def __init__(self, identity, network_driver, neutron):
     self.account_driver = get_account_driver(identity.provider)
     if not self.account_driver:
         raise Exception(
             "ConfigError: Cannot use ExternalRouter topology without an "
             "AccountDriver. Please add an AccountProvider linked to an "
             "Identity who has the 'admin' role on Openstack "
             "_or_ use ExternalNetworkTopology to continue"
         )
     router_name = identity.get_credential('router_name')
     if not router_name:
         router_name = identity.provider.get_credential('router_name')
     if not router_name:
         router_name = identity.provider.select_router()
         from core.models import Credential
         Credential.objects.get_or_create(
             identity=identity, key='router_name', value=router_name
         )
     if not router_name:
         raise Exception(
             "Unknown Router - Identity %s is missing 'router_name' " %
             identity
         )
     self.external_router_name = router_name
     return super(ExternalRouter,
                  self).__init__(identity, network_driver, neutron)

def redeploy_users(provider, users=[]):
    accounts = get_account_driver(provider)
    tenant_instances_map = accounts.tenant_instances_map(status_list=['deploy_error', 'networking','deploying','initializing'])
    for tenant, instance_list in tenant_instances_map.iteritems():
        username = tenant.name
        if users and username not in users:
            print "Found affected user:%s and Instances:%s - Skipping because they aren't in the list." % (username, instance_list)
            continue
        for instance in instance_list:
            metadata = instance._node.extra.get('metadata',{})
            instance_status = instance.extra.get('status')
            tmp_status = metadata.get('tmp_status','')
            print "Starting idempotent redeployment for %s - Instance: %s (%s - %s)" % (username, instance.id, instance_status, tmp_status)
            ident = Identity.objects.get(provider=provider, created_by__username=username)
            driver = get_esh_driver(ident)
            try:
                start_task = get_idempotent_deploy_chain(driver.__class__, driver.provider, driver.identity, instance, username)
                print "Starting idempotent redeployment: %s ..." % (start_task),
                start_task.apply_async()
            except Identity.DoesNotExist:
                print "Identity does not exist in this DB. SKIPPED."
                continue
            if DO_NOTHING:
                continue
            print " Sent"

def _fix_new_machine_forked(machine_request, provider, new_machine):
    app_uuid = _generate_app_uuid(new_machine.identifier)
    if not machine_request.new_version_forked:
        return False
    if Application.objects.filter(uuid=app_uuid).count():
        return False
    print "OK: This MachineRequest: %s has a BAD Application." \
        "\tUUID should be %s." % (machine_request, app_uuid)
    old_application = new_machine.application
    current_application = _create_new_application(
        machine_request,
        new_machine.identifier)

    remaining_machines = old_application._current_machines()
    for machine in remaining_machines:
        if machine.identifier == new_machine.identifier:
            new_machine.application = current_application
            new_machine.save()
    current_application.save()
    # Pass #2 - If remaining, unmatched ids:
    remaining_machines = old_application._current_machines()

    acct_provider = machine_request.new_machine_provider
    accounts = get_account_driver(acct_provider)

    if remaining_machines:
        print "Warn: These machines likely point to the wrong application.:%s" % remaining_machines
        for machine in remaining_machines:
            glance_image = accounts.image_manager.get_image(machine.identifier)
            if glance_image:
                original_request = MachineRequest.objects.filter(
                    new_application_name=glance_image.name)
                print "Hint: Image_ID:%s Named:%s MachineRequest:%s" % (glance_image.id, glance_image.name, original_request)

    return True

def create_new_account_for(provider, user):
    from service.exceptions import AccountCreationConflict
    from service.driver import get_account_driver
    existing_user_list = provider.identity_set.values_list(
        'created_by__username', flat=True
    )
    if user.username in existing_user_list:
        logger.info(
            "Accounts already exists on %s for %s" %
            (provider.location, user.username)
        )
        return None
    try:
        accounts = get_account_driver(provider)
        logger.info("Create NEW account for %s" % user.username)
        default_quota = DefaultQuotaPluginManager.default_quota(
            user=user, provider=provider
        )
        new_identity = accounts.create_account(
            user.username, quota=default_quota
        )
        return new_identity
    except AccountCreationConflict:
        raise    # TODO: Ideally, have sentry handle these events, rather than force an Unhandled 500 to bubble up.
    except:
        logger.exception(
            "Could *NOT* Create NEW account for %s" % user.username
        )
        return None

