python-openstackclient 7.2.1__py3-none-any.whl → 7.3.1__py3-none-any.whl

openstackclient/tests/unit/identity/v3/test_role.py

@@ -13,110 +13,177 @@
 #   under the License.
 #
 
-import copy
 from unittest import mock
 
 from osc_lib import exceptions
-from osc_lib import utils
 
-from openstackclient.identity import common
+from openstack import exceptions as sdk_exc
+from openstack.identity.v3 import domain as _domain
+from openstack.identity.v3 import group as _group
+from openstack.identity.v3 import project as _project
+from openstack.identity.v3 import role as _role
+from openstack.identity.v3 import system as _system
+from openstack.identity.v3 import user as _user
+from openstack.test import fakes as sdk_fakes
+
 from openstackclient.identity.v3 import role
-from openstackclient.tests.unit import fakes
 from openstackclient.tests.unit.identity.v3 import fakes as identity_fakes
+from openstackclient.tests.unit import utils as test_utils
+
+
+class TestRoleInherited(identity_fakes.TestIdentityv3):
+    def _is_inheritance_testcase(self):
+        return True
 
 
-class TestRole(identity_fakes.TestIdentityv3):
+class TestFindSDKId(test_utils.TestCase):
     def setUp(self):
         super().setUp()
+        self.user = sdk_fakes.generate_fake_resource(_user.User)
+        self.identity_sdk_client = mock.Mock()
+        self.identity_sdk_client.find_user = mock.Mock()
 
-        # Get a shortcut to the UserManager Mock
-        self.users_mock = self.identity_client.users
-        self.users_mock.reset_mock()
+    def test_find_sdk_id_validate(self):
+        self.identity_sdk_client.find_user.side_effect = [self.user]
 
-        # Get a shortcut to the UserManager Mock
-        self.groups_mock = self.identity_client.groups
-        self.groups_mock.reset_mock()
+        result = role._find_sdk_id(
+            self.identity_sdk_client.find_user,
+            name_or_id=self.user.id,
+            validate_actor_existence=True,
+        )
+        self.assertEqual(self.user.id, result)
 
-        # Get a shortcut to the DomainManager Mock
-        self.domains_mock = self.identity_client.domains
-        self.domains_mock.reset_mock()
+    def test_find_sdk_id_no_validate(self):
+        self.identity_sdk_client.find_user.side_effect = [self.user]
 
-        # Get a shortcut to the ProjectManager Mock
-        self.projects_mock = self.identity_client.projects
-        self.projects_mock.reset_mock()
+        result = role._find_sdk_id(
+            self.identity_sdk_client.find_user,
+            name_or_id=self.user.id,
+            validate_actor_existence=False,
+        )
+        self.assertEqual(self.user.id, result)
 
-        # Get a shortcut to the RoleManager Mock
-        self.roles_mock = self.identity_client.roles
-        self.roles_mock.reset_mock()
+    def test_find_sdk_id_not_found_validate(self):
+        self.identity_sdk_client.find_user.side_effect = [
+            sdk_exc.ResourceNotFound,
+        ]
 
-    def _is_inheritance_testcase(self):
-        return False
+        self.assertRaises(
+            exceptions.CommandError,
+            role._find_sdk_id,
+            self.identity_sdk_client.find_user,
+            name_or_id=self.user.id,
+            validate_actor_existence=True,
+        )
+
+    def test_find_sdk_id_not_found_no_validate(self):
+        self.identity_sdk_client.find_user.side_effect = [
+            sdk_exc.ResourceNotFound,
+        ]
+
+        result = role._find_sdk_id(
+            self.identity_sdk_client.find_user,
+            name_or_id=self.user.id,
+            validate_actor_existence=False,
+        )
+        self.assertEqual(self.user.id, result)
+
+    def test_find_sdk_id_forbidden_validate(self):
+        self.identity_sdk_client.find_user.side_effect = [
+            sdk_exc.ForbiddenException,
+        ]
+
+        result = role._find_sdk_id(
+            self.identity_sdk_client.find_user,
+            name_or_id=self.user.id,
+            validate_actor_existence=True,
+        )
+
+        self.assertEqual(self.user.id, result)
+
+    def test_find_sdk_id_forbidden_no_validate(self):
+        self.identity_sdk_client.find_user.side_effect = [
+            sdk_exc.ForbiddenException,
+        ]
+
+        result = role._find_sdk_id(
+            self.identity_sdk_client.find_user,
+            name_or_id=self.user.id,
+            validate_actor_existence=False,
+        )
+
+        self.assertEqual(self.user.id, result)
 
 
-class TestRoleInherited(TestRole):
+class TestRoleAdd(identity_fakes.TestIdentityv3):
     def _is_inheritance_testcase(self):
-        return True
+        return False
 
+    user = sdk_fakes.generate_fake_resource(_user.User)
+    group = sdk_fakes.generate_fake_resource(_group.Group)
+    domain = sdk_fakes.generate_fake_resource(_domain.Domain)
+    project = sdk_fakes.generate_fake_resource(_project.Project)
 
-class TestRoleAdd(TestRole):
     def setUp(self):
         super().setUp()
 
-        self.users_mock.get.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.USER),
-            loaded=True,
-        )
+        self.identity_sdk_client.find_user.return_value = self.user
+        self.identity_sdk_client.find_group.return_value = self.group
+        self.identity_sdk_client.find_domain.return_value = self.domain
+        self.identity_sdk_client.find_project.return_value = self.project
 
-        self.groups_mock.get.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.GROUP),
-            loaded=True,
+        self.role = sdk_fakes.generate_fake_resource(
+            resource_type=_role.Role,
+            domain_id=None,
+            description=None,
         )
-
-        self.domains_mock.get.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.DOMAIN),
-            loaded=True,
+        self.identity_sdk_client.find_role.return_value = self.role
+        self.role_with_domain = sdk_fakes.generate_fake_resource(
+            resource_type=_role.Role,
+            domain_id=self.domain.id,
+            description=None,
         )
 
-        self.projects_mock.get.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.PROJECT),
-            loaded=True,
+        self.identity_sdk_client.assign_domain_role_to_user.return_value = (
+            self.role
         )
-
-        self.roles_mock.get.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.ROLE),
-            loaded=True,
+        self.identity_sdk_client.assign_domain_role_to_group.return_value = (
+            self.role
         )
-        self.roles_mock.grant.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.ROLE),
-            loaded=True,
+        self.identity_sdk_client.assign_project_role_to_user.return_value = (
+            self.role
+        )
+        self.identity_sdk_client.assign_project_role_to_group.return_value = (
+            self.role
+        )
+        self.identity_sdk_client.assign_system_role_to_user.return_value = (
+            self.role
+        )
+        self.identity_sdk_client.assign_system_role_to_group.return_value = (
+            self.role
         )
 
         # Get the command object to test
         self.cmd = role.AddRole(self.app, None)
 
-    def test_role_add_user_system(self):
+    @mock.patch.object(role.LOG, 'warning')
+    def test_role_add_user_system(self, mock_warning):
         arglist = [
             '--user',
-            identity_fakes.user_name,
+            self.user.name,
             '--system',
             'all',
-            identity_fakes.role_name,
+            self.role.name,
         ]
         if self._is_inheritance_testcase():
             arglist.append('--inherited')
         verifylist = [
-            ('user', identity_fakes.user_name),
+            ('user', self.user.name),
             ('group', None),
             ('system', 'all'),
             ('domain', None),
             ('project', None),
-            ('role', identity_fakes.role_name),
+            ('role', self.role.name),
             ('inherited', self._is_inheritance_testcase()),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -125,32 +192,36 @@ class TestRoleAdd(TestRole):
 
         # Set expected values
         kwargs = {
-            'user': identity_fakes.user_id,
             'system': 'all',
-            'os_inherit_extension_inherited': self._is_inheritance_testcase(),
+            'user': self.user.id,
+            'role': self.role.id,
         }
-        # RoleManager.grant(role, user=, group=, domain=, project=)
-        self.roles_mock.grant.assert_called_with(
-            identity_fakes.role_id, **kwargs
+        self.identity_sdk_client.assign_system_role_to_user.assert_called_with(
+            **kwargs
         )
         self.assertIsNone(result)
 
