diff --git a/releasenotes/notes/add-cred-provider-abstract-class-to-lib-70ff513221f8a871.yaml b/releasenotes/notes/add-cred-provider-abstract-class-to-lib-70ff513221f8a871.yaml
new file mode 100644
index 0000000..6f7a411
--- /dev/null
+++ b/releasenotes/notes/add-cred-provider-abstract-class-to-lib-70ff513221f8a871.yaml
@@ -0,0 +1,6 @@
+---
+features:
+  - The cred_provider abstract class which serves as the basis for both
+    of tempest's cred providers, pre-provisioned credentials and dynamic
+    credentials, is now a library interface. This provides the common signature
+    required for building a credential provider.
diff --git a/tempest/api/compute/admin/test_floating_ips_bulk.py b/tempest/api/compute/admin/test_floating_ips_bulk.py
index 456363c..e207aed 100644
--- a/tempest/api/compute/admin/test_floating_ips_bulk.py
+++ b/tempest/api/compute/admin/test_floating_ips_bulk.py
@@ -17,7 +17,7 @@
 
 from tempest.api.compute import base
 from tempest import config
-from tempest import exceptions
+from tempest.lib import exceptions
 from tempest import test
 
 CONF = config.CONF
diff --git a/tempest/api/compute/floating_ips/test_floating_ips_actions.py b/tempest/api/compute/floating_ips/test_floating_ips_actions.py
index 3508ba9..fdf1e93 100644
--- a/tempest/api/compute/floating_ips/test_floating_ips_actions.py
+++ b/tempest/api/compute/floating_ips/test_floating_ips_actions.py
@@ -14,7 +14,6 @@
 #    under the License.
 
 from tempest.api.compute.floating_ips import base
-from tempest.common.utils import data_utils
 from tempest.common import waiters
 from tempest import config
 from tempest.lib.common.utils import test_utils
@@ -112,8 +111,7 @@
         # positive test:Association of an already associated floating IP
         # to specific server should change the association of the Floating IP
         # Create server so as to use for Multiple association
-        new_name = data_utils.rand_name('floating_server')
-        body = self.create_test_server(name=new_name)
+        body = self.create_test_server()
         waiters.wait_for_server_status(self.servers_client,
                                        body['id'], 'ACTIVE')
         self.new_server_id = body['id']
diff --git a/tempest/api/compute/images/test_list_image_filters.py b/tempest/api/compute/images/test_list_image_filters.py
index f340658..a9c2f7a 100644
--- a/tempest/api/compute/images/test_list_image_filters.py
+++ b/tempest/api/compute/images/test_list_image_filters.py
@@ -23,7 +23,7 @@
 from tempest.common.utils import data_utils
 from tempest.common import waiters
 from tempest import config
-from tempest import exceptions
+from tempest.lib import exceptions
 from tempest import test
 
 CONF = config.CONF
diff --git a/tempest/api/compute/servers/test_server_actions.py b/tempest/api/compute/servers/test_server_actions.py
index 788dd8a..9077801 100644
--- a/tempest/api/compute/servers/test_server_actions.py
+++ b/tempest/api/compute/servers/test_server_actions.py
@@ -24,7 +24,6 @@
 from tempest.common.utils.linux import remote_client
 from tempest.common import waiters
 from tempest import config
-from tempest import exceptions
 from tempest.lib import decorators
 from tempest.lib import exceptions as lib_exc
 from tempest import test
@@ -331,7 +330,7 @@
         elif CONF.image_feature_enabled.api_v2:
             glance_client = self.os.image_client_v2
         else:
-            raise exceptions.InvalidConfiguration(
+            raise lib_exc.InvalidConfiguration(
                 'Either api_v1 or api_v2 must be True in '
                 '[image-feature-enabled].')
 
diff --git a/tempest/api/compute/servers/test_server_group.py b/tempest/api/compute/servers/test_server_group.py
index e32f6b0..bc49e7b 100644
--- a/tempest/api/compute/servers/test_server_group.py
+++ b/tempest/api/compute/servers/test_server_group.py
@@ -19,12 +19,13 @@
 
 
 class ServerGroupTestJSON(base.BaseV2ComputeTest):
-    """These tests check for the server-group APIs
+    """These tests check for the server-group APIs.
 
     They create/delete server-groups with different policies.
     policies = affinity/anti-affinity
     It also adds the tests for list and get details of server-groups
     """
+
     @classmethod
     def skip_checks(cls):
         super(ServerGroupTestJSON, cls).skip_checks()
@@ -40,12 +41,10 @@
     @classmethod
     def resource_setup(cls):
         super(ServerGroupTestJSON, cls).resource_setup()
-        server_group_name = data_utils.rand_name('server-group')
         cls.policy = ['affinity']
 
         cls.created_server_group = cls.create_test_server_group(
-            server_group_name,
-            cls.policy)
+            policy=cls.policy)
 
     def _create_server_group(self, name, policy):
         # create the test server-group with given policy
diff --git a/tempest/api/identity/v2/test_users.py b/tempest/api/identity/v2/test_users.py
index 4833f9e..33d212c 100644
--- a/tempest/api/identity/v2/test_users.py
+++ b/tempest/api/identity/v2/test_users.py
@@ -44,6 +44,11 @@
             # Clear auth restores the original credentials and deletes
             # cached auth data
             client.auth_provider.clear_auth()
+            # NOTE(lbragstad): Fernet tokens are not subsecond aware and
+            # Keystone should only be precise to the second. Sleep to ensure we
+            # are passing the second boundary before attempting to
+            # authenticate.
+            time.sleep(1)
             client.auth_provider.set_auth()
 
