Comment 1 for bug 1522402

It's true, novaclient doesn't yet support v3 keystone auth, that is, it doesn't support the request/response format for the keystone v3 tokens call. The openstackclient, however, does have support [1]. The openstackclient uses novaclient underneath for calling nova apis, so as long as a call is made through novaclient with an already obtained token, it works (openstackclient code obtains the token and passes it through novaclient code). Similarly, nova should work (albeit unaware of any hierarchical tenancy concepts) as long as the api is called with the v3 token. That means usual calls work but you can't assign hierarchical project quota, for example.

Hope this helps.

[1] http://docs.openstack.org/developer/python-openstackclient/authentication.html#authenticating-using-identity-server-api-v3