def fix_requests(provider, requests=[]):
    accounts = get_account_driver(provider)
    for request_id in requests:
        try:
            machine_request = MachineRequest.objects.get(id=request_id)
        except MachineRequest.DoesNotExist:
            print "Warn: MachineRequest by this ID could not be found: %s" % request_id
            continue

        if machine_request.new_machine_provider != provider:
            raise ValueError(
                "MachineRequest ID:%s is for Provider:%s. Testing Provider is:%s" %
                (request_id, machine_request.new_machine_provider, provider))
    fixed = False
    try:
        new_machine = ProviderMachine.objects.get(
            id=machine_request.new_machine_id)
    except ProviderMachine.DoesNotExist as no_match:
        print "OK: This MachineRequest has a BAD 'new_machine' (DoesNotExist)"
        new_machine = None
    if not fixed:
        fixed = _fix_wrong_machine_on_request(
            machine_request,
            provider,
            new_machine)
    if not fixed and new_machine:
        _fix_new_version_forked(machine_request, provider, new_machine)

    def post(self, request, cloud_admin_uuid):
        """
        Passes in:
        Username (To apply the identity to)
        Credentials (Nested, will be applied to new identity)

        """
        user = request.user
        data = request.DATA
        try:
            provider_uuid = data['provider']
            provider = Provider.objects.get(
                cloudadministrator__user=user,
                uuid=provider_uuid)
        except KeyError:
            return Response(
                "Missing 'provider' key, Expected UUID. Received no value.",
                status=status.HTTP_409_conflict)
        except Exception:
            return Response(
                "Provider with UUID %s does not exist" % provider_uuid,
                status=status.HTTP_409_conflict)
            raise Exception
        driver = get_account_driver(provider)
        missing_args = driver.clean_credentials(data)
        if missing_args:
            raise Exception("Cannot create account. Missing credentials: %s"
                            % missing_args)
        identity = driver.create_account(**data)
        serializer = IdentitySerializer(identity)

        # TODO: Account creation SHOULD return IdentityMembership NOT identity.
        return Response(serializer.data)

 def validate_account_driver(self, validated_data):
     try:
         provider = validated_data['provider']
         acct_driver = get_account_driver(provider, raise_exception=True)
         return acct_driver
     except Exception as exc:
         raise serializers.ValidationError("Attempting to create an account for provider %s failed. Message: %s" % (provider, exc.message))

def update_cloud_membership_for_machine(provider_machine, group):
    """
    Given a provider_machine and a group
    * Loop through identities owned by group
    * * If identity.provider == provider_machine.provider, allow identity to launch via cloud ACLs
    """
    prov = provider_machine.instance_source.provider
    accounts = get_account_driver(prov)
    if not accounts:
        raise NotImplemented("Account Driver could not be created for %s" % prov)
    accounts.clear_cache()
    admin_driver = accounts.admin_driver  # cache has been cleared
    if not admin_driver:
        raise NotImplemented("Admin Driver could not be created for %s" % prov)
    img = accounts.get_image(provider_machine.identifier)
    if img.get('visibility') != 'shared':
       logger.debug("Skipped updates for image %s -- visibility (%s) is not 'shared'", img.id, img.get('visibility'))
       return
    approved_projects = accounts.get_image_members(img.id)
    for identity_membership in group.identitymembership_set.all():
        if identity_membership.identity.provider != prov:
            logger.debug("Skipped %s -- Wrong provider" % identity_membership.identity)
            continue
        # Get project name from the identity's credential-list
        identity = identity_membership.identity
        project_name = identity.get_credential('ex_project_name')
        project = accounts.get_project(project_name)
        if not project:
            logger.debug("Unknown Project: %s -- Does not exist" % project)
            continue
        elif project in approved_projects:
            logger.debug("Skipped Project: %s -- Already shared" % project)
            continue
        accounts.share_image_with_identity(img, identity)