         old_pass = self.creds.password
diff --git a/tempest/api/identity/v3/test_users.py b/tempest/api/identity/v3/test_users.py
index c92e750..1a38f3a 100644
--- a/tempest/api/identity/v3/test_users.py
+++ b/tempest/api/identity/v3/test_users.py
@@ -44,6 +44,11 @@
             # Clear auth restores the original credentials and deletes
             # cached auth data
             client.auth_provider.clear_auth()
+            # NOTE(lbragstad): Fernet tokens are not subsecond aware and
+            # Keystone should only be precise to the second. Sleep to ensure we
+            # are passing the second boundary before attempting to
+            # authenticate.
+            time.sleep(1)
             client.auth_provider.set_auth()
 
         old_pass = self.creds.password
diff --git a/tempest/api/image/v1/test_images.py b/tempest/api/image/v1/test_images.py
index 695efb5..269e297 100644
--- a/tempest/api/image/v1/test_images.py
+++ b/tempest/api/image/v1/test_images.py
@@ -20,7 +20,7 @@
 from tempest.common.utils import data_utils
 from tempest.common import waiters
 from tempest import config
-from tempest import exceptions
+from tempest.lib import exceptions
 from tempest import test
 
 CONF = config.CONF
diff --git a/tempest/api/network/admin/test_l3_agent_scheduler.py b/tempest/api/network/admin/test_l3_agent_scheduler.py
index d2e1492..dca4523 100644
--- a/tempest/api/network/admin/test_l3_agent_scheduler.py
+++ b/tempest/api/network/admin/test_l3_agent_scheduler.py
@@ -15,7 +15,7 @@
 from tempest.api.network import base
 from tempest.common.utils import data_utils
 from tempest import config
-from tempest import exceptions
+from tempest.lib import exceptions
 from tempest import test
 
 CONF = config.CONF
diff --git a/tempest/api/network/test_ports.py b/tempest/api/network/test_ports.py
index e5972a9..12539ba 100644
--- a/tempest/api/network/test_ports.py
+++ b/tempest/api/network/test_ports.py
@@ -23,7 +23,7 @@
 from tempest.common import custom_matchers
 from tempest.common.utils import data_utils
 from tempest import config
-from tempest import exceptions
+from tempest.lib import exceptions
 from tempest import test
 
 CONF = config.CONF
diff --git a/tempest/api/network/test_security_groups.py b/tempest/api/network/test_security_groups.py
index 5312979..1031ab8 100644
--- a/tempest/api/network/test_security_groups.py
+++ b/tempest/api/network/test_security_groups.py
@@ -71,7 +71,7 @@
     @test.attr(type='smoke')
     @test.idempotent_id('e30abd17-fef9-4739-8617-dc26da88e686')
     def test_list_security_groups(self):
-        # Verify the that security group belonging to project exist in list
+        # Verify the security group belonging to project exist in list
         body = self.security_groups_client.list_security_groups()
         security_groups = body['security_groups']
         found = None
diff --git a/tempest/api/volume/base.py b/tempest/api/volume/base.py
index b49a126..b788d54 100644
--- a/tempest/api/volume/base.py
+++ b/tempest/api/volume/base.py
@@ -17,8 +17,8 @@
 from tempest.common.utils import data_utils
 from tempest.common import waiters
 from tempest import config
-from tempest import exceptions
 from tempest.lib.common.utils import test_utils
+from tempest.lib import exceptions
 import tempest.test
 
 CONF = config.CONF
@@ -172,7 +172,11 @@
             except Exception:
                 pass
 
-    def create_server(self, name, **kwargs):
+    def create_server(self, **kwargs):
+        name = kwargs.get(
+            'name',
+            data_utils.rand_name(self.__class__.__name__ + '-instance'))
+
         tenant_network = self.get_tenant_network()
         body, _ = compute.create_test_server(
             self.os,
diff --git a/tempest/api/volume/test_volumes_actions.py b/tempest/api/volume/test_volumes_actions.py
index 9b48c89..7fd8b60 100644
--- a/tempest/api/volume/test_volumes_actions.py
+++ b/tempest/api/volume/test_volumes_actions.py
@@ -18,8 +18,8 @@
 from tempest.common.utils import data_utils
 from tempest.common import waiters
 from tempest import config
-from tempest import exceptions
 from tempest.lib.common.utils import test_utils
+from tempest.lib import exceptions
 from tempest import test
 