+        if self._is_inheritance_testcase():
+            mock_warning.assert_called_with(
+                "'--inherited' was given, which is not supported when adding a system role; this will be an error in a future release"
+            )
+
     def test_role_add_user_domain(self):
         arglist = [
             '--user',
-            identity_fakes.user_name,
+            self.user.name,
             '--domain',
-            identity_fakes.domain_name,
-            identity_fakes.role_name,
+            self.domain.name,
+            self.role.name,
         ]
         if self._is_inheritance_testcase():
             arglist.append('--inherited')
         verifylist = [
-            ('user', identity_fakes.user_name),
+            ('user', self.user.name),
             ('group', None),
-            ('domain', identity_fakes.domain_name),
+            ('domain', self.domain.name),
             ('project', None),
-            ('role', identity_fakes.role_name),
+            ('role', self.role.name),
             ('inherited', self._is_inheritance_testcase()),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -159,32 +230,32 @@ class TestRoleAdd(TestRole):
 
         # Set expected values
         kwargs = {
-            'user': identity_fakes.user_id,
-            'domain': identity_fakes.domain_id,
-            'os_inherit_extension_inherited': self._is_inheritance_testcase(),
+            'domain': self.domain.id,
+            'user': self.user.id,
+            'role': self.role.id,
+            'inherited': self._is_inheritance_testcase(),
         }
-        # RoleManager.grant(role, user=, group=, domain=, project=)
-        self.roles_mock.grant.assert_called_with(
-            identity_fakes.role_id, **kwargs
+        self.identity_sdk_client.assign_domain_role_to_user.assert_called_with(
+            **kwargs
         )
         self.assertIsNone(result)
 
     def test_role_add_user_project(self):
         arglist = [
             '--user',
-            identity_fakes.user_name,
+            self.user.name,
             '--project',
-            identity_fakes.project_name,
-            identity_fakes.role_name,
+            self.project.name,
+            self.role.name,
         ]
         if self._is_inheritance_testcase():
             arglist.append('--inherited')
         verifylist = [
-            ('user', identity_fakes.user_name),
+            ('user', self.user.name),
             ('group', None),
             ('domain', None),
-            ('project', identity_fakes.project_name),
-            ('role', identity_fakes.role_name),
+            ('project', self.project.name),
+            ('role', self.role.name),
             ('inherited', self._is_inheritance_testcase()),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -193,33 +264,34 @@ class TestRoleAdd(TestRole):
 
         # Set expected values
         kwargs = {
-            'user': identity_fakes.user_id,
-            'project': identity_fakes.project_id,
-            'os_inherit_extension_inherited': self._is_inheritance_testcase(),
+            'project': self.project.id,
+            'user': self.user.id,
+            'role': self.role.id,
+            'inherited': self._is_inheritance_testcase(),
         }
-        # RoleManager.grant(role, user=, group=, domain=, project=)
-        self.roles_mock.grant.assert_called_with(
-            identity_fakes.role_id, **kwargs
+        self.identity_sdk_client.assign_project_role_to_user.assert_called_with(
+            **kwargs
         )
         self.assertIsNone(result)
 
-    def test_role_add_group_system(self):
+    @mock.patch.object(role.LOG, 'warning')
+    def test_role_add_group_system(self, mock_warning):
         arglist = [
             '--group',
-            identity_fakes.group_name,
+            self.group.name,
             '--system',
             'all',
-            identity_fakes.role_name,
+            self.role.name,
         ]
         if self._is_inheritance_testcase():
             arglist.append('--inherited')
         verifylist = [
             ('user', None),
-            ('group', identity_fakes.group_name),
+            ('group', self.group.name),
             ('system', 'all'),
             ('domain', None),
             ('project', None),
-            ('role', identity_fakes.role_name),
+            ('role', self.role.name),
             ('inherited', self._is_inheritance_testcase()),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -228,32 +300,36 @@ class TestRoleAdd(TestRole):
 
         # Set expected values
         kwargs = {
-            'group': identity_fakes.group_id,
             'system': 'all',
-            'os_inherit_extension_inherited': self._is_inheritance_testcase(),
+            'group': self.group.id,
+            'role': self.role.id,
         }
-        # RoleManager.grant(role, user=, group=, domain=, project=)
-        self.roles_mock.grant.assert_called_with(
-            identity_fakes.role_id, **kwargs
+        self.identity_sdk_client.assign_system_role_to_group.assert_called_with(
+            **kwargs
         )
         self.assertIsNone(result)
 
+        if self._is_inheritance_testcase():
+            mock_warning.assert_called_with(
+                "'--inherited' was given, which is not supported when adding a system role; this will be an error in a future release"
+            )
+
     def test_role_add_group_domain(self):
         arglist = [
             '--group',
-            identity_fakes.group_name,
+            self.group.name,
             '--domain',
-            identity_fakes.domain_name,
-            identity_fakes.role_name,
+            self.domain.name,
+            self.role.name,
         ]
         if self._is_inheritance_testcase():
             arglist.append('--inherited')
         verifylist = [
             ('user', None),
-            ('group', identity_fakes.group_name),
-            ('domain', identity_fakes.domain_name),
+            ('group', self.group.name),
+            ('domain', self.domain.name),
             ('project', None),
-            ('role', identity_fakes.role_name),
+            ('role', self.role.name),
             ('inherited', self._is_inheritance_testcase()),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -262,32 +338,32 @@ class TestRoleAdd(TestRole):
 
         # Set expected values
         kwargs = {
-            'group': identity_fakes.group_id,
-            'domain': identity_fakes.domain_id,
-            'os_inherit_extension_inherited': self._is_inheritance_testcase(),
+            'domain': self.domain.id,
+            'group': self.group.id,
+            'role': self.role.id,
+            'inherited': self._is_inheritance_testcase(),
         }
-        # RoleManager.grant(role, user=, group=, domain=, project=)
-        self.roles_mock.grant.assert_called_with(
-            identity_fakes.role_id, **kwargs
+        self.identity_sdk_client.assign_domain_role_to_group.assert_called_with(
+            **kwargs
         )
         self.assertIsNone(result)
 
     def test_role_add_group_project(self):
         arglist = [
             '--group',
-            identity_fakes.group_name,
+            self.group.name,
             '--project',
-            identity_fakes.project_name,
-            identity_fakes.role_name,
+            self.project.name,
+            self.role.name,
         ]
         if self._is_inheritance_testcase():
             arglist.append('--inherited')
         verifylist = [
             ('user', None),
-            ('group', identity_fakes.group_name),
+            ('group', self.group.name),
             ('domain', None),
-            ('project', identity_fakes.project_name),
-            ('role', identity_fakes.role_name),
+            ('project', self.project.name),
+            ('role', self.role.name),
             ('inherited', self._is_inheritance_testcase()),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -296,39 +372,36 @@ class TestRoleAdd(TestRole):
 
         # Set expected values
         kwargs = {
-            'group': identity_fakes.group_id,
-            'project': identity_fakes.project_id,
-            'os_inherit_extension_inherited': self._is_inheritance_testcase(),
+            'project': self.project.id,
+            'group': self.group.id,
+            'role': self.role.id,
+            'inherited': self._is_inheritance_testcase(),
         }
-        # RoleManager.grant(role, user=, group=, domain=, project=)
-        self.roles_mock.grant.assert_called_with(
-            identity_fakes.role_id, **kwargs
+        self.identity_sdk_client.assign_project_role_to_group.assert_called_with(
+            **kwargs
         )
         self.assertIsNone(result)
 
     def test_role_add_domain_role_on_user_project(self):
-        self.roles_mock.get.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.ROLE_2),
-            loaded=True,
-        )
+        self.identity_sdk_client.find_role.return_value = self.role_with_domain
+
         arglist = [
             '--user',
-            identity_fakes.user_name,
+            self.user.name,
             '--project',
-            identity_fakes.project_name,
+            self.project.name,
             '--role-domain',
-            identity_fakes.domain_name,
-            identity_fakes.ROLE_2['name'],
+            self.domain.name,
+            self.role_with_domain.name,
         ]
         if self._is_inheritance_testcase():
             arglist.append('--inherited')
         verifylist = [
-            ('user', identity_fakes.user_name),
+            ('user', self.user.name),
             ('group', None),
             ('domain', None),
-            ('project', identity_fakes.project_name),
-            ('role', identity_fakes.ROLE_2['name']),
+            ('project', self.project.name),
+            ('role', self.role_with_domain.name),
             ('inherited', self._is_inheritance_testcase()),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -337,26 +410,26 @@ class TestRoleAdd(TestRole):
 