def print_instances(provider, users=[], status_list=[]):
    accounts = get_account_driver(provider)
    tenant_instances_map = accounts.tenant_instances_map(
        status_list=status_list,
        match_all=MATCH_ALL)
    for tenant, instance_list in tenant_instances_map.iteritems():
        username = tenant.name
        if users and username not in users:
            continue
        for instance in instance_list:
            instance_status = instance.extra.get('status')
            task = instance.extra.get('task')
            metadata = instance.extra.get('metadata', {})
            tmp_status = metadata.get('tmp_status', '')
            created = instance.extra.get('created', "N/A")
            updated = instance.extra.get('updated', "N/A")
            status_name = _get_status_name_for_provider(
                provider,
                instance_status,
                task,
                tmp_status)
            try:
                last_history = Instance.objects.get(
                    provider_alias=instance.id).get_last_history()
            except:
                last_history = "N/A (Instance not in this DB)"
            print "Tenant:%s Instance:%s Status: (%s - %s) Created:%s Updated:%s, Last History:%s" % (username, instance.id, instance_status, tmp_status, created, updated, last_history)

def update_application_owner(application, identity):
    from service.openstack import glance_update_machine_metadata
    from service.driver import get_account_driver

    old_identity = application.created_by_identity
    tenant_name = _extract_tenant_name(identity)
    old_tenant_name = _extract_tenant_name(old_identity)
    # Prepare the application
    application.created_by_identity = identity
    application.created_by = identity.created_by
    application.save()
    # Update all the PMs
    all_pms = application.providermachine_set.all()
    print "Updating %s machines.." % len(all_pms)
    for provider_machine in all_pms:
        accounts = get_account_driver(provider_machine.provider)
        image_id = provider_machine.instance_source.identifier
        image = accounts.get_image(image_id)
        if not image:
            continue
        tenant_id = accounts.get_project(tenant_name).id
        glance_update_machine_metadata(provider_machine, {"owner": tenant_id, "application_owner": tenant_name})
        print "App data saved for %s" % image_id
        accounts.image_manager.share_image(image, tenant_name)
        print "Shared access to %s with %s" % (image_id, tenant_name)
        accounts.image_manager.unshare_image(image, old_tenant_name)
        print "Removed access to %s for %s" % (image_id, old_tenant_name)

def _get_instance_owner_map(provider, users=None):
    """
    All keys == All identities
    Values = List of identities / username
    NOTE: This is KEYSTONE && NOVA specific. the 'instance owner' here is the
          username // ex_tenant_name
    """
    from service.driver import get_account_driver

    accounts = get_account_driver(provider=provider, raise_exception=True)
    all_identities = _select_identities(provider, users)
    acct_providers = AccountProvider.objects.filter(provider=provider)
    if acct_providers:
        account_identity = acct_providers[0].identity
        provider = None
    else:
        account_identity = None

    all_instances = get_cached_instances(
        provider=provider, identity=account_identity, force=True
    )
    #all_tenants = admin_driver._connection._keystone_list_tenants()
    all_tenants = accounts.list_projects()
    # Convert instance.owner from tenant-id to tenant-name all at once
    all_instances = _convert_tenant_id_to_names(all_instances, all_tenants)
    # Make a mapping of owner-to-instance
    instance_map = _make_instance_owner_map(all_instances, users=users)
    logger.info("Instance owner map created")
    identity_map = _include_all_idents(all_identities, instance_map)
    logger.info("Identity map created")
    return identity_map