 CONF = config.CONF
@@ -55,10 +55,7 @@
     @test.services('compute')
     def test_attach_detach_volume_to_instance(self):
         # Create a server
-        srv_name = data_utils.rand_name(self.__class__.__name__ + '-Instance')
-        server = self.create_server(
-            name=srv_name,
-            wait_until='ACTIVE')
+        server = self.create_server(wait_until='ACTIVE')
         # Volume is attached and detached successfully from an instance
         self.client.attach_volume(self.volume['id'],
                                   instance_uuid=server['id'],
@@ -89,10 +86,7 @@
     @test.services('compute')
     def test_get_volume_attachment(self):
         # Create a server
-        srv_name = data_utils.rand_name(self.__class__.__name__ + '-Instance')
-        server = self.create_server(
-            name=srv_name,
-            wait_until='ACTIVE')
+        server = self.create_server(wait_until='ACTIVE')
         # Verify that a volume's attachment information is retrieved
         self.client.attach_volume(self.volume['id'],
                                   instance_uuid=server['id'],
diff --git a/tempest/api/volume/test_volumes_backup.py b/tempest/api/volume/test_volumes_backup.py
index 867e520..141336f 100644
--- a/tempest/api/volume/test_volumes_backup.py
+++ b/tempest/api/volume/test_volumes_backup.py
@@ -84,9 +84,7 @@
         volume = self.create_volume()
         self.addCleanup(self.volumes_client.delete_volume,
                         volume['id'])
-        server_name = data_utils.rand_name(
-            self.__class__.__name__ + '-instance')
-        server = self.create_server(name=server_name, wait_until='ACTIVE')
+        server = self.create_server(wait_until='ACTIVE')
         # Attach volume to instance
         self.servers_client.attach_volume(server['id'],
                                           volumeId=volume['id'])
diff --git a/tempest/api/volume/test_volumes_negative.py b/tempest/api/volume/test_volumes_negative.py
index e8ead5b..fda0dda 100644
--- a/tempest/api/volume/test_volumes_negative.py
+++ b/tempest/api/volume/test_volumes_negative.py
@@ -176,10 +176,7 @@
     @test.idempotent_id('f5e56b0a-5d02-43c1-a2a7-c9b792c2e3f6')
     @test.services('compute')
     def test_attach_volumes_with_nonexistent_volume_id(self):
-        srv_name = data_utils.rand_name(self.__class__.__name__ + '-Instance')
-        server = self.create_server(
-            name=srv_name,
-            wait_until='ACTIVE')
+        server = self.create_server(wait_until='ACTIVE')
 
         self.assertRaises(lib_exc.NotFound,
                           self.client.attach_volume,
diff --git a/tempest/api/volume/test_volumes_snapshots.py b/tempest/api/volume/test_volumes_snapshots.py
index f971eca..7be31d1 100644
--- a/tempest/api/volume/test_volumes_snapshots.py
+++ b/tempest/api/volume/test_volumes_snapshots.py
@@ -45,11 +45,7 @@
     def test_snapshot_create_with_volume_in_use(self):
         # Create a snapshot when volume status is in-use
         # Create a test instance
-        server_name = data_utils.rand_name(
-            self.__class__.__name__ + '-instance')
-        server = self.create_server(
-            name=server_name,
-            wait_until='ACTIVE')
+        server = self.create_server(wait_until='ACTIVE')
         self.servers_client.attach_volume(
             server['id'], volumeId=self.volume_origin['id'],
             device='/dev/%s' % CONF.compute.volume_device_name)
diff --git a/tempest/clients.py b/tempest/clients.py
index 6cb6980..be6bc02 100644
--- a/tempest/clients.py
+++ b/tempest/clients.py
@@ -267,14 +267,14 @@
                     CONF.identity.uri, **self.default_params)
             else:
                 msg = 'Identity v2 API enabled, but no identity.uri set'
-                raise exceptions.InvalidConfiguration(msg)
+                raise lib_exc.InvalidConfiguration(msg)
         if CONF.identity_feature_enabled.api_v3:
             if CONF.identity.uri_v3:
                 self.token_v3_client = identity.v3.V3TokenClient(
                     CONF.identity.uri_v3, **self.default_params)
             else:
                 msg = 'Identity v3 API enabled, but no identity.uri_v3 set'
-                raise exceptions.InvalidConfiguration(msg)
+                raise lib_exc.InvalidConfiguration(msg)
 
     def _set_volume_clients(self):
         # Mandatory parameters (always defined)
diff --git a/tempest/cmd/account_generator.py b/tempest/cmd/account_generator.py
index f9d7a9b..1779252 100755
--- a/tempest/cmd/account_generator.py
+++ b/tempest/cmd/account_generator.py
@@ -144,6 +144,13 @@
         identity_version=identity_version,
         name=opts.tag,
         network_resources=network_resources,
+        neutron_available=CONF.service_available.neutron,
+        create_networks=CONF.auth.create_isolated_networks,
+        identity_admin_role=CONF.identity.admin_role,
+        identity_admin_domain_scope=CONF.identity.admin_domain_scope,
+        project_network_cidr=CONF.network.project_network_cidr,
+        project_network_mask_bits=CONF.network.project_network_mask_bits,
+        public_network_id=CONF.network.public_network_id,
         admin_creds=admin_creds,
         **credentials_factory.get_dynamic_provider_params())
 
diff --git a/tempest/common/credentials_factory.py b/tempest/common/credentials_factory.py
index c22afc1..5634958 100644
--- a/tempest/common/credentials_factory.py
+++ b/tempest/common/credentials_factory.py
@@ -17,8 +17,8 @@
 from tempest.common import dynamic_creds
 from tempest.common import preprov_creds
 from tempest import config
-from tempest import exceptions
 from tempest.lib import auth
+from tempest.lib import exceptions
 