         # Set expected values
         kwargs = {
-            'user': identity_fakes.user_id,
-            'project': identity_fakes.project_id,
-            'os_inherit_extension_inherited': self._is_inheritance_testcase(),
+            'project': self.project.id,
+            'user': self.user.id,
+            'role': self.role_with_domain.id,
+            'inherited': self._is_inheritance_testcase(),
         }
-        # RoleManager.grant(role, user=, group=, domain=, project=)
-        self.roles_mock.grant.assert_called_with(
-            identity_fakes.ROLE_2['id'], **kwargs
+        self.identity_sdk_client.assign_project_role_to_user.assert_called_with(
+            **kwargs
         )
         self.assertIsNone(result)
 
     def test_role_add_with_error(self):
         arglist = [
-            identity_fakes.role_name,
+            self.role.name,
         ]
         verifylist = [
             ('user', None),
             ('group', None),
             ('domain', None),
             ('project', None),
-            ('role', identity_fakes.role_name),
+            ('role', self.role.name),
             ('inherited', False),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -369,31 +442,47 @@ class TestRoleAddInherited(TestRoleAdd, TestRoleInherited):
     pass
 
 
-class TestRoleCreate(TestRole):
+class TestRoleCreate(identity_fakes.TestIdentityv3):
+    collist = ('id', 'name', 'domain_id', 'description')
+    domain = sdk_fakes.generate_fake_resource(_domain.Domain)
+
     def setUp(self):
         super().setUp()
 
-        self.domains_mock.get.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.DOMAIN),
-            loaded=True,
+        self.role = sdk_fakes.generate_fake_resource(
+            resource_type=_role.Role,
+            domain_id=None,
+            description=None,
         )
-
-        self.roles_mock.create.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.ROLE),
-            loaded=True,
+        self.role_with_domain = sdk_fakes.generate_fake_resource(
+            resource_type=_role.Role,
+            domain_id=self.domain.id,
+            description=None,
+        )
+        self.role_with_description = sdk_fakes.generate_fake_resource(
+            resource_type=_role.Role,
+            domain_id=None,
+            description='role description',
         )
+        self.role_with_immutable_option = sdk_fakes.generate_fake_resource(
+            resource_type=_role.Role,
+            domain_id=None,
+            description=None,
+            options={'immutable': True},
+        )
+        self.identity_sdk_client.find_domain.return_value = self.domain
 
         # Get the command object to test
         self.cmd = role.CreateRole(self.app, None)
 
     def test_role_create_no_options(self):
+        self.identity_sdk_client.create_role.return_value = self.role
+
         arglist = [
-            identity_fakes.role_name,
+            self.role.name,
         ]
         verifylist = [
-            ('name', identity_fakes.role_name),
+            ('name', self.role.name),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
 
@@ -404,39 +493,34 @@ class TestRoleCreate(TestRole):
 
         # Set expected values
         kwargs = {
-            'domain': None,
-            'name': identity_fakes.role_name,
-            'description': None,
+            'name': self.role.name,
             'options': {},
         }
 
-        # RoleManager.create(name=, domain=)
-        self.roles_mock.create.assert_called_with(**kwargs)
+        self.identity_sdk_client.create_role.assert_called_with(**kwargs)
 
-        collist = ('domain', 'id', 'name')
-        self.assertEqual(collist, columns)
+        self.assertEqual(self.collist, columns)
         datalist = (
+            self.role.id,
+            self.role.name,
+            None,
             None,
-            identity_fakes.role_id,
-            identity_fakes.role_name,
         )
         self.assertEqual(datalist, data)
 
     def test_role_create_with_domain(self):
-        self.roles_mock.create.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.ROLE_2),
-            loaded=True,
+        self.identity_sdk_client.create_role.return_value = (
+            self.role_with_domain
         )
 
         arglist = [
             '--domain',
-            identity_fakes.domain_name,
-            identity_fakes.ROLE_2['name'],
+            self.domain.name,
+            self.role_with_domain.name,
         ]
         verifylist = [
-            ('domain', identity_fakes.domain_name),
-            ('name', identity_fakes.ROLE_2['name']),
+            ('domain', self.domain.name),
+            ('name', self.role_with_domain.name),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
 
@@ -447,38 +531,35 @@ class TestRoleCreate(TestRole):
 
         # Set expected values
         kwargs = {
-            'domain': identity_fakes.domain_id,
-            'name': identity_fakes.ROLE_2['name'],
-            'description': None,
+            'domain_id': self.domain.id,
+            'name': self.role_with_domain.name,
             'options': {},
         }
 
-        # RoleManager.create(name=, domain=)
-        self.roles_mock.create.assert_called_with(**kwargs)
+        self.identity_sdk_client.create_role.assert_called_with(**kwargs)
 
-        collist = ('domain', 'id', 'name')
-        self.assertEqual(collist, columns)
+        self.assertEqual(self.collist, columns)
         datalist = (
-            identity_fakes.domain_id,
-            identity_fakes.ROLE_2['id'],
-            identity_fakes.ROLE_2['name'],
+            self.role_with_domain.id,
+            self.role_with_domain.name,
+            self.domain.id,
+            None,
         )
         self.assertEqual(datalist, data)
 
     def test_role_create_with_description(self):
-        self.roles_mock.create.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.ROLE_2),
-            loaded=True,
+        self.identity_sdk_client.create_role.return_value = (
+            self.role_with_description
         )
+
         arglist = [
             '--description',
-            identity_fakes.role_description,
-            identity_fakes.ROLE_2['name'],
+            self.role_with_description.description,
+            self.role_with_description.name,
         ]
         verifylist = [
-            ('description', identity_fakes.role_description),
-            ('name', identity_fakes.ROLE_2['name']),
+            ('description', self.role_with_description.description),
+            ('name', self.role_with_description.name),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
 
@@ -489,37 +570,32 @@ class TestRoleCreate(TestRole):
 
         # Set expected values
         kwargs = {
-            'description': identity_fakes.role_description,
-            'name': identity_fakes.ROLE_2['name'],
-            'domain': None,
+            'name': self.role_with_description.name,
+            'description': self.role_with_description.description,
             'options': {},
         }
 
-        # RoleManager.create(name=, domain=)
-        self.roles_mock.create.assert_called_with(**kwargs)
+        self.identity_sdk_client.create_role.assert_called_with(**kwargs)
 
-        collist = ('domain', 'id', 'name')
-        self.assertEqual(collist, columns)
+        self.assertEqual(self.collist, columns)
         datalist = (
-            'd1',
-            identity_fakes.ROLE_2['id'],
-            identity_fakes.ROLE_2['name'],
+            self.role_with_description.id,
+            self.role_with_description.name,
+            None,
+            self.role_with_description.description,
         )
         self.assertEqual(datalist, data)
 
     def test_role_create_with_immutable_option(self):
-        self.roles_mock.create.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.ROLE_2),
-            loaded=True,
-        )
+        self.identity_sdk_client.create_role.return_value = self.role
+
         arglist = [
             '--immutable',
-            identity_fakes.ROLE_2['name'],
+            self.role.name,
         ]
         verifylist = [
             ('immutable', True),
-            ('name', identity_fakes.ROLE_2['name']),
+            ('name', self.role.name),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
 
@@ -531,36 +607,30 @@ class TestRoleCreate(TestRole):
         # Set expected values
         kwargs = {
             'options': {'immutable': True},
-            'description': None,
-            'name': identity_fakes.ROLE_2['name'],
-            'domain': None,
+            'name': self.role.name,
         }
 
-        # RoleManager.create(name=, domain=)
-        self.roles_mock.create.assert_called_with(**kwargs)
+        self.identity_sdk_client.create_role.assert_called_with(**kwargs)
 
-        collist = ('domain', 'id', 'name')
-        self.assertEqual(collist, columns)
+        self.assertEqual(self.collist, columns)
         datalist = (
-            'd1',
-            identity_fakes.ROLE_2['id'],
-            identity_fakes.ROLE_2['name'],
+            self.role.id,
+            self.role.name,
+            None,
+            None,
         )
         self.assertEqual(datalist, data)
 
     def test_role_create_with_no_immutable_option(self):
-        self.roles_mock.create.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.ROLE_2),
-            loaded=True,
-        )
+        self.identity_sdk_client.create_role.return_value = self.role
+
         arglist = [
             '--no-immutable',
-            identity_fakes.ROLE_2['name'],
+            self.role.name,
         ]
         verifylist = [
             ('no_immutable', True),
-            ('name', identity_fakes.ROLE_2['name']),
+            ('name', self.role.name),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
 
@@ -572,88 +642,94 @@ class TestRoleCreate(TestRole):
         # Set expected values
         kwargs = {
             'options': {'immutable': False},
-            'description': None,
-            'name': identity_fakes.ROLE_2['name'],
-            'domain': None,
+            'name': self.role.name,
         }
 