def main():
    parser = argparse.ArgumentParser()
    parser.add_argument("--dry-run", action="store_true",
                        help="List of provider names and IDs")
    args = parser.parse_args()
    admin_owned_apps = Application.objects.filter(
        created_by__username__contains='admin').filter(only_current_apps()).distinct()
    account_drivers = {}
    # FIXME: Change the provider_id if necessary.
    for app in admin_owned_apps:
        # Step 1 - See if MachineRequest can answer the question
        machine = app._current_machines().filter(instance_source__provider__id=4).first()
        if not machine:
            continue
        mr = MachineRequest.objects.filter(new_machine=machine).first()
        if mr:
            fix_application_owner(app, mr.created_by, args.dry_run)
            continue
        # Step 2 - See if glance can answer the question
        provider = machine.provider
        if account_drivers.get(provider):
            accounts = account_drivers[provider]
        else:
            accounts = get_account_driver(provider)
            account_drivers[provider] = accounts
        img = accounts.get_image(machine.identifier)
        if not img:
            continue
        project = accounts.get_project_by_id(img.owner)
        if not project:
            continue
        user = AtmosphereUser.objects.filter(username=project.name).first()
        if user:
            fix_application_owner(app, user, args.dry_run)

def glance_image_owner(provider_uuid, identifier, glance_image=None):
    try:
        prov = Provider.objects.get(uuid=provider_uuid)
        accounts = get_account_driver(prov)
        if not glance_image:
            accounts.clear_cache()
            glance_image = accounts.get_image(identifier)
        project = accounts.user_manager.get_project_by_id(
            glance_image.get('owner')
        )
    except Exception as e:
        logger.exception(e)
        project = None

    if not project:
        return None
    try:
        image_owner = Identity.objects.get(
            provider__uuid=provider_uuid, created_by__username=project.name
        )
    except Identity.DoesNotExist:
        logger.warn(
            "Could not find a username %s on Provider %s" %
            (project.name, provider_uuid)
        )
        image_owner = None
    return image_owner

def remove_empty_networks_for(provider_id):
    provider = Provider.objects.get(id=provider_id)
    os_driver = get_account_driver(provider)
    all_instances = os_driver.admin_driver.list_all_instances()
    project_map = os_driver.network_manager.project_network_map()
    projects_with_networks = project_map.keys()
    for project in projects_with_networks:
        networks = project_map[project]['network']
        if type(networks) != list:
            networks = [networks]
        for network in networks:
            network_name = network['name']
            logger.debug("Checking if network %s is in use" % network_name)
            if running_instances(network_name, all_instances):
                continue
            #TODO: MUST change when not using 'usergroups' explicitly.
            user = project
            try:
                logger.debug("Removing project network for User:%s, Project:%s"
                             % (user, project))
                os_driver.network_manager.delete_project_network(user, project)
            except NeutronClientException:
                logger.exception("Neutron unable to remove project"
                                 "network for %s-%s" % (user,project))
            except NeutronException:
                logger.exception("Neutron unable to remove project"
                                 "network for %s-%s" % (user,project))

def _get_all_access_list(account_driver, db_machine, cloud_machine):
    """
    Input: AccountDriver, ProviderMachine, glance_image
    Output: A list of _all project names_ that should be included on `cloud_machine`

    This list will include:
    - Users who match the provider_machine's application.access_list
    - Users who are already approved to use the `cloud_machine`
    - The owner of the application/Creator of the MachineRequest
    - If using settings.REPLICATION_PROVIDER:
      - include all those approved on the replication provider's copy of the image
    """
    #TODO: In a future update to 'imaging' we might image 'as the user' rather than 'as the admin user', in this case we should just use 'owner' metadata

    image_owner = cloud_machine.get('application_owner')
    # NOTE: This assumes that the 'owner' (atmosphere user) == 'project_name' (Openstack)
    # Always include the original application owner
    owner_set = set()
    if image_owner:
        owner_set.add(image_owner)

    if hasattr(cloud_machine, 'id'):
       image_id = cloud_machine.id
    elif type(cloud_machine) == dict:
       image_id = cloud_machine.get('id')
    else:
       raise ValueError("Unexpected cloud_machine: %s" % cloud_machine)

    existing_members = account_driver.get_image_members(image_id, None)
    # Extend to include based on projects already granted access to the image
    cloud_shared_set = { p.name for p in existing_members }