 CONF = config.CONF
 
@@ -80,6 +80,16 @@
             network_resources=network_resources,
             identity_version=identity_version,
             admin_creds=admin_creds,
+            identity_admin_domain_scope=CONF.identity.admin_domain_scope,
+            identity_admin_role=CONF.identity.admin_role,
+            extra_roles=CONF.auth.tempest_roles,
+            neutron_available=CONF.service_available.neutron,
+            project_network_cidr=CONF.network.project_network_cidr,
+            project_network_mask_bits=CONF.network.project_network_mask_bits,
+            public_network_id=CONF.network.public_network_id,
+            create_networks=(CONF.auth.create_isolated_networks and not
+                             CONF.baremetal.driver_enabled),
+            resource_prefix=CONF.resources_prefix,
             **get_dynamic_provider_params())
     else:
         if CONF.auth.test_accounts_file:
diff --git a/tempest/common/dynamic_creds.py b/tempest/common/dynamic_creds.py
index b96b1c0..5c12fd8 100644
--- a/tempest/common/dynamic_creds.py
+++ b/tempest/common/dynamic_creds.py
@@ -18,20 +18,22 @@
 
 from tempest import clients
 from tempest.common import cred_client
-from tempest.common import cred_provider
-from tempest.common.utils import data_utils
-from tempest import config
-from tempest import exceptions
+from tempest.lib.common import cred_provider
+from tempest.lib.common.utils import data_utils
 from tempest.lib import exceptions as lib_exc
 
-CONF = config.CONF
 LOG = logging.getLogger(__name__)
 
 
 class DynamicCredentialProvider(cred_provider.CredentialProvider):
 
     def __init__(self, identity_version, name=None, network_resources=None,
-                 credentials_domain=None, admin_role=None, admin_creds=None):
+                 credentials_domain=None, admin_role=None, admin_creds=None,
+                 identity_admin_domain_scope=False,
+                 identity_admin_role='admin', extra_roles=None,
+                 neutron_available=False, create_networks=True,
+                 project_network_cidr=None, project_network_mask_bits=None,
+                 public_network_id=None, resource_prefix=None):
         """Creates credentials dynamically for tests
 
         A credential provider that, based on an initial set of
@@ -48,6 +50,23 @@
         :param dict network_resources: network resources to be created for
                                        the created credentials
         :param Credentials admin_creds: initial admin credentials
+        :param bool identity_admin_domain_scope: Set to true if admin should be
+                                                 scoped to the domain. By
+                                                 default this is False and the
+                                                 admin role is scoped to the
+                                                 project.
+        :param str identity_admin_role: The role name to use for admin
+        :param list extra_roles: A list of strings for extra roles that should
+                                 be assigned to all created users
+        :param bool neutron_available: Whether we are running in an environemnt
+                                       with neutron
+        :param bool create_networks: Whether dynamic project networks should be
+                                     created or not
+        :param project_network_cidr: The CIDR to use for created project
+                                     networks
+        :param project_network_mask_bits: The network mask bits to use for
+                                          created project networks
+        :param public_network_id: The id for the public network to use
         """
         super(DynamicCredentialProvider, self).__init__(
             identity_version=identity_version, admin_role=admin_role,
@@ -56,7 +75,16 @@
         self.network_resources = network_resources
         self._creds = {}
         self.ports = []
+        self.resource_prefix = resource_prefix or ''
+        self.neutron_available = neutron_available
+        self.create_networks = create_networks
+        self.project_network_cidr = project_network_cidr
+        self.project_network_mask_bits = project_network_mask_bits
+        self.public_network_id = public_network_id
         self.default_admin_creds = admin_creds
+        self.identity_admin_domain_scope = identity_admin_domain_scope
+        self.identity_admin_role = identity_admin_role or 'admin'
+        self.extra_roles = extra_roles or []
         (self.identity_admin_client,
          self.tenants_admin_client,
          self.users_admin_client,
@@ -98,7 +126,7 @@
         else:
             # We use a dedicated client manager for identity client in case we
             # need a different token scope for them.
-            scope = 'domain' if CONF.identity.admin_domain_scope else 'project'
+            scope = 'domain' if self.identity_admin_domain_scope else 'project'
             identity_os = clients.Manager(self.default_admin_creds,
                                           scope=scope)
             return (identity_os.identity_v3_client,
@@ -124,7 +152,7 @@
         """
         root = self.name
 
-        project_name = data_utils.rand_name(root)
+        project_name = data_utils.rand_name(root, prefix=self.resource_prefix)
         project_desc = project_name + "-desc"
         project = self.creds_client.create_project(
             name=project_name, description=project_desc)
@@ -133,7 +161,8 @@
         # having the same ID in both makes it easier to match them and debug.
         username = project_name
         user_password = data_utils.rand_password()
-        email = data_utils.rand_name(root) + "@example.com"
+        email = data_utils.rand_name(
+            root, prefix=self.resource_prefix) + "@example.com"
         user = self.creds_client.create_user(
             username, user_password, project, email)
         role_assigned = False
@@ -141,11 +170,11 @@
             self.creds_client.assign_user_role(user, project, self.admin_role)
             role_assigned = True
             if (self.identity_version == 'v3' and
-                    CONF.identity.admin_domain_scope):
+                    self.identity_admin_domain_scope):
                 self.creds_client.assign_user_role_on_domain(
-                    user, CONF.identity.admin_role)
+                    user, self.identity_admin_role)
         # Add roles specified in config file
-        for conf_role in CONF.auth.tempest_roles:
+        for conf_role in self.extra_roles:
             self.creds_client.assign_user_role(user, project, conf_role)
             role_assigned = True
         # Add roles requested by caller
@@ -189,26 +218,27 @@
             if self.network_resources['router']:
                 if (not self.network_resources['subnet'] or
                     not self.network_resources['network']):
-                    raise exceptions.InvalidConfiguration(
+                    raise lib_exc.InvalidConfiguration(
                         'A router requires a subnet and network')
             elif self.network_resources['subnet']:
                 if not self.network_resources['network']:
-                    raise exceptions.InvalidConfiguration(
+                    raise lib_exc.InvalidConfiguration(
                         'A subnet requires a network')
             elif self.network_resources['dhcp']:
-                raise exceptions.InvalidConfiguration('DHCP requires a subnet')
+                raise lib_exc.InvalidConfiguration('DHCP requires a subnet')
 