-        # RoleManager.create(name=, domain=)
-        self.roles_mock.create.assert_called_with(**kwargs)
+        self.identity_sdk_client.create_role.assert_called_with(**kwargs)
 
-        collist = ('domain', 'id', 'name')
-        self.assertEqual(collist, columns)
+        self.assertEqual(self.collist, columns)
         datalist = (
-            'd1',
-            identity_fakes.ROLE_2['id'],
-            identity_fakes.ROLE_2['name'],
+            self.role.id,
+            self.role.name,
+            None,
+            None,
         )
         self.assertEqual(datalist, data)
 
 
-class TestRoleDelete(TestRole):
+class TestRoleDelete(identity_fakes.TestIdentityv3):
     def setUp(self):
         super().setUp()
 
-        self.roles_mock.get.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.ROLE),
-            loaded=True,
-        )
-        self.roles_mock.delete.return_value = None
-
         # Get the command object to test
         self.cmd = role.DeleteRole(self.app, None)
 
     def test_role_delete_no_options(self):
+        self.role = sdk_fakes.generate_fake_resource(
+            resource_type=_role.Role,
+            domain_id=None,
+            description=None,
+        )
+        self.identity_sdk_client.find_role.return_value = self.role
+        self.identity_sdk_client.delete_role.return_value = None
+
         arglist = [
-            identity_fakes.role_name,
+            self.role.name,
         ]
         verifylist = [
-            ('roles', [identity_fakes.role_name]),
+            ('roles', [self.role.name]),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
 
         result = self.cmd.take_action(parsed_args)
 
-        self.roles_mock.delete.assert_called_with(
-            identity_fakes.role_id,
+        self.identity_sdk_client.delete_role.assert_called_with(
+            role=self.role.id,
+            ignore_missing=False,
         )
         self.assertIsNone(result)
 
     def test_role_delete_with_domain(self):
-        self.roles_mock.get.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.ROLE_2),
-            loaded=True,
+        self.domain = sdk_fakes.generate_fake_resource(_domain.Domain)
+        self.role_with_domain = sdk_fakes.generate_fake_resource(
+            resource_type=_role.Role,
+            domain_id=self.domain.id,
+            description=None,
         )
-        self.roles_mock.delete.return_value = None
+        self.identity_sdk_client.find_role.return_value = self.role_with_domain
+        self.identity_sdk_client.delete_role.return_value = None
 
         arglist = [
             '--domain',
-            identity_fakes.domain_name,
-            identity_fakes.ROLE_2['name'],
+            self.domain.name,
+            self.role_with_domain.name,
         ]
         verifylist = [
-            ('roles', [identity_fakes.ROLE_2['name']]),
-            ('domain', identity_fakes.domain_name),
+            ('roles', [self.role_with_domain.name]),
+            ('domain', self.domain.name),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
 
         result = self.cmd.take_action(parsed_args)
 
-        self.roles_mock.delete.assert_called_with(
-            identity_fakes.ROLE_2['id'],
+        self.identity_sdk_client.delete_role.assert_called_with(
+            role=self.role_with_domain.id,
+            ignore_missing=False,
         )
         self.assertIsNone(result)
 
-    @mock.patch.object(utils, 'find_resource')
-    def test_delete_multi_roles_with_exception(self, find_mock):
-        find_mock.side_effect = [
-            self.roles_mock.get.return_value,
-            exceptions.CommandError,
+    def test_delete_multi_roles_with_exception(self):
+        self.role = sdk_fakes.generate_fake_resource(
+            resource_type=_role.Role,
+            domain_id=None,
+            description=None,
+        )
+        self.identity_sdk_client.find_role.side_effect = [
+            self.role,
+            sdk_exc.ResourceNotFound,
         ]
         arglist = [
-            identity_fakes.role_name,
+            self.role.id,
             'unexist_role',
         ]
         verifylist = [
@@ -667,44 +743,62 @@ class TestRoleDelete(TestRole):
         except exceptions.CommandError as e:
             self.assertEqual('1 of 2 roles failed to delete.', str(e))
 
-        find_mock.assert_any_call(
-            self.roles_mock, identity_fakes.role_name, domain_id=None
-        )
-        find_mock.assert_any_call(
-            self.roles_mock, 'unexist_role', domain_id=None
+        self.identity_sdk_client.find_role.assert_has_calls(
+            [
+                mock.call(
+                    name_or_id=self.role.id,
+                    ignore_missing=False,
+                    domain_id=None,
+                ),
+                mock.call(
+                    name_or_id='unexist_role',
+                    ignore_missing=False,
+                    domain_id=None,
+                ),
+            ]
         )
 
-        self.assertEqual(2, find_mock.call_count)
-        self.roles_mock.delete.assert_called_once_with(identity_fakes.role_id)
+        self.assertEqual(2, self.identity_sdk_client.find_role.call_count)
+        self.identity_sdk_client.delete_role.assert_called_once_with(
+            role=self.role.id, ignore_missing=False
+        )
 
 
-class TestRoleList(TestRole):
+class TestRoleList(identity_fakes.TestIdentityv3):
     columns = (
         'ID',
         'Name',
     )
-    datalist = (
-        (
-            identity_fakes.role_id,
-            identity_fakes.role_name,
-        ),
-    )
+    domain = sdk_fakes.generate_fake_resource(_domain.Domain)
 
     def setUp(self):
         super().setUp()
 
-        self.roles_mock.list.return_value = [
-            fakes.FakeResource(
-                None,
-                copy.deepcopy(identity_fakes.ROLE),
-                loaded=True,
-            ),
+        self.role = sdk_fakes.generate_fake_resource(
+            resource_type=_role.Role,
+            domain_id=None,
+            description=None,
+        )
+        self.role_with_domain = sdk_fakes.generate_fake_resource(
+            resource_type=_role.Role,
+            domain_id=self.domain.id,
+            description=None,
+        )
+        self.identity_sdk_client.roles.return_value = [
+            self.role,
+            self.role_with_domain,
         ]
+        self.identity_sdk_client.find_domain.return_value = self.domain
 
-        self.domains_mock.get.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.DOMAIN),
-            loaded=True,
+        self.datalist = (
+            (
+                self.role.id,
+                self.role.name,
+            ),
+            (
+                self.role_with_domain.id,
+                self.role_with_domain.name,
+            ),
         )
 
         # Get the command object to test
@@ -720,25 +814,19 @@ class TestRoleList(TestRole):
         # containing the data to be listed.
         columns, data = self.cmd.take_action(parsed_args)
 
-        self.roles_mock.list.assert_called_with()
+        self.identity_sdk_client.roles.assert_called_with()
 
         self.assertEqual(self.columns, columns)
         self.assertEqual(self.datalist, tuple(data))
 
     def test_role_list_domain_role(self):
-        self.roles_mock.list.return_value = [
-            fakes.FakeResource(
-                None,
-                copy.deepcopy(identity_fakes.ROLE_2),
-                loaded=True,
-            ),
-        ]
+        self.identity_sdk_client.roles.return_value = [self.role_with_domain]
         arglist = [
             '--domain',
-            identity_fakes.domain_name,
+            self.domain.name,
         ]
         verifylist = [
-            ('domain', identity_fakes.domain_name),
+            ('domain', self.domain.name),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
 
@@ -748,56 +836,51 @@ class TestRoleList(TestRole):
         columns, data = self.cmd.take_action(parsed_args)
 
         # Set expected values
-        kwargs = {'domain_id': identity_fakes.domain_id}
-        # RoleManager.list(user=, group=, domain=, project=, **kwargs)
-        self.roles_mock.list.assert_called_with(**kwargs)
+        kwargs = {'domain_id': self.domain.id}
+        self.identity_sdk_client.roles.assert_called_with(**kwargs)
 
         collist = ('ID', 'Name', 'Domain')
         self.assertEqual(collist, columns)
         datalist = (
             (
-                identity_fakes.ROLE_2['id'],
-                identity_fakes.ROLE_2['name'],
-                identity_fakes.domain_name,
+                self.role_with_domain.id,
+                self.role_with_domain.name,
+                self.domain.name,
             ),
         )
         self.assertEqual(datalist, tuple(data))
 
 
-class TestRoleRemove(TestRole):
-    def setUp(self):
-        super().setUp()
+class TestRoleRemove(identity_fakes.TestIdentityv3):
+    def _is_inheritance_testcase(self):
+        return False
 
