Move tempest_roles options to auth group

This commit moves the tempest_roles option to the auth group. This
option was previously in the identity section which was the incorrect
place for it. The identity group is used for config settings related
to keystone, while the auth section is used for tempest specific user
auth.

Change-Id: Id89c7c265b648cf31b3f2e684d4467a7c8c2f554
diff --git a/etc/tempest.conf.sample b/etc/tempest.conf.sample
index 234273b..88a56be 100644
--- a/etc/tempest.conf.sample
+++ b/etc/tempest.conf.sample
@@ -135,6 +135,9 @@
 # concurrent test processes. (boolean value)
 #locking_credentials_provider = false
 
+# Roles to assign to all users created by tempest (list value)
+#tempest_roles =
+
 
 [baremetal]
 
@@ -582,9 +585,6 @@
 # applies to user and project (string value)
 #admin_domain_name = <None>
 
-# Roles to assign to all users created by tempest (list value)
-#tempest_roles =
-
 
 [identity-feature-enabled]
 
diff --git a/tempest/common/isolated_creds.py b/tempest/common/isolated_creds.py
index e7590b7..a663931 100644
--- a/tempest/common/isolated_creds.py
+++ b/tempest/common/isolated_creds.py
@@ -124,7 +124,7 @@
             self._assign_user_role(tenant, user, swift_operator_role)
         if admin:
             self._assign_user_role(tenant, user, CONF.identity.admin_role)
-        for role in CONF.identity.tempest_roles:
+        for role in CONF.auth.tempest_roles:
             self._assign_user_role(tenant, user, role)
         return self._get_credentials(user, tenant)
 
diff --git a/tempest/config.py b/tempest/config.py
index 4858fda..d42a805 100644
--- a/tempest/config.py
+++ b/tempest/config.py
@@ -59,6 +59,9 @@
                      "It requires at least `2 * CONC` distinct accounts "
                      "configured in `test_accounts_file`, with CONC == the "
                      "number of concurrent test processes."),
+    cfg.ListOpt('tempest_roles',
+                help="Roles to assign to all users created by tempest",
+                default=[])
 ]
 
 identity_group = cfg.OptGroup(name='identity',
@@ -131,9 +134,6 @@
     cfg.StrOpt('admin_domain_name',
                help="Admin domain name for authentication (Keystone V3)."
                     "The same domain applies to user and project"),
-    cfg.ListOpt('tempest_roles',
-                help="Roles to assign to all users created by tempest",
-                default=[])
 ]
 
 identity_feature_group = cfg.OptGroup(name='identity-feature-enabled',