-        data_utils.rand_name_root = data_utils.rand_name(self.name)
+        rand_name_root = data_utils.rand_name(
+            self.name, prefix=self.resource_prefix)
         if not self.network_resources or self.network_resources['network']:
-            network_name = data_utils.rand_name_root + "-network"
+            network_name = rand_name_root + "-network"
             network = self._create_network(network_name, tenant_id)
         try:
             if not self.network_resources or self.network_resources['subnet']:
-                subnet_name = data_utils.rand_name_root + "-subnet"
+                subnet_name = rand_name_root + "-subnet"
                 subnet = self._create_subnet(subnet_name, tenant_id,
                                              network['id'])
             if not self.network_resources or self.network_resources['router']:
-                router_name = data_utils.rand_name_root + "-router"
+                router_name = rand_name_root + "-router"
                 router = self._create_router(router_name, tenant_id)
                 self._add_router_interface(router['id'], subnet['id'])
         except Exception:
@@ -234,8 +264,8 @@
         return resp_body['network']
 
     def _create_subnet(self, subnet_name, tenant_id, network_id):
-        base_cidr = netaddr.IPNetwork(CONF.network.project_network_cidr)
-        mask_bits = CONF.network.project_network_mask_bits
+        base_cidr = netaddr.IPNetwork(self.project_network_cidr)
+        mask_bits = self.project_network_mask_bits
         for subnet_cidr in base_cidr.subnet(mask_bits):
             try:
                 if self.network_resources:
@@ -264,7 +294,7 @@
 
     def _create_router(self, router_name, tenant_id):
         external_net_id = dict(
-            network_id=CONF.network.public_network_id)
+            network_id=self.public_network_id)
         resp_body = self.routers_admin_client.create_router(
             name=router_name,
             external_gateway_info=external_net_id,
@@ -288,9 +318,8 @@
             # Maintained until tests are ported
             LOG.info("Acquired dynamic creds:\n credentials: %s"
                      % credentials)
-            if (CONF.service_available.neutron and
-                not CONF.baremetal.driver_enabled and
-                CONF.auth.create_isolated_networks):
+            if (self.neutron_available and
+                self.create_networks):
                 network, subnet, router = self._create_network_resources(
                     credentials.tenant_id)
                 credentials.set_resources(network=network, subnet=subnet,
@@ -405,7 +434,7 @@
             # "circular dependency". So here just use try...except to
             # ensure tenant deletion without big changes.
             try:
-                if CONF.service_available.neutron:
+                if self.neutron_available:
                     self._cleanup_default_secgroup(creds.tenant_id)
             except lib_exc.NotFound:
                 LOG.warning("failed to cleanup tenant %s's secgroup" %
diff --git a/tempest/common/preprov_creds.py b/tempest/common/preprov_creds.py
index 5992d24..5e23696 100644
--- a/tempest/common/preprov_creds.py
+++ b/tempest/common/preprov_creds.py
@@ -21,10 +21,10 @@
 import yaml
 
 from tempest import clients
-from tempest.common import cred_provider
 from tempest.common import fixed_network
 from tempest import exceptions
 from tempest.lib import auth
+from tempest.lib.common import cred_provider
 from tempest.lib import exceptions as lib_exc
 
 LOG = logging.getLogger(__name__)
@@ -35,7 +35,7 @@
         with open(path, 'r') as yaml_file:
             accounts = yaml.load(yaml_file)
     except IOError:
-        raise exceptions.InvalidConfiguration(
+        raise lib_exc.InvalidConfiguration(
             'The path for the test accounts file: %s '
             'could not be found' % path)
     return accounts
diff --git a/tempest/common/utils/linux/remote_client.py b/tempest/common/utils/linux/remote_client.py
index 7cb9ebe..9ec217f 100644
--- a/tempest/common/utils/linux/remote_client.py
+++ b/tempest/common/utils/linux/remote_client.py
@@ -19,7 +19,6 @@
 from oslo_log import log as logging
 
 from tempest import config
-from tempest import exceptions
 from tempest.lib.common import ssh
 from tempest.lib.common.utils import test_utils
 import tempest.lib.exceptions
@@ -218,8 +217,8 @@
         supported_clients = ['udhcpc', 'dhclient']
         dhcp_client = CONF.scenario.dhcp_client
         if dhcp_client not in supported_clients:
-            raise exceptions.InvalidConfiguration('%s DHCP client unsupported'
-                                                  % dhcp_client)
+            raise tempest.lib.exceptions.InvalidConfiguration(
+                '%s DHCP client unsupported' % dhcp_client)
         if dhcp_client == 'udhcpc' and not fixed_ip:
             raise ValueError("need to set 'fixed_ip' for udhcpc client")
         return getattr(self, '_renew_lease_' + dhcp_client)(fixed_ip=fixed_ip)
diff --git a/tempest/exceptions.py b/tempest/exceptions.py
index da32693..727d54e 100644
--- a/tempest/exceptions.py
+++ b/tempest/exceptions.py
@@ -17,10 +17,6 @@
 from tempest.lib import exceptions
 
