropertyMock(return_value=auth_ref)
+        type(self.app.client_manager).auth_ref = self.ar_mock
+
         arglist = []
         verifylist = []
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
-        self.sc_mock.get_token.return_value = \
-            identity_fakes.TOKEN_WITH_DOMAIN_ID
 
         # In base command class ShowOne in cliff, abstract method take_action()
         # returns a two-part tuple with a tuple of column names and a tuple of
         # data to be shown.
         columns, data = self.cmd.take_action(parsed_args)
 
-        self.sc_mock.get_token.assert_called_with()
-
         collist = ('domain_id', 'expires', 'id', 'user_id')
         self.assertEqual(collist, columns)
         datalist = (
             identity_fakes.domain_id,
-            identity_fakes.token_expires,
+            auth_ref.expires,
             identity_fakes.token_id,
             identity_fakes.user_id,
         )
         self.assertEqual(datalist, data)
 
     def test_token_issue_with_unscoped(self):
+        auth_ref = identity_fakes.fake_auth_ref(
+            identity_fakes.UNSCOPED_TOKEN,
+        )
+        self.ar_mock = mock.PropertyMock(return_value=auth_ref)
+        type(self.app.client_manager).auth_ref = self.ar_mock
+
         arglist = []
         verifylist = []
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
-        self.sc_mock.get_token.return_value = \
-            identity_fakes.UNSCOPED_TOKEN
 
         # DisplayCommandBase.take_action() returns two tuples
         columns, data = self.cmd.take_action(parsed_args)
 
-        self.sc_mock.get_token.assert_called_with()
-
-        collist = ('expires', 'id', 'user_id')
+        collist = (
+            'expires',
+            'id',
+            'user_id',
+        )
         self.assertEqual(collist, columns)
         datalist = (
-            identity_fakes.token_expires,
+            auth_ref.expires,
             identity_fakes.token_id,
             identity_fakes.user_id,
         )