-        self.users_mock.get.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.USER),
-            loaded=True,
-        )
+    user = sdk_fakes.generate_fake_resource(_user.User)
+    group = sdk_fakes.generate_fake_resource(_group.Group)
+    domain = sdk_fakes.generate_fake_resource(_domain.Domain)
+    project = sdk_fakes.generate_fake_resource(_project.Project)
+    system = sdk_fakes.generate_fake_resource(_system.System)
 
-        self.groups_mock.get.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.GROUP),
-            loaded=True,
-        )
+    def setUp(self):
+        super().setUp()
 
-        self.domains_mock.get.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.DOMAIN),
-            loaded=True,
+        self.role = sdk_fakes.generate_fake_resource(
+            resource_type=_role.Role,
+            domain_id=None,
+            description=None,
         )
+        self.identity_sdk_client.find_role.return_value = self.role
+        self.identity_sdk_client.find_user.return_value = self.user
+        self.identity_sdk_client.find_group.return_value = self.group
+        self.identity_sdk_client.find_domain.return_value = self.domain
+        self.identity_sdk_client.find_project.return_value = self.project
 
-        self.projects_mock.get.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.PROJECT),
-            loaded=True,
-        )
-
-        self.roles_mock.get.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.ROLE),
-            loaded=True,
-        )
-        self.roles_mock.revoke.return_value = None
+        self.identity_sdk_client.unassign_domain_role_from_user.return_value = None
+        self.identity_sdk_client.unassign_domain_role_from_group.return_value = None
+        self.identity_sdk_client.unassign_project_role_from_user.return_value = None
+        self.identity_sdk_client.unassign_project_role_from_group.return_value = None
+        self.identity_sdk_client.unassign_system_role_from_user.return_value = None
+        self.identity_sdk_client.unassign_system_role_from_group.return_value = None
 
         # Get the command object to test
         self.cmd = role.RemoveRole(self.app, None)
@@ -805,20 +888,20 @@ class TestRoleRemove(TestRole):
     def test_role_remove_user_system(self):
         arglist = [
             '--user',
-            identity_fakes.user_name,
+            self.user.name,
             '--system',
             'all',
-            identity_fakes.role_name,
+            self.role.name,
         ]
         if self._is_inheritance_testcase():
             arglist.append('--inherited')
         verifylist = [
-            ('user', identity_fakes.user_name),
+            ('user', self.user.name),
             ('group', None),
             ('system', 'all'),
             ('domain', None),
             ('project', None),
-            ('role', identity_fakes.role_name),
+            ('role', self.role.name),
             ('inherited', self._is_inheritance_testcase()),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -827,40 +910,39 @@ class TestRoleRemove(TestRole):
 
         # Set expected values
         kwargs = {
-            'user': identity_fakes.user_id,
+            'user': self.user.id,
             'system': 'all',
-            'os_inherit_extension_inherited': self._is_inheritance_testcase(),
+            'role': self.role.id,
         }
-        # RoleManager.revoke(role, user=, group=, domain=, project=)
-        self.roles_mock.revoke.assert_called_with(
-            identity_fakes.role_id, **kwargs
+        self.identity_sdk_client.unassign_system_role_from_user.assert_called_with(
+            **kwargs
         )
         self.assertIsNone(result)
 
-    @mock.patch.object(common, 'find_user')
-    def test_role_remove_non_existent_user_system(self, find_mock):
-        # Simulate the user not being in keystone, the client should gracefully
+    def test_role_remove_non_existent_user_system(self):
+        # Simulate the user not being in keystone; the client should gracefully
         # handle this exception and send the request to remove the role since
         # keystone supports removing role assignments with non-existent actors
         # (e.g., users or groups).
-        find_mock.side_effect = exceptions.CommandError
-
+        self.identity_sdk_client.find_user.side_effect = [
+            sdk_exc.ResourceNotFound,
+        ]
         arglist = [
             '--user',
-            identity_fakes.user_id,
+            self.user.id,
             '--system',
             'all',
-            identity_fakes.role_name,
+            self.role.name,
         ]
         if self._is_inheritance_testcase():
             arglist.append('--inherited')
         verifylist = [
-            ('user', identity_fakes.user_id),
+            ('user', self.user.id),
             ('group', None),
             ('system', 'all'),
             ('domain', None),
             ('project', None),
-            ('role', identity_fakes.role_name),
+            ('role', self.role.name),
             ('inherited', self._is_inheritance_testcase()),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -869,32 +951,31 @@ class TestRoleRemove(TestRole):
 
         # Set expected values
         kwargs = {
-            'user': identity_fakes.user_id,
+            'user': self.user.id,
             'system': 'all',
-            'os_inherit_extension_inherited': self._is_inheritance_testcase(),
+            'role': self.role.id,
         }
-        # RoleManager.revoke(role, user=, group=, domain=, project=)
-        self.roles_mock.revoke.assert_called_with(
-            identity_fakes.role_id, **kwargs
+        self.identity_sdk_client.unassign_system_role_from_user.assert_called_with(
+            **kwargs
         )
         self.assertIsNone(result)
 
     def test_role_remove_user_domain(self):
         arglist = [
             '--user',
-            identity_fakes.user_name,
+            self.user.name,
             '--domain',
-            identity_fakes.domain_name,
-            identity_fakes.role_name,
+            self.domain.name,
+            self.role.name,
         ]
         if self._is_inheritance_testcase():
             arglist.append('--inherited')
         verifylist = [
-            ('user', identity_fakes.user_name),
+            ('user', self.user.name),
             ('group', None),
-            ('domain', identity_fakes.domain_name),
+            ('domain', self.domain.name),
             ('project', None),
-            ('role', identity_fakes.role_name),
+            ('role', self.role.name),
             ('inherited', self._is_inheritance_testcase()),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -903,39 +984,39 @@ class TestRoleRemove(TestRole):
 
         # Set expected values
         kwargs = {
-            'user': identity_fakes.user_id,
-            'domain': identity_fakes.domain_id,
-            'os_inherit_extension_inherited': self._is_inheritance_testcase(),
+            'user': self.user.id,
+            'domain': self.domain.id,
+            'role': self.role.id,
+            'inherited': self._is_inheritance_testcase(),
         }
-        # RoleManager.revoke(role, user=, group=, domain=, project=)
-        self.roles_mock.revoke.assert_called_with(
-            identity_fakes.role_id, **kwargs
+        self.identity_sdk_client.unassign_domain_role_from_user.assert_called_with(
+            **kwargs
         )
         self.assertIsNone(result)
 
-    @mock.patch.object(common, 'find_user')
-    def test_role_remove_non_existent_user_domain(self, find_mock):
+    def test_role_remove_non_existent_user_domain(self):
         # Simulate the user not being in keystone, the client the gracefully
         # handle this exception and send the request to remove the role since
         # keystone will validate.
-        find_mock.side_effect = exceptions.CommandError
-
+        self.identity_sdk_client.find_user.side_effect = [
+            sdk_exc.ResourceNotFound,
+        ]
         arglist = [
             '--user',
-            identity_fakes.user_id,
+            self.user.id,
             '--domain',
-            identity_fakes.domain_name,
-            identity_fakes.role_name,
+            self.domain.name,
+            self.role.name,
         ]
         if self._is_inheritance_testcase():
             arglist.append('--inherited')
         verifylist = [
-            ('user', identity_fakes.user_id),
+            ('user', self.user.id),
             ('group', None),
             ('system', None),
-            ('domain', identity_fakes.domain_name),
+            ('domain', self.domain.name),
             ('project', None),
-            ('role', identity_fakes.role_name),
+            ('role', self.role.name),
             ('inherited', self._is_inheritance_testcase()),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -944,32 +1025,32 @@ class TestRoleRemove(TestRole):
 
         # Set expected values
         kwargs = {
-            'user': identity_fakes.user_id,
-            'domain': identity_fakes.domain_id,
-            'os_inherit_extension_inherited': self._is_inheritance_testcase(),
+            'user': self.user.id,
+            'domain': self.domain.id,
+            'role': self.role.id,
+            'inherited': self._is_inheritance_testcase(),
         }
-        # RoleManager.revoke(role, user=, group=, domain=, project=)
-        self.roles_mock.revoke.assert_called_with(
-            identity_fakes.role_id, **kwargs
+        self.identity_sdk_client.unassign_domain_role_from_user.assert_called_with(
+            **kwargs
         )
         self.assertIsNone(result)
 
     def test_role_remove_user_project(self):
         arglist = [
             '--user',
-            identity_fakes.user_name,
+            self.user.name,
             '--project',
-            identity_fakes.project_name,
-            identity_fakes.role_name,
+            self.project.name,
+            self.role.name,
         ]
         if self._is_inheritance_testcase():
             arglist.append('--inherited')
         verifylist = [
-            ('user', identity_fakes.user_name),
+            ('user', self.user.name),
             ('group', None),
             ('domain', None),
-            ('project', identity_fakes.project_name),
-            ('role', identity_fakes.role_name),
+            ('project', self.project.name),
+            ('role', self.role.name),
             ('inherited', self._is_inheritance_testcase()),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -978,39 +1059,40 @@ class TestRoleRemove(TestRole):
 