 
-class InvalidConfiguration(exceptions.TempestException):
-    message = "Invalid Configuration"
-
-
 class InvalidServiceTag(exceptions.TempestException):
     message = "Invalid service tag"
 
diff --git a/tempest/common/cred_provider.py b/tempest/lib/common/cred_provider.py
similarity index 100%
rename from tempest/common/cred_provider.py
rename to tempest/lib/common/cred_provider.py
diff --git a/tempest/lib/exceptions.py b/tempest/lib/exceptions.py
index a5c6b1b..a6c01bb 100644
--- a/tempest/lib/exceptions.py
+++ b/tempest/lib/exceptions.py
@@ -149,6 +149,10 @@
     message = "Unexpected response code received"
 
 
+class InvalidConfiguration(TempestException):
+    message = "Invalid Configuration"
+
+
 class InvalidIdentityVersion(TempestException):
     message = "Invalid version %(identity_version)s of the identity service"
 
diff --git a/tempest/scenario/manager.py b/tempest/scenario/manager.py
index 9559cab..3a808ce 100644
--- a/tempest/scenario/manager.py
+++ b/tempest/scenario/manager.py
@@ -57,7 +57,7 @@
             elif CONF.image_feature_enabled.api_v2:
                 cls.image_client = cls.manager.image_client_v2
             else:
-                raise exceptions.InvalidConfiguration(
+                raise lib_exc.InvalidConfiguration(
                     'Either api_v1 or api_v2 must be True in '
                     '[image-feature-enabled].')
         # Compute image client
@@ -80,12 +80,12 @@
         cls.security_group_rules_client = (
             cls.manager.security_group_rules_client)
 
-        if CONF.volume_feature_enabled.api_v1:
-            cls.volumes_client = cls.manager.volumes_client
-            cls.snapshots_client = cls.manager.snapshots_client
-        else:
+        if CONF.volume_feature_enabled.api_v2:
             cls.volumes_client = cls.manager.volumes_v2_client
             cls.snapshots_client = cls.manager.snapshots_v2_client
+        else:
+            cls.volumes_client = cls.manager.volumes_client
+            cls.snapshots_client = cls.manager.snapshots_client
 
     # ## Test functions library
     #
@@ -639,7 +639,7 @@
                     return address['addr']
             raise exceptions.ServerUnreachable(server_id=server['id'])
         else:
-            raise exceptions.InvalidConfiguration()
+            raise lib_exc.InvalidConfiguration()
 
 
 class NetworkScenarioTest(ScenarioTest):
@@ -1177,7 +1177,7 @@
             # https://blueprints.launchpad.net/tempest/+spec/test-accounts
             if not CONF.compute.fixed_network_name:
                 m = 'fixed_network_name must be specified in config'
-                raise exceptions.InvalidConfiguration(m)
+                raise lib_exc.InvalidConfiguration(m)
             network = self._get_network_by_name(
                 CONF.compute.fixed_network_name)
             router = None
@@ -1363,14 +1363,14 @@
     @classmethod
     def setup_clients(cls):
         super(EncryptionScenarioTest, cls).setup_clients()
-        if CONF.volume_feature_enabled.api_v1:
-            cls.admin_volume_types_client = cls.os_adm.volume_types_client
-            cls.admin_encryption_types_client =\
-                cls.os_adm.encryption_types_client
-        else:
+        if CONF.volume_feature_enabled.api_v2:
             cls.admin_volume_types_client = cls.os_adm.volume_types_v2_client
             cls.admin_encryption_types_client =\
                 cls.os_adm.encryption_types_v2_client
+        else:
+            cls.admin_volume_types_client = cls.os_adm.volume_types_client
+            cls.admin_encryption_types_client =\
+                cls.os_adm.encryption_types_client
 
     def create_volume_type(self, client=None, name=None):
         if not client:
diff --git a/tempest/scenario/test_server_multinode.py b/tempest/scenario/test_server_multinode.py
index b323d2a..333079c 100644
--- a/tempest/scenario/test_server_multinode.py
+++ b/tempest/scenario/test_server_multinode.py
@@ -15,7 +15,7 @@
 
 
 from tempest import config
-from tempest import exceptions
+from tempest.lib import exceptions
 from tempest.scenario import manager
 from tempest import test
 
diff --git a/tempest/tests/common/test_custom_matchers.py b/tempest/tests/common/test_custom_matchers.py
index 2656a47..07867fc 100644
--- a/tempest/tests/common/test_custom_matchers.py
+++ b/tempest/tests/common/test_custom_matchers.py
@@ -16,11 +16,47 @@
 from tempest.common import custom_matchers
 from tempest.tests import base
 
