diff --git a/_modules/runtest/tempest_sections/auth.py b/_modules/runtest/tempest_sections/auth.py
index aae2cbd..3d9b4ba 100644
--- a/_modules/runtest/tempest_sections/auth.py
+++ b/_modules/runtest/tempest_sections/auth.py
@@ -54,9 +54,16 @@
         # Look for nova only as it is core openstack service and present on each installation.
         # Assume if barbican is enabled in nova, its integration enabled globally.
 
+        roles = []
+        contrail_enabled = conditions.BaseRule('*.opencontrail.control.enabled',
+                                               'eq', True, multiple='any')
+        if contrail_enabled.check(self.pillar):
+            roles.append("admin")
         c = conditions.BaseRule('nova.controller.enabled', 'eq', True)
         if self.get_item_when_condition_match('nova.controller.barbican.enabled', c):
-            return 'creator'
+            roles.append("creator")
+        if roles:
+            return ', '.join(roles)
 
     @property
     def test_accounts_file(self):
diff --git a/_modules/runtest/tempest_sections/patrole_plugin.py b/_modules/runtest/tempest_sections/patrole_plugin.py
index f74284b..20f6a76 100644
--- a/_modules/runtest/tempest_sections/patrole_plugin.py
+++ b/_modules/runtest/tempest_sections/patrole_plugin.py
@@ -25,9 +25,9 @@
 
     @property
     def custom_policy_files(self):
-        contrail_enabled = conditions.BaseRule('opencontrail.control.enabled',
+        contrail_enabled = conditions.BaseRule('*.opencontrail.control.enabled',
                                                'eq', True, multiple='any')
-        if contrail_enabled:
+        if contrail_enabled.check(self.pillar):
             return '/etc/opencontrail/policy.json'
         else:
             pass
diff --git a/_modules/runtest/tempest_sections/tungsten_plugin.py b/_modules/runtest/tempest_sections/tungsten_plugin.py
index 8b477ae..2b86029 100644
--- a/_modules/runtest/tempest_sections/tungsten_plugin.py
+++ b/_modules/runtest/tempest_sections/tungsten_plugin.py
@@ -23,9 +23,9 @@
 
     @property
     def catalog_type(self):
-        contrail_enabled = conditions.BaseRule('opencontrail.control.enabled',
+        contrail_enabled = conditions.BaseRule('*.opencontrail.control.enabled',
                                                'eq', True, multiple='any')
-        if contrail_enabled:
+        if contrail_enabled.check(self.pillar):
             c = conditions.BaseRule('keystone.client.enabled', 'eq', True)
             return self.get_item_when_condition_match(
                 'keystone.client.server.identity.service.opencontrail.type', c)