diff --git a/etc/tempest.conf.sample b/etc/tempest.conf.sample
index 3ade411..949302f 100644
--- a/etc/tempest.conf.sample
+++ b/etc/tempest.conf.sample
@@ -816,7 +816,7 @@
 
 # Number of seconds to time on waiting for a container to container
 # synchronization complete. (integer value)
-#container_sync_timeout = 120
+#container_sync_timeout = 600
 
 # Number of seconds to wait while looping to check the status of a
 # container to container synchronization (integer value)
@@ -829,6 +829,16 @@
 # User role that has reseller admin (string value)
 #reseller_admin_role = ResellerAdmin
 
+# Name of sync realm. A sync realm is a set of clusters that have
+# agreed to allow container syncing with each other. Set the same
+# realm name as Swift's container-sync-realms.conf (string value)
+#realm_name = realm1
+
+# One name of cluster which is set in the realm whose name is set in
+# 'realm_name' item in this file. Set the same cluster name as Swift's
+# container-sync-realms.conf (string value)
+#cluster_name = name1
+
 
 [object-storage-feature-enabled]
 
diff --git a/tempest/api/compute/admin/test_servers.py b/tempest/api/compute/admin/test_servers.py
index e3477f1..5210077 100644
--- a/tempest/api/compute/admin/test_servers.py
+++ b/tempest/api/compute/admin/test_servers.py
@@ -79,6 +79,24 @@
         self.assertIn(self.s2_name, servers_name)
 
     @test.attr(type='gate')
+    def test_list_servers_by_admin_with_specified_tenant(self):
+        # In nova v2, tenant_id is ignored unless all_tenants is specified
+
+        # List the primary tenant but get nothing due to odd specified behavior
+        tenant_id = self.non_admin_client.tenant_id
+        params = {'tenant_id': tenant_id}
+        resp, body = self.client.list_servers_with_detail(params)
+        servers = body['servers']
+        self.assertEqual([], servers)
+
+        # List the admin tenant which has no servers
+        admin_tenant_id = self.client.tenant_id
+        params = {'all_tenants': '', 'tenant_id': admin_tenant_id}
+        resp, body = self.client.list_servers_with_detail(params)
+        servers = body['servers']
+        self.assertEqual([], servers)
+
+    @test.attr(type='gate')
     def test_list_servers_filter_by_exist_host(self):
         # Filter the list of servers by existent host
         name = data_utils.rand_name('server')
diff --git a/tempest/api/object_storage/test_container_sync.py b/tempest/api/object_storage/test_container_sync.py
index a50e392..7f8cb8b 100644
--- a/tempest/api/object_storage/test_container_sync.py
+++ b/tempest/api/object_storage/test_container_sync.py
@@ -44,10 +44,9 @@
         cls.local_ip = '127.0.0.1'
 
         # Must be configure according to container-sync interval
-        container_sync_timeout = \
-            int(CONF.object_storage.container_sync_timeout)
+        container_sync_timeout = CONF.object_storage.container_sync_timeout
         cls.container_sync_interval = \
-            int(CONF.object_storage.container_sync_interval)
+            CONF.object_storage.container_sync_interval
         cls.attempts = \
             int(container_sync_timeout / cls.container_sync_interval)
 
@@ -66,12 +65,7 @@
             cls.delete_containers(cls.containers, client[0], client[1])
         super(ContainerSyncTest, cls).resource_cleanup()
 
-    @test.attr(type='slow')
-    @test.skip_because(bug='1317133')
-    @testtools.skipIf(
-        not CONF.object_storage_feature_enabled.container_sync,
-        'Old-style container sync function is disabled')
-    def test_container_synchronization(self):
+    def _test_container_synchronization(self, make_headers):
         # container to container synchronization
         # to allow/accept sync requests to/from other accounts
 
@@ -79,15 +73,7 @@
         for cont in (self.containers, self.containers[::-1]):
             cont_client = [self.clients[c][0] for c in cont]
             obj_client = [self.clients[c][1] for c in cont]
-            # tell first container to synchronize to a second
-            client_proxy_ip = \
-                urlparse.urlparse(cont_client[1].base_url).netloc.split(':')[0]
-            client_base_url = \
-                cont_client[1].base_url.replace(client_proxy_ip,
-                                                self.local_ip)
-            headers = {'X-Container-Sync-Key': 'sync_key',
-                       'X-Container-Sync-To': "%s/%s" %
-                       (client_base_url, str(cont[1]))}
+            headers = make_headers(cont[1], cont_client[1])
             resp, body = \
                 cont_client[0].put(str(cont[0]), body=None, headers=headers)
             # create object in container
@@ -101,21 +87,19 @@
         params = {'format': 'json'}
         while self.attempts > 0:
             object_lists = []
-            for client_index in (0, 1):
-                resp, object_list = \
-                    cont_client[client_index].\
-                    list_container_contents(self.containers[client_index],
-                                            params=params)
+            for c_client, cont in zip(cont_client, self.containers):
+                resp, object_list = c_client.list_container_contents(
+                    cont, params=params)
                 object_lists.append(dict(
                     (obj['name'], obj) for obj in object_list))
             # check that containers are not empty and have equal keys()
             # or wait for next attempt
-            if not object_lists[0] or not object_lists[1] or \
-                    set(object_lists[0].keys()) != set(object_lists[1].keys()):
+            if object_lists[0] and object_lists[1] and \
+                    set(object_lists[0].keys()) == set(object_lists[1].keys()):
+                break
+            else:
                 time.sleep(self.container_sync_interval)
                 self.attempts -= 1
-            else:
-                break
 
