diff --git a/etc/tempest.conf.sample b/etc/tempest.conf.sample
index 2e1d6f3..234273b 100644
--- a/etc/tempest.conf.sample
+++ b/etc/tempest.conf.sample
@@ -582,6 +582,9 @@
 # applies to user and project (string value)
 #admin_domain_name = <None>
 
+# Roles to assign to all users created by tempest (list value)
+#tempest_roles =
+
 
 [identity-feature-enabled]
 
diff --git a/tempest/api/network/test_ports.py b/tempest/api/network/test_ports.py
index 7ab5ebd..ee0e4c8 100644
--- a/tempest/api/network/test_ports.py
+++ b/tempest/api/network/test_ports.py
@@ -13,6 +13,7 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
+import netaddr
 import socket
 
 from tempest.api.network import base
@@ -83,6 +84,34 @@
         self.assertTrue(port1['admin_state_up'])
         self.assertTrue(port2['admin_state_up'])
 
+    @classmethod
+    def _get_ipaddress_from_tempest_conf(cls):
+        """Return first subnet gateway for configured CIDR """
+        if cls._ip_version == 4:
+            cidr = netaddr.IPNetwork(CONF.network.tenant_network_cidr)
+
+        elif cls._ip_version == 6:
+            cidr = netaddr.IPNetwork(CONF.network.tenant_network_v6_cidr)
+
+        return netaddr.IPAddress(cidr)
+
+    @test.attr(type='smoke')
+    def test_create_port_in_allowed_allocation_pools(self):
+        network = self.create_network()
+        net_id = network['id']
+        address = self._get_ipaddress_from_tempest_conf()
+        allocation_pools = {'allocation_pools': [{'start': str(address + 4),
+                                                  'end': str(address + 6)}]}
+        self.create_subnet(network, **allocation_pools)
+        body = self.client.create_port(network_id=net_id)
+        self.addCleanup(self.client.delete_port, body['port']['id'])
+        port = body['port']
+        ip_address = port['fixed_ips'][0]['ip_address']
+        start_ip_address = allocation_pools['allocation_pools'][0]['start']
+        end_ip_address = allocation_pools['allocation_pools'][0]['end']
+        ip_range = netaddr.IPRange(start_ip_address, end_ip_address)
+        self.assertIn(ip_address, ip_range)
+
     @test.attr(type='smoke')
     def test_show_port(self):
         # Verify the details of port
diff --git a/tempest/common/isolated_creds.py b/tempest/common/isolated_creds.py
index f478f95..e7590b7 100644
--- a/tempest/common/isolated_creds.py
+++ b/tempest/common/isolated_creds.py
@@ -124,6 +124,8 @@
             self._assign_user_role(tenant, user, swift_operator_role)
         if admin:
             self._assign_user_role(tenant, user, CONF.identity.admin_role)
+        for role in CONF.identity.tempest_roles:
+            self._assign_user_role(tenant, user, role)
         return self._get_credentials(user, tenant)
 
     def _get_credentials(self, user, tenant):
diff --git a/tempest/common/rest_client.py b/tempest/common/rest_client.py
index 8786a17..c5696b7 100644
--- a/tempest/common/rest_client.py
+++ b/tempest/common/rest_client.py
@@ -295,7 +295,7 @@
             if len(body.keys()) > 1:
                 return body
             # Just return the "wrapped" element
-            first_key, first_item = body.items()[0]
+            first_key, first_item = six.next(six.iteritems(body))
             if isinstance(first_item, (dict, list)):
                 return first_item
         except (ValueError, IndexError):
diff --git a/tempest/config.py b/tempest/config.py
index 1c0dabb..4858fda 100644
--- a/tempest/config.py
+++ b/tempest/config.py
@@ -131,6 +131,9 @@
     cfg.StrOpt('admin_domain_name',
                help="Admin domain name for authentication (Keystone V3)."
                     "The same domain applies to user and project"),
+    cfg.ListOpt('tempest_roles',
+                help="Roles to assign to all users created by tempest",
+                default=[])
 ]
 