         # Set expected values
         kwargs = {
-            'user': identity_fakes.user_id,
-            'project': identity_fakes.project_id,
-            'os_inherit_extension_inherited': self._is_inheritance_testcase(),
+            'user': self.user.id,
+            'project': self.project.id,
+            'role': self.role.id,
+            'inherited': self._is_inheritance_testcase(),
         }
-        # RoleManager.revoke(role, user=, group=, domain=, project=)
-        self.roles_mock.revoke.assert_called_with(
-            identity_fakes.role_id, **kwargs
+        self.identity_sdk_client.unassign_project_role_from_user.assert_called_with(
+            **kwargs
         )
         self.assertIsNone(result)
 
-    @mock.patch.object(common, 'find_user')
-    def test_role_remove_non_existent_user_project(self, find_mock):
+    def test_role_remove_non_existent_user_project(self):
         # Simulate the user not being in keystone, the client the gracefully
         # handle this exception and send the request to remove the role since
         # keystone will validate.
-        find_mock.side_effect = exceptions.CommandError
+        self.identity_sdk_client.find_user.side_effect = [
+            sdk_exc.ResourceNotFound,
+        ]
 
         arglist = [
             '--user',
-            identity_fakes.user_id,
+            self.user.id,
             '--project',
-            identity_fakes.project_name,
-            identity_fakes.role_name,
+            self.project.name,
+            self.role.name,
         ]
         if self._is_inheritance_testcase():
             arglist.append('--inherited')
         verifylist = [
-            ('user', identity_fakes.user_id),
+            ('user', self.user.id),
             ('group', None),
             ('system', None),
             ('domain', None),
-            ('project', identity_fakes.project_name),
-            ('role', identity_fakes.role_name),
+            ('project', self.project.name),
+            ('role', self.role.name),
             ('inherited', self._is_inheritance_testcase()),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -1019,34 +1101,34 @@ class TestRoleRemove(TestRole):
 
         # Set expected values
         kwargs = {
-            'user': identity_fakes.user_id,
-            'project': identity_fakes.project_id,
-            'os_inherit_extension_inherited': self._is_inheritance_testcase(),
+            'user': self.user.id,
+            'project': self.project.id,
+            'role': self.role.id,
+            'inherited': self._is_inheritance_testcase(),
         }
-        # RoleManager.revoke(role, user=, group=, domain=, project=)
-        self.roles_mock.revoke.assert_called_with(
-            identity_fakes.role_id, **kwargs
+        self.identity_sdk_client.unassign_project_role_from_user.assert_called_with(
+            **kwargs
         )
         self.assertIsNone(result)
 
     def test_role_remove_group_system(self):
         arglist = [
             '--group',
-            identity_fakes.group_name,
+            self.group.name,
             '--system',
             'all',
-            identity_fakes.role_name,
+            self.role.name,
         ]
         if self._is_inheritance_testcase():
             arglist.append('--inherited')
         verifylist = [
             ('user', None),
-            ('group', identity_fakes.group_name),
+            ('group', self.group.name),
             ('system', 'all'),
             ('domain', None),
             ('project', None),
-            ('role', identity_fakes.role_name),
-            ('role', identity_fakes.role_name),
+            ('role', self.role.name),
+            ('role', self.role.name),
             ('inherited', self._is_inheritance_testcase()),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -1055,39 +1137,39 @@ class TestRoleRemove(TestRole):
 
         # Set expected values
         kwargs = {
-            'group': identity_fakes.group_id,
+            'group': self.group.id,
             'system': 'all',
-            'os_inherit_extension_inherited': self._is_inheritance_testcase(),
+            'role': self.role.id,
         }
-        # RoleManager.revoke(role, user=, group=, domain=, project=)
-        self.roles_mock.revoke.assert_called_with(
-            identity_fakes.role_id, **kwargs
+        self.identity_sdk_client.unassign_system_role_from_group.assert_called_with(
+            **kwargs
         )
         self.assertIsNone(result)
 
-    @mock.patch.object(common, 'find_group')
-    def test_role_remove_non_existent_group_system(self, find_mock):
+    def test_role_remove_non_existent_group_system(self):
         # Simulate the user not being in keystone, the client the gracefully
         # handle this exception and send the request to remove the role since
         # keystone will validate.
-        find_mock.side_effect = exceptions.CommandError
+        self.identity_sdk_client.find_group.side_effect = [
+            sdk_exc.ResourceNotFound,
+        ]
 
         arglist = [
             '--group',
-            identity_fakes.group_id,
+            self.group.id,
             '--system',
             'all',
-            identity_fakes.role_name,
+            self.role.name,
         ]
         if self._is_inheritance_testcase():
             arglist.append('--inherited')
         verifylist = [
             ('user', None),
-            ('group', identity_fakes.group_id),
+            ('group', self.group.id),
             ('system', 'all'),
             ('domain', None),
             ('project', None),
-            ('role', identity_fakes.role_name),
+            ('role', self.role.name),
             ('inherited', self._is_inheritance_testcase()),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -1096,33 +1178,32 @@ class TestRoleRemove(TestRole):
 
         # Set expected values
         kwargs = {
-            'group': identity_fakes.group_id,
+            'group': self.group.id,
             'system': 'all',
-            'os_inherit_extension_inherited': self._is_inheritance_testcase(),
+            'role': self.role.id,
         }
-        # RoleManager.revoke(role, user=, group=, domain=, project=)
-        self.roles_mock.revoke.assert_called_with(
-            identity_fakes.role_id, **kwargs
+        self.identity_sdk_client.unassign_system_role_from_group.assert_called_with(
+            **kwargs
         )
         self.assertIsNone(result)
 
     def test_role_remove_group_domain(self):
         arglist = [
             '--group',
-            identity_fakes.group_name,
+            self.group.name,
             '--domain',
-            identity_fakes.domain_name,
-            identity_fakes.role_name,
+            self.domain.name,
+            self.role.name,
         ]
         if self._is_inheritance_testcase():
             arglist.append('--inherited')
         verifylist = [
             ('user', None),
-            ('group', identity_fakes.group_name),
-            ('domain', identity_fakes.domain_name),
+            ('group', self.group.name),
+            ('domain', self.domain.name),
             ('project', None),
-            ('role', identity_fakes.role_name),
-            ('role', identity_fakes.role_name),
+            ('role', self.role.name),
+            ('role', self.role.name),
             ('inherited', self._is_inheritance_testcase()),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -1131,39 +1212,40 @@ class TestRoleRemove(TestRole):
 
         # Set expected values
         kwargs = {
-            'group': identity_fakes.group_id,
-            'domain': identity_fakes.domain_id,
-            'os_inherit_extension_inherited': self._is_inheritance_testcase(),
+            'group': self.group.id,
+            'domain': self.domain.id,
+            'role': self.role.id,
+            'inherited': self._is_inheritance_testcase(),
         }
-        # RoleManager.revoke(role, user=, group=, domain=, project=)
-        self.roles_mock.revoke.assert_called_with(
-            identity_fakes.role_id, **kwargs
+        self.identity_sdk_client.unassign_domain_role_from_group.assert_called_with(
+            **kwargs
         )
         self.assertIsNone(result)
 
-    @mock.patch.object(common, 'find_group')
-    def test_role_remove_non_existent_group_domain(self, find_mock):
+    def test_role_remove_non_existent_group_domain(self):
         # Simulate the user not being in keystone, the client the gracefully
         # handle this exception and send the request to remove the role since
         # keystone will validate.
-        find_mock.side_effect = exceptions.CommandError
+        self.identity_sdk_client.find_group.side_effect = [
+            sdk_exc.ResourceNotFound,
+        ]
 
         arglist = [
             '--group',
-            identity_fakes.group_id,
+            self.group.id,
             '--domain',
-            identity_fakes.domain_name,
-            identity_fakes.role_name,
+            self.domain.name,
+            self.role.name,
         ]
         if self._is_inheritance_testcase():
             arglist.append('--inherited')
         verifylist = [
             ('user', None),
-            ('group', identity_fakes.group_id),
+            ('group', self.group.id),
             ('system', None),
-            ('domain', identity_fakes.domain_name),
+            ('domain', self.domain.name),
             ('project', None),
-            ('role', identity_fakes.role_name),
+            ('role', self.role.name),
             ('inherited', self._is_inheritance_testcase()),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -1172,32 +1254,32 @@ class TestRoleRemove(TestRole):
 