-from testtools.tests.matchers import helpers
+
+# Stolen from testtools/testtools/tests/matchers/helpers.py
+class TestMatchersInterface(object):
+
+    def test_matches_match(self):
+        matcher = self.matches_matcher
+        matches = self.matches_matches
+        mismatches = self.matches_mismatches
+        for candidate in matches:
+            self.assertEqual(None, matcher.match(candidate))
+        for candidate in mismatches:
+            mismatch = matcher.match(candidate)
+            self.assertNotEqual(None, mismatch)
+            self.assertNotEqual(None, getattr(mismatch, 'describe', None))
+
+    def test__str__(self):
+        # [(expected, object to __str__)].
+        from testtools.matchers._doctest import DocTestMatches
+        examples = self.str_examples
+        for expected, matcher in examples:
+            self.assertThat(matcher, DocTestMatches(expected))
+
+    def test_describe_difference(self):
+        # [(expected, matchee, matcher), ...]
+        examples = self.describe_examples
+        for difference, matchee, matcher in examples:
+            mismatch = matcher.match(matchee)
+            self.assertEqual(difference, mismatch.describe())
+
+    def test_mismatch_details(self):
+        # The mismatch object must provide get_details, which must return a
+        # dictionary mapping names to Content objects.
+        examples = self.describe_examples
+        for difference, matchee, matcher in examples:
+            mismatch = matcher.match(matchee)
+            details = mismatch.get_details()
+            self.assertEqual(dict(details), details)
 
 
 class TestMatchesDictExceptForKeys(base.TestCase,
-                                   helpers.TestMatchersInterface):
+                                   TestMatchersInterface):
 
     matches_matcher = custom_matchers.MatchesDictExceptForKeys(
         {'a': 1, 'b': 2, 'c': 3, 'd': 4}, ['c', 'd'])
diff --git a/tempest/tests/common/test_dynamic_creds.py b/tempest/tests/common/test_dynamic_creds.py
index 0033d4e..a90ca8a 100644
--- a/tempest/tests/common/test_dynamic_creds.py
+++ b/tempest/tests/common/test_dynamic_creds.py
@@ -19,7 +19,6 @@
 from tempest.common import credentials_factory as credentials
 from tempest.common import dynamic_creds
 from tempest import config
-from tempest import exceptions
 from tempest.lib.common import rest_client
 from tempest.lib import exceptions as lib_exc
 from tempest.lib.services.identity.v2 import identity_client as v2_iden_client
@@ -176,7 +175,6 @@
 
     @mock.patch('tempest.lib.common.rest_client.RestClient')
     def test_primary_creds(self, MockRestClient):
-        cfg.CONF.set_default('neutron', False, 'service_available')
         creds = dynamic_creds.DynamicCredentialProvider(**self.fixed_params)
         self._mock_assign_user_role()
         self._mock_list_role()
@@ -191,7 +189,6 @@
 
     @mock.patch('tempest.lib.common.rest_client.RestClient')
     def test_admin_creds(self, MockRestClient):
-        cfg.CONF.set_default('neutron', False, 'service_available')
         creds = dynamic_creds.DynamicCredentialProvider(**self.fixed_params)
         self._mock_list_roles('1234', 'admin')
         self._mock_user_create('1234', 'fake_admin_user')
@@ -214,7 +211,6 @@
 
     @mock.patch('tempest.lib.common.rest_client.RestClient')
     def test_role_creds(self, MockRestClient):
-        cfg.CONF.set_default('neutron', False, 'service_available')
         creds = dynamic_creds.DynamicCredentialProvider(**self.fixed_params)
         self._mock_list_2_roles()
         self._mock_user_create('1234', 'fake_role_user')
@@ -243,7 +239,6 @@
 
     @mock.patch('tempest.lib.common.rest_client.RestClient')
     def test_all_cred_cleanup(self, MockRestClient):
-        cfg.CONF.set_default('neutron', False, 'service_available')
         creds = dynamic_creds.DynamicCredentialProvider(**self.fixed_params)
         self._mock_assign_user_role()
         self._mock_list_role()
@@ -281,7 +276,6 @@
 
     @mock.patch('tempest.lib.common.rest_client.RestClient')
     def test_alt_creds(self, MockRestClient):
-        cfg.CONF.set_default('neutron', False, 'service_available')
         creds = dynamic_creds.DynamicCredentialProvider(**self.fixed_params)
         self._mock_assign_user_role()
         self._mock_list_role()
@@ -296,8 +290,10 @@
 
     @mock.patch('tempest.lib.common.rest_client.RestClient')
     def test_no_network_creation_with_config_set(self, MockRestClient):
-        cfg.CONF.set_default('create_isolated_networks', False, group='auth')
-        creds = dynamic_creds.DynamicCredentialProvider(**self.fixed_params)
+        creds = dynamic_creds.DynamicCredentialProvider(
+            neutron_available=True, create_networks=False,
+            project_network_cidr='10.100.0.0/16', project_network_mask_bits=28,
+            **self.fixed_params)
         self._mock_assign_user_role()
         self._mock_list_role()
         self._mock_user_create('1234', 'fake_prim_user')
@@ -325,7 +321,10 @@
 