 identity_feature_group = cfg.OptGroup(name='identity-feature-enabled',
diff --git a/tempest/tests/fake_auth_provider.py b/tempest/tests/fake_auth_provider.py
index 44c331e..bc68d26 100644
--- a/tempest/tests/fake_auth_provider.py
+++ b/tempest/tests/fake_auth_provider.py
@@ -13,16 +13,6 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-from tempest.tests import fake_credentials
-
-
-def get_default_credentials(credential_type, fill_in=True):
-    return fake_credentials.FakeCredentials()
-
-
-def get_credentials(credential_type=None, fill_in=True, **kwargs):
-    return fake_credentials.FakeCredentials()
-
 
 class FakeAuthProvider(object):
 
diff --git a/tempest/tests/test_auth.py b/tempest/tests/test_auth.py
index fc05198..a191781 100644
--- a/tempest/tests/test_auth.py
+++ b/tempest/tests/test_auth.py
@@ -24,13 +24,20 @@
 from tempest.services.identity.json import identity_client as v2_client
 from tempest.services.identity.v3.json import identity_client as v3_client
 from tempest.tests import base
-from tempest.tests import fake_auth_provider
 from tempest.tests import fake_config
 from tempest.tests import fake_credentials
 from tempest.tests import fake_http
 from tempest.tests import fake_identity
 
 
+def fake_get_default_credentials(credential_type, fill_in=True):
+    return fake_credentials.FakeCredentials()
+
+
+def fake_get_credentials(credential_type=None, fill_in=True, **kwargs):
+    return fake_credentials.FakeCredentials()
+
+
 class BaseAuthTestsSetUp(base.TestCase):
     _auth_provider_class = None
     credentials = fake_credentials.FakeCredentials()
@@ -46,10 +53,9 @@
         self.useFixture(fake_config.ConfigFixture())
         self.stubs.Set(config, 'TempestConfigPrivate', fake_config.FakePrivate)
         self.fake_http = fake_http.fake_httplib2(return_type=200)
-        self.stubs.Set(auth, 'get_credentials',
-                       fake_auth_provider.get_credentials)
+        self.stubs.Set(auth, 'get_credentials', fake_get_credentials)
         self.stubs.Set(auth, 'get_default_credentials',
-                       fake_auth_provider.get_default_credentials)
+                       fake_get_default_credentials)
         self.auth_provider = self._auth(self.credentials)
 
 
diff --git a/tempest/tests/test_rest_client.py b/tempest/tests/test_rest_client.py
index e42fab7..6a95a80 100644
--- a/tempest/tests/test_rest_client.py
+++ b/tempest/tests/test_rest_client.py
@@ -16,13 +16,12 @@
 
 import httplib2
 from oslotest import mockpatch
+import six
 
 from tempest.common import rest_client
-from tempest import config
 from tempest import exceptions
 from tempest.tests import base
 from tempest.tests import fake_auth_provider
-from tempest.tests import fake_config
 from tempest.tests import fake_http
 
 
@@ -32,8 +31,6 @@
 
     def setUp(self):
         super(BaseRestClientTestClass, self).setUp()
-        self.useFixture(fake_config.ConfigFixture())
-        self.stubs.Set(config, 'TempestConfigPrivate', fake_config.FakePrivate)
         self.rest_client = rest_client.RestClient(
             fake_auth_provider.FakeAuthProvider(), None, None)
         self.stubs.Set(httplib2.Http, 'request', self.fake_http.request)
@@ -94,7 +91,7 @@
 
     def _verify_headers(self, resp):
         self.assertEqual(self.rest_client._get_type(), self.TYPE)
-        resp = dict((k.lower(), v) for k, v in resp.iteritems())
+        resp = dict((k.lower(), v) for k, v in six.iteritems(resp))
         self.assertEqual(self.header_value, resp['accept'])
         self.assertEqual(self.header_value, resp['content-type'])
 
@@ -296,8 +293,6 @@
 
     def setUp(self):
         super(TestRestClientErrorCheckerJSON, self).setUp()
-        self.useFixture(fake_config.ConfigFixture())
-        self.stubs.Set(config, 'TempestConfigPrivate', fake_config.FakePrivate)
         self.rest_client = rest_client.RestClient(
             fake_auth_provider.FakeAuthProvider(), None, None)