         # Set expected values
         kwargs = {
-            'group': identity_fakes.group_id,
-            'domain': identity_fakes.domain_id,
-            'os_inherit_extension_inherited': self._is_inheritance_testcase(),
+            'group': self.group.id,
+            'domain': self.domain.id,
+            'role': self.role.id,
+            'inherited': self._is_inheritance_testcase(),
         }
-        # RoleManager.revoke(role, user=, group=, domain=, project=)
-        self.roles_mock.revoke.assert_called_with(
-            identity_fakes.role_id, **kwargs
+        self.identity_sdk_client.unassign_domain_role_from_group.assert_called_with(
+            **kwargs
         )
         self.assertIsNone(result)
 
     def test_role_remove_group_project(self):
         arglist = [
             '--group',
-            identity_fakes.group_name,
+            self.group.name,
             '--project',
-            identity_fakes.project_name,
-            identity_fakes.role_name,
+            self.project.name,
+            self.role.name,
         ]
         if self._is_inheritance_testcase():
             arglist.append('--inherited')
         verifylist = [
             ('user', None),
-            ('group', identity_fakes.group_name),
+            ('group', self.group.name),
             ('domain', None),
-            ('project', identity_fakes.project_name),
-            ('role', identity_fakes.role_name),
+            ('project', self.project.name),
+            ('role', self.role.name),
             ('inherited', self._is_inheritance_testcase()),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -1206,39 +1288,39 @@ class TestRoleRemove(TestRole):
 
         # Set expected values
         kwargs = {
-            'group': identity_fakes.group_id,
-            'project': identity_fakes.project_id,
-            'os_inherit_extension_inherited': self._is_inheritance_testcase(),
+            'group': self.group.id,
+            'project': self.project.id,
+            'role': self.role.id,
+            'inherited': self._is_inheritance_testcase(),
         }
-        # RoleManager.revoke(role, user=, group=, domain=, project=)
-        self.roles_mock.revoke.assert_called_with(
-            identity_fakes.role_id, **kwargs
+        self.identity_sdk_client.unassign_project_role_from_group.assert_called_with(
+            **kwargs
         )
         self.assertIsNone(result)
 
-    @mock.patch.object(common, 'find_group')
-    def test_role_remove_non_existent_group_project(self, find_mock):
+    def test_role_remove_non_existent_group_project(self):
         # Simulate the user not being in keystone, the client the gracefully
         # handle this exception and send the request to remove the role since
         # keystone will validate.
-        find_mock.side_effect = exceptions.CommandError
-
+        self.identity_sdk_client.find_group.side_effect = [
+            sdk_exc.ResourceNotFound,
+        ]
         arglist = [
             '--group',
-            identity_fakes.group_id,
+            self.group.id,
             '--project',
-            identity_fakes.project_name,
-            identity_fakes.role_name,
+            self.project.name,
+            self.role.name,
         ]
         if self._is_inheritance_testcase():
             arglist.append('--inherited')
         verifylist = [
             ('user', None),
-            ('group', identity_fakes.group_id),
+            ('group', self.group.id),
             ('system', None),
             ('domain', None),
-            ('project', identity_fakes.project_name),
-            ('role', identity_fakes.role_name),
+            ('project', self.project.name),
+            ('role', self.role.name),
             ('inherited', self._is_inheritance_testcase()),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -1247,37 +1329,38 @@ class TestRoleRemove(TestRole):
 
         # Set expected values
         kwargs = {
-            'group': identity_fakes.group_id,
-            'project': identity_fakes.project_id,
-            'os_inherit_extension_inherited': self._is_inheritance_testcase(),
+            'group': self.group.id,
+            'project': self.project.id,
+            'role': self.role.id,
+            'inherited': self._is_inheritance_testcase(),
         }
-        # RoleManager.revoke(role, user=, group=, domain=, project=)
-        self.roles_mock.revoke.assert_called_with(
-            identity_fakes.role_id, **kwargs
+        self.identity_sdk_client.unassign_project_role_from_group.assert_called_with(
+            **kwargs
         )
         self.assertIsNone(result)
 
     def test_role_remove_domain_role_on_group_domain(self):
-        self.roles_mock.get.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.ROLE_2),
-            loaded=True,
+        self.role_with_domain = sdk_fakes.generate_fake_resource(
+            resource_type=_role.Role,
+            domain_id=self.domain.id,
+            description=None,
         )
+        self.identity_sdk_client.find_role.return_value = self.role_with_domain
         arglist = [
             '--group',
-            identity_fakes.group_name,
+            self.group.name,
             '--domain',
-            identity_fakes.domain_name,
-            identity_fakes.ROLE_2['name'],
+            self.domain.name,
+            self.role_with_domain.name,
         ]
         if self._is_inheritance_testcase():
             arglist.append('--inherited')
         verifylist = [
             ('user', None),
-            ('group', identity_fakes.group_name),
-            ('domain', identity_fakes.domain_name),
+            ('group', self.group.name),
+            ('domain', self.domain.name),
             ('project', None),
-            ('role', identity_fakes.ROLE_2['name']),
+            ('role', self.role_with_domain.name),
             ('inherited', self._is_inheritance_testcase()),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -1286,26 +1369,26 @@ class TestRoleRemove(TestRole):
 
         # Set expected values
         kwargs = {
-            'group': identity_fakes.group_id,
-            'domain': identity_fakes.domain_id,
-            'os_inherit_extension_inherited': self._is_inheritance_testcase(),
+            'group': self.group.id,
+            'domain': self.domain.id,
+            'role': self.role_with_domain.id,
+            'inherited': self._is_inheritance_testcase(),
         }
-        # RoleManager.revoke(role, user=, group=, domain=, project=)
-        self.roles_mock.revoke.assert_called_with(
-            identity_fakes.ROLE_2['id'], **kwargs
+        self.identity_sdk_client.unassign_domain_role_from_group.assert_called_with(
+            **kwargs
         )
         self.assertIsNone(result)
 
     def test_role_remove_with_error(self):
         arglist = [
-            identity_fakes.role_name,
+            self.role.name,
         ]
         verifylist = [
             ('user', None),
             ('group', None),
             ('domain', None),
             ('project', None),
-            ('role', identity_fakes.role_name),
+            ('role', self.role.name),
             ('inherited', False),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
@@ -1314,29 +1397,37 @@ class TestRoleRemove(TestRole):
         )
 
 
-class TestRoleSet(TestRole):
+class TestRoleSet(identity_fakes.TestIdentityv3):
     def setUp(self):
         super().setUp()
 
-        self.roles_mock.get.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.ROLE),
-            loaded=True,
+        self.domain = sdk_fakes.generate_fake_resource(_domain.Domain)
+        self.role_with_domain = sdk_fakes.generate_fake_resource(
+            resource_type=_role.Role,
+            domain_id=self.domain.id,
+            description=None,
         )
-        self.roles_mock.update.return_value = None
 
         # Get the command object to test
         self.cmd = role.SetRole(self.app, None)
 
     def test_role_set_no_options(self):
+        self.role = sdk_fakes.generate_fake_resource(
+            resource_type=_role.Role,
+            domain_id=None,
+            description=None,
+        )
+        self.identity_sdk_client.find_role.return_value = self.role
+        self.identity_sdk_client.update_role.return_value = self.role
+
         arglist = [
             '--name',
             'over',
-            identity_fakes.role_name,
+            self.role.name,
         ]
         verifylist = [
             ('name', 'over'),
-            ('role', identity_fakes.role_name),
+            ('role', self.role.name),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
 
@@ -1345,32 +1436,32 @@ class TestRoleSet(TestRole):
         # Set expected values
         kwargs = {
             'name': 'over',
-            'description': None,
+            'role': self.role.id,
             'options': {},
         }
-        # RoleManager.update(role, name=)
-        self.roles_mock.update.assert_called_with(
-            identity_fakes.role_id, **kwargs
-        )
+        self.identity_sdk_client.update_role.assert_called_with(**kwargs)
         self.assertIsNone(result)
 
     def test_role_set_domain_role(self):
-        self.roles_mock.get.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.ROLE_2),
-            loaded=True,
+        self.domain2 = sdk_fakes.generate_fake_resource(_domain.Domain)
+        self.identity_sdk_client.find_domain.return_value = self.domain2
+
+        self.identity_sdk_client.find_role.return_value = self.role_with_domain
+        self.identity_sdk_client.update_role.return_value = (
+            self.role_with_domain
         )
+
         arglist = [
             '--name',
             'over',
             '--domain',
-            identity_fakes.domain_name,
-            identity_fakes.ROLE_2['name'],
+            self.domain2.name,
+            self.role_with_domain.name,
         ]
         verifylist = [
             ('name', 'over'),
-            ('domain', identity_fakes.domain_name),
-            ('role', identity_fakes.ROLE_2['name']),
+            ('domain', self.domain2.name),
+            ('role', self.role_with_domain.name),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
 