     @mock.patch('tempest.lib.common.rest_client.RestClient')
     def test_network_creation(self, MockRestClient):
-        creds = dynamic_creds.DynamicCredentialProvider(**self.fixed_params)
+        creds = dynamic_creds.DynamicCredentialProvider(
+            neutron_available=True,
+            project_network_cidr='10.100.0.0/16', project_network_mask_bits=28,
+            **self.fixed_params)
         self._mock_assign_user_role()
         self._mock_list_role()
         self._mock_user_create('1234', 'fake_prim_user')
@@ -356,7 +355,10 @@
                                          "description": args['name'],
                                          "security_group_rules": [],
                                          "id": "sg-%s" % args['tenant_id']}]}
-        creds = dynamic_creds.DynamicCredentialProvider(**self.fixed_params)
+        creds = dynamic_creds.DynamicCredentialProvider(
+            neutron_available=True,
+            project_network_cidr='10.100.0.0/16', project_network_mask_bits=28,
+            **self.fixed_params)
         # Create primary tenant and network
         self._mock_assign_user_role()
         self._mock_list_role()
@@ -460,7 +462,10 @@
 
     @mock.patch('tempest.lib.common.rest_client.RestClient')
     def test_network_alt_creation(self, MockRestClient):
-        creds = dynamic_creds.DynamicCredentialProvider(**self.fixed_params)
+        creds = dynamic_creds.DynamicCredentialProvider(
+            neutron_available=True,
+            project_network_cidr='10.100.0.0/16', project_network_mask_bits=28,
+            **self.fixed_params)
         self._mock_assign_user_role()
         self._mock_list_role()
         self._mock_user_create('1234', 'fake_alt_user')
@@ -485,7 +490,10 @@
 
     @mock.patch('tempest.lib.common.rest_client.RestClient')
     def test_network_admin_creation(self, MockRestClient):
-        creds = dynamic_creds.DynamicCredentialProvider(**self.fixed_params)
+        creds = dynamic_creds.DynamicCredentialProvider(
+            neutron_available=True,
+            project_network_cidr='10.100.0.0/16', project_network_mask_bits=28,
+            **self.fixed_params)
         self._mock_assign_user_role()
         self._mock_user_create('1234', 'fake_admin_user')
         self._mock_tenant_create('1234', 'fake_admin_tenant')
@@ -517,6 +525,8 @@
             'dhcp': False,
         }
         creds = dynamic_creds.DynamicCredentialProvider(
+            neutron_available=True,
+            project_network_cidr='10.100.0.0/16', project_network_mask_bits=28,
             network_resources=net_dict,
             **self.fixed_params)
         self._mock_assign_user_role()
@@ -553,13 +563,15 @@
             'dhcp': False,
         }
         creds = dynamic_creds.DynamicCredentialProvider(
+            neutron_available=True,
+            project_network_cidr='10.100.0.0/16', project_network_mask_bits=28,
             network_resources=net_dict,
             **self.fixed_params)
         self._mock_assign_user_role()
         self._mock_list_role()
         self._mock_user_create('1234', 'fake_prim_user')
         self._mock_tenant_create('1234', 'fake_prim_tenant')
-        self.assertRaises(exceptions.InvalidConfiguration,
+        self.assertRaises(lib_exc.InvalidConfiguration,
                           creds.get_primary_creds)
 
     @mock.patch('tempest.lib.common.rest_client.RestClient')
@@ -571,13 +583,15 @@
             'dhcp': False,
         }
         creds = dynamic_creds.DynamicCredentialProvider(
+            neutron_available=True,
+            project_network_cidr='10.100.0.0/16', project_network_mask_bits=28,
             network_resources=net_dict,
             **self.fixed_params)
         self._mock_assign_user_role()
         self._mock_list_role()
         self._mock_user_create('1234', 'fake_prim_user')
         self._mock_tenant_create('1234', 'fake_prim_tenant')
-        self.assertRaises(exceptions.InvalidConfiguration,
+        self.assertRaises(lib_exc.InvalidConfiguration,
                           creds.get_primary_creds)
 
     @mock.patch('tempest.lib.common.rest_client.RestClient')
@@ -589,13 +603,15 @@
             'dhcp': True,
         }
         creds = dynamic_creds.DynamicCredentialProvider(
+            neutron_available=True,
+            project_network_cidr='10.100.0.0/16', project_network_mask_bits=28,
             network_resources=net_dict,
             **self.fixed_params)
         self._mock_assign_user_role()
         self._mock_list_role()
         self._mock_user_create('1234', 'fake_prim_user')
         self._mock_tenant_create('1234', 'fake_prim_tenant')
-        self.assertRaises(exceptions.InvalidConfiguration,
+        self.assertRaises(lib_exc.InvalidConfiguration,
                           creds.get_primary_creds)
 
 
diff --git a/tempest/tests/common/test_preprov_creds.py b/tempest/tests/common/test_preprov_creds.py
index 13d4713..f824b6c 100644
--- a/tempest/tests/common/test_preprov_creds.py
+++ b/tempest/tests/common/test_preprov_creds.py
@@ -23,10 +23,10 @@
 import shutil
 import six
 
-from tempest.common import cred_provider
 from tempest.common import preprov_creds
 from tempest import config
 from tempest.lib import auth
+from tempest.lib.common import cred_provider
 from tempest.lib import exceptions as lib_exc
 from tempest.tests import base
 from tempest.tests import fake_config