@@ -235,7 +235,7 @@ function configure_glance {

     iniset $GLANCE_CACHE_CONF DEFAULT use_syslog $SYSLOG

     iniset $GLANCE_CACHE_CONF DEFAULT image_cache_dir $GLANCE_CACHE_DIR/

     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_url

-    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI/v2.0

+    iniset $GLANCE_CACHE_CONF DEFAULT auth_url $KEYSTONE_AUTH_URI/v3

     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_tenant_name

     iniset $GLANCE_CACHE_CONF DEFAULT admin_tenant_name $SERVICE_PROJECT_NAME

     iniuncomment $GLANCE_CACHE_CONF DEFAULT auth_user

@@ -269,13 +269,15 @@ function configure_tempest {

         iniset $TEMPEST_CONFIG auth admin_project_name $admin_project_name

         iniset $TEMPEST_CONFIG auth admin_domain_name $admin_domain_name

     fi

-    if [ "$ENABLE_IDENTITY_V2" == "False" ]; then

-        # Only Identity v3 is available; then skip Identity API v2 tests

+    if [ "$ENABLE_IDENTITY_V2" == "True" ]; then

+        # Run Identity API v2 tests ONLY if needed

+        iniset $TEMPEST_CONFIG identity-feature-enabled api_v2 True

+        iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v2}

+    else

+        # Skip Identity API v2 tests by default

         iniset $TEMPEST_CONFIG identity-feature-enabled api_v2 False

-        # In addition, use v3 auth tokens for running all Tempest tests

+        # Use v3 auth tokens for running all Tempest tests

         iniset $TEMPEST_CONFIG identity auth_version v3

-    else

-        iniset $TEMPEST_CONFIG identity auth_version ${TEMPEST_AUTH_VERSION:-v2}

     fi

     if is_ssl_enabled_service "key" || is_service_enabled tls-proxy; then

@@ -81,12 +81,12 @@ KEYSTONE_AUTH_PROTOCOL=${KEYSTONE_AUTH_PROTOCOL:-$SERVICE_PROTOCOL}

 KEYSTONE_AUTH_HOST=${KEYSTONE_AUTH_HOST:-$SERVICE_HOST}

 # Identity API version

-export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-2.0}

+export OS_IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}

 # Authenticating against an OpenStack cloud using Keystone returns a **Token**

 # and **Service Catalog**.  The catalog contains the endpoints for all services

 # the user/project has access to - including nova, glance, keystone, swift, ...

-# We currently recommend using the 2.0 *identity api*.

+# We currently recommend using the version 3 *identity api*.

 #

 export OS_AUTH_URL=$KEYSTONE_AUTH_PROTOCOL://$KEYSTONE_AUTH_HOST:5000/v${OS_IDENTITY_API_VERSION}

@@ -148,7 +148,7 @@ else

 fi

 # Configure Identity API version: 2.0, 3

-IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-2.0}

+IDENTITY_API_VERSION=${IDENTITY_API_VERSION:-3}

 # Set the option ENABLE_IDENTITY_V2 to True. It defines whether the DevStack

 # deployment will be deploying the Identity v2 pipelines. If this option is set

@@ -152,7 +152,7 @@ if [ -z "$OS_USERNAME" ]; then

 fi

 if [ -z "$OS_AUTH_URL" ]; then

-    export OS_AUTH_URL=http://localhost:5000/v2.0/

+    export OS_AUTH_URL=http://localhost:5000/v3/

 fi

 if [ -z "$OS_USER_DOMAIN_ID" -a -z "$OS_USER_DOMAIN_NAME" ]; then