@@ -1379,32 +1470,27 @@ class TestRoleSet(TestRole):
         # Set expected values
         kwargs = {
             'name': 'over',
-            'description': None,
+            'role': self.role_with_domain.id,
+            'domain_id': self.domain2.id,
             'options': {},
         }
-        # RoleManager.update(role, name=)
-        self.roles_mock.update.assert_called_with(
-            identity_fakes.ROLE_2['id'], **kwargs
-        )
+        self.identity_sdk_client.update_role.assert_called_with(**kwargs)
         self.assertIsNone(result)
 
     def test_role_set_description(self):
-        self.roles_mock.get.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.ROLE_2),
-            loaded=True,
-        )
+        self.identity_sdk_client.find_role.return_value = self.role_with_domain
+
         arglist = [
             '--name',
             'over',
             '--description',
-            identity_fakes.role_description,
-            identity_fakes.ROLE_2['name'],
+            'role description',
+            self.role_with_domain.name,
         ]
         verifylist = [
             ('name', 'over'),
-            ('description', identity_fakes.role_description),
-            ('role', identity_fakes.ROLE_2['name']),
+            ('description', 'role description'),
+            ('role', self.role_with_domain.name),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
 
@@ -1413,31 +1499,26 @@ class TestRoleSet(TestRole):
         # Set expected values
         kwargs = {
             'name': 'over',
-            'description': identity_fakes.role_description,
+            'description': 'role description',
+            'role': self.role_with_domain.id,
             'options': {},
         }
-        # RoleManager.update(role, name=)
-        self.roles_mock.update.assert_called_with(
-            identity_fakes.ROLE_2['id'], **kwargs
-        )
+        self.identity_sdk_client.update_role.assert_called_with(**kwargs)
         self.assertIsNone(result)
 
     def test_role_set_with_immutable(self):
-        self.roles_mock.get.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.ROLE_2),
-            loaded=True,
-        )
+        self.identity_sdk_client.find_role.return_value = self.role_with_domain
+
         arglist = [
             '--name',
             'over',
             '--immutable',
-            identity_fakes.ROLE_2['name'],
+            self.role_with_domain.name,
         ]
         verifylist = [
             ('name', 'over'),
             ('immutable', True),
-            ('role', identity_fakes.ROLE_2['name']),
+            ('role', self.role_with_domain.name),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
 
@@ -1446,31 +1527,25 @@ class TestRoleSet(TestRole):
         # Set expected values
         kwargs = {
             'name': 'over',
-            'description': None,
+            'role': self.role_with_domain.id,
             'options': {'immutable': True},
         }
-        # RoleManager.update(role, name=)
-        self.roles_mock.update.assert_called_with(
-            identity_fakes.ROLE_2['id'], **kwargs
-        )
+        self.identity_sdk_client.update_role.assert_called_with(**kwargs)
         self.assertIsNone(result)
 
     def test_role_set_with_no_immutable(self):
-        self.roles_mock.get.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.ROLE_2),
-            loaded=True,
-        )
+        self.identity_sdk_client.find_role.return_value = self.role_with_domain
+
         arglist = [
             '--name',
             'over',
             '--no-immutable',
-            identity_fakes.ROLE_2['name'],
+            self.role_with_domain.name,
         ]
         verifylist = [
             ('name', 'over'),
             ('no_immutable', True),
-            ('role', identity_fakes.ROLE_2['name']),
+            ('role', self.role_with_domain.name),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
 
@@ -1479,35 +1554,37 @@ class TestRoleSet(TestRole):
         # Set expected values
         kwargs = {
             'name': 'over',
-            'description': None,
+            'role': self.role_with_domain.id,
             'options': {'immutable': False},
         }
-        # RoleManager.update(role, name=)
-        self.roles_mock.update.assert_called_with(
-            identity_fakes.ROLE_2['id'], **kwargs
-        )
+        self.identity_sdk_client.update_role.assert_called_with(**kwargs)
         self.assertIsNone(result)
 
 
-class TestRoleShow(TestRole):
+class TestRoleShow(identity_fakes.TestIdentityv3):
+    domain = sdk_fakes.generate_fake_resource(_domain.Domain)
+
     def setUp(self):
         super().setUp()
 
-        self.roles_mock.get.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.ROLE),
-            loaded=True,
-        )
+        self.identity_sdk_client.find_domain.return_value = self.domain
 
         # Get the command object to test
         self.cmd = role.ShowRole(self.app, None)
 
     def test_role_show(self):
+        self.role = sdk_fakes.generate_fake_resource(
+            resource_type=_role.Role,
+            domain_id=None,
+            description=None,
+        )
+        self.identity_sdk_client.find_role.return_value = self.role
+
         arglist = [
-            identity_fakes.role_name,
+            self.role.name,
         ]
         verifylist = [
-            ('role', identity_fakes.role_name),
+            ('role', self.role.name),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
 
@@ -1516,34 +1593,38 @@ class TestRoleShow(TestRole):
         # data to be shown.
         columns, data = self.cmd.take_action(parsed_args)
 
-        # RoleManager.get(role)
-        self.roles_mock.get.assert_called_with(
-            identity_fakes.role_name,
+        self.identity_sdk_client.find_role.assert_called_with(
+            name_or_id=self.role.name,
+            domain_id=None,
+            ignore_missing=False,
         )
 
-        collist = ('domain', 'id', 'name')
+        collist = ('id', 'name', 'domain_id', 'description')
         self.assertEqual(collist, columns)
         datalist = (
+            self.role.id,
+            self.role.name,
+            None,
             None,
-            identity_fakes.role_id,
-            identity_fakes.role_name,
         )
         self.assertEqual(datalist, data)
 
     def test_role_show_domain_role(self):
-        self.roles_mock.get.return_value = fakes.FakeResource(
-            None,
-            copy.deepcopy(identity_fakes.ROLE_2),
-            loaded=True,
+        self.role_with_domain = sdk_fakes.generate_fake_resource(
+            resource_type=_role.Role,
+            domain_id=self.domain.id,
+            description=None,
         )
+        self.identity_sdk_client.find_role.return_value = self.role_with_domain
+
         arglist = [
             '--domain',
-            identity_fakes.domain_name,
-            identity_fakes.ROLE_2['name'],
+            self.domain.name,
+            self.role_with_domain.id,
         ]
         verifylist = [
-            ('domain', identity_fakes.domain_name),
-            ('role', identity_fakes.ROLE_2['name']),
+            ('domain', self.domain.name),
+            ('role', self.role_with_domain.id),
         ]
         parsed_args = self.check_parser(self.cmd, arglist, verifylist)
 
@@ -1552,23 +1633,18 @@ class TestRoleShow(TestRole):
         # data to be shown.
         columns, data = self.cmd.take_action(parsed_args)
 
-        # RoleManager.get(role). This is called from utils.find_resource().
-        # In fact, the current implementation calls the get(role) first with
-        # just the name, then with the name+domain_id. So technically we should
-        # mock this out with a call list, with the first call returning None
-        # and the second returning the object. However, if we did that we are
-        # then just testing the current sequencing within the utils method, and
-        # would become brittle to changes within that method. Hence we just
-        # check for the first call which is always lookup by name.
-        self.roles_mock.get.assert_called_with(
-            identity_fakes.ROLE_2['name'],
+        self.identity_sdk_client.find_role.assert_called_with(
+            name_or_id=self.role_with_domain.id,
+            domain_id=self.domain.id,
+            ignore_missing=False,
         )
 
-        collist = ('domain', 'id', 'name')
+        collist = ('id', 'name', 'domain_id', 'description')
         self.assertEqual(collist, columns)
         datalist = (
-            identity_fakes.domain_id,
-            identity_fakes.ROLE_2['id'],
-            identity_fakes.ROLE_2['name'],
+            self.role_with_domain.id,
+            self.role_with_domain.name,
+            self.domain.id,
+            None,
         )
         self.assertEqual(datalist, data)