Comment 7 for bug 1372710

For some reason this has been marked incomplete for keystoneclient, but FWIW, last time boto broke us like this, I worked around it by changing the logic in keystoneclient dependent on boto version:

https://github.com/openstack/python-keystoneclient/blob/master/keystoneclient/contrib/ec2/utils.py#L219

It's a bit ugly, but given that boto arbitrarily changes stuff like this periodically it seems like the only option - multiple validation calls to keystone from the API seems suboptimal to say the least.

It makes me wonder what AWS actually does, given that stuff like this appears to change randomly in boto without any change in the signature version - I can only assume the AWS signature check is somehow tolerant of stuff like this, or that they periodically break all their users and boto has to change their stuff to match?