diff --git a/_modules/runtest/tempest_sections/auth.py b/_modules/runtest/tempest_sections/auth.py
index aae2cbd..be7e38d 100644
--- a/_modules/runtest/tempest_sections/auth.py
+++ b/_modules/runtest/tempest_sections/auth.py
@@ -53,10 +53,16 @@
         # Barbican may be enabled in several components like nova,glance,cinder.
         # Look for nova only as it is core openstack service and present on each installation.
         # Assume if barbican is enabled in nova, its integration enabled globally.
-
+        roles = []
+        contrail_enabled = conditions.BaseRule('opencontrail.control.enabled',
+                                               'eq', True, multiple='any')
+        if contrail_enabled:
+            roles.append("admin")
         c = conditions.BaseRule('nova.controller.enabled', 'eq', True)
         if self.get_item_when_condition_match('nova.controller.barbican.enabled', c):
-            return 'creator'
+            roles.append("creator")
+        if roles:
+            return ', '.join(roles)
 
     @property
     def test_accounts_file(self):