         self.assertEqual(object_lists[0], object_lists[1],
                          'Different object lists in containers.')
@@ -126,3 +110,22 @@
             for obj_name in object_lists[0]:
                 resp, object_content = obj_client.get_object(cont, obj_name)
                 self.assertEqual(object_content, obj_name[::-1])
+
+    @test.attr(type='slow')
+    @test.skip_because(bug='1317133')
+    @testtools.skipIf(
+        not CONF.object_storage_feature_enabled.container_sync,
+        'Old-style container sync function is disabled')
+    def test_container_synchronization(self):
+        def make_headers(cont, cont_client):
+            # tell first container to synchronize to a second
+            client_proxy_ip = \
+                urlparse.urlparse(cont_client.base_url).netloc.split(':')[0]
+            client_base_url = \
+                cont_client.base_url.replace(client_proxy_ip,
+                                             self.local_ip)
+            headers = {'X-Container-Sync-Key': 'sync_key',
+                       'X-Container-Sync-To': "%s/%s" %
+                       (client_base_url, str(cont))}
+            return headers
+        self._test_container_synchronization(make_headers)
diff --git a/tempest/api/object_storage/test_container_sync_middleware.py b/tempest/api/object_storage/test_container_sync_middleware.py
new file mode 100644
index 0000000..41509a0
--- /dev/null
+++ b/tempest/api/object_storage/test_container_sync_middleware.py
@@ -0,0 +1,51 @@
+# Copyright(c)2015 NTT corp. All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+
+from tempest.api.object_storage import test_container_sync
+from tempest import config
+from tempest import test
+
+CONF = config.CONF
+
+
+# This test can be quite long to run due to its
+# dependency on container-sync process running interval.
+# You can obviously reduce the container-sync interval in the
+# container-server configuration.
+
+
+class ContainerSyncMiddlewareTest(test_container_sync.ContainerSyncTest):
+
+    @classmethod
+    def resource_setup(cls):
+        super(ContainerSyncMiddlewareTest, cls).resource_setup()
+
+        # Set container-sync-realms.conf info
+        cls.realm_name = CONF.object_storage.realm_name
+        cls.key = 'sync_key'
+        cls.cluster_name = CONF.object_storage.cluster_name
+
+    @test.attr(type='slow')
+    @test.requires_ext(extension='container_sync', service='object')
+    def test_container_synchronization(self):
+        def make_headers(cont, cont_client):
+            # tell first container to synchronize to a second
+            account_name = cont_client.base_url.split('/')[-1]
+
+            headers = {'X-Container-Sync-Key': "%s" % (self.key),
+                       'X-Container-Sync-To': "//%s/%s/%s/%s" %
+                       (self.realm_name, self.cluster_name,
+                        str(account_name), str(cont))}
+            return headers
+        self._test_container_synchronization(make_headers)
diff --git a/tempest/common/negative_rest_client.py b/tempest/common/negative_rest_client.py
index d9842e6..a02e494 100644
--- a/tempest/common/negative_rest_client.py
+++ b/tempest/common/negative_rest_client.py
@@ -15,18 +15,16 @@
 #    License for the specific language governing permissions and limitations
 #    under the License.
 
-from tempest_lib.common import rest_client
-
+from tempest.common import service_client
 from tempest import config
 
 CONF = config.CONF
 
 
-class NegativeRestClient(rest_client.RestClient):
+class NegativeRestClient(service_client.ServiceClient):
     """
     Version of RestClient that does not raise exceptions.
     """
-
     def __init__(self, auth_provider, service):
         region = self._get_region(service)
         super(NegativeRestClient, self).__init__(auth_provider,
diff --git a/tempest/common/service_client.py b/tempest/common/service_client.py
index 45a07f1..d2f67e3 100644
--- a/tempest/common/service_client.py
+++ b/tempest/common/service_client.py
@@ -83,6 +83,12 @@
             raise exceptions.ServerFault(ex)
         except lib_exceptions.UnexpectedResponseCode as ex:
             raise exceptions.UnexpectedResponseCode(ex)
+        # TODO(oomichi): This is just a workaround for failing gate tests
+        # when separating Forbidden from Unauthorized in tempest-lib.
+        # We will need to remove this translation and replace negative tests
+        # with lib_exceptions.Forbidden in the future.
+        except lib_exceptions.Forbidden as ex:
+            raise exceptions.Unauthorized(ex)
 
 
 class ResponseBody(dict):
diff --git a/tempest/config.py b/tempest/config.py
index 1b6ec62..70f972f 100644
--- a/tempest/config.py
+++ b/tempest/config.py
@@ -601,7 +601,7 @@
                         'publicURL', 'adminURL', 'internalURL'],
                help="The endpoint type to use for the object-store service."),
     cfg.IntOpt('container_sync_timeout',
-               default=120,
+               default=600,
                help="Number of seconds to time on waiting for a container "
                     "to container synchronization complete."),
     cfg.IntOpt('container_sync_interval',
@@ -615,6 +615,17 @@
     cfg.StrOpt('reseller_admin_role',
                default='ResellerAdmin',
                help="User role that has reseller admin"),
+    cfg.StrOpt('realm_name',
+               default='realm1',
+               help="Name of sync realm. A sync realm is a set of clusters "
+                    "that have agreed to allow container syncing with each "
+                    "other. Set the same realm name as Swift's "
+                    "container-sync-realms.conf"),
+    cfg.StrOpt('cluster_name',
+               default='name1',
+               help="One name of cluster which is set in the realm whose name "
+                    "is set in 'realm_name' item in this file. Set the "
+                    "same cluster name as Swift's container-sync-realms.conf"),
 ]
 
 object_storage_feature_group = cfg.OptGroup(