    # Deprecation warning: Now that we use a script to do replication,
    # we should not need to account for shares on another provider.
    # Remove this code any time during/after the v29 release
    has_machine_request = MachineRequest.objects.filter(
        new_machine__instance_source__identifier=cloud_machine.id,
        status__name='completed').last()
    machine_request_set = set()
    machine_request_provider_set = set()
    if has_machine_request:
        access_list = has_machine_request.get_access_list()
        # NOTE: This assumes that every name in
        #      accesslist (AtmosphereUser) == project_name(Openstack)
        machine_request_set = { name.strip() for name in access_list }

        request_provider = has_machine_request.new_machine_provider
        request_identifier = has_machine_request.new_machine.instance_source.identifier
        if request_provider != db_machine.provider:
            main_account_driver = get_account_driver(request_provider)
            # Extend to include based on information in the machine request
            request_shared_projects = main_account_driver.get_image_members(request_identifier, None)
            machine_request_provider_set = set(p.name for p in request_shared_projects)
        # End deprecation warning

    # Extend to include new names found by application pattern_match
    parent_app = db_machine.application_version.application
    access_list_set = set(parent_app.get_users_from_access_list().values_list('username', flat=True))
    shared_project_names = list(owner_set | cloud_shared_set | machine_request_set | machine_request_provider_set | access_list_set)
    return shared_project_names

def upload_privacy_data(machine_request, new_machine):
    """
    ASSERT: The image in 'new_machine' SHOULD BE private
    (Based on values in machine_request)
    """
    prov = new_machine.provider
    accounts = get_account_driver(prov)
    if not accounts:
        print "Aborting import: Could not retrieve Account Driver "\
            "for Provider %s" % prov
        return
    img = accounts.get_image(new_machine.identifier)
    if hasattr(img, 'visibility'):  # Treated as an obj.
        is_public = img.visibility == 'public'
    elif hasattr(img, 'items'):  # Treated as a dict.
        is_public = img.get('visibility','N/A') == 'public'

    if is_public:
        print "Marking image %s private" % img.id
        accounts.image_manager.update_image(img, visibility='private')

    accounts.clear_cache()
    admin_driver = accounts.admin_driver  # cache has been cleared
    if not admin_driver:
        print "Aborting import: Could not retrieve admin_driver "\
            "for Provider %s" % prov
        return
    img = accounts.get_image(new_machine.identifier)
    tenant_list = machine_request.get_access_list()
    # All in the list will be added as 'sharing' the OStack img
    # All tenants already sharing the OStack img will be added to this list
    return sync_machine_membership(accounts, img, new_machine, tenant_list)

def main():
    parser = argparse.ArgumentParser()
    parser.add_argument("--provider-list", action="store_true",
                        help="List of provider names and IDs")
    parser.add_argument("--quota-list", action="store_true",
                        help="List of provider names and IDs")
    parser.add_argument("--provider-id", type=int,
                        help="Atmosphere provider ID"
                        " to use when importing users.")
    parser.add_argument("--quota-id",
                        help="Atmosphere Quota ID to assign (Optional)")
    parser.add_argument("--groups",
                        help="LDAP groups to import. (comma separated)")
    parser.add_argument("--dry-run", action="store_true",
                        help="A 'dry-run' so you know what will happen,"
                             " before it happens")
    parser.add_argument("--users",
                        help="LDAP usernames to import. (comma separated)")
    parser.add_argument("--admin", action="store_true",
                        help="ALL Users addded are treated as admin and staff "
                        "users. They also receive the maximum quota.")
    args = parser.parse_args()
    make_admins = args.admin
    dry_run = args.dry_run
    users = None
    quota = None
    if args.provider_list:
        print "ID\tName"
        for p in Provider.objects.all().order_by('id'):
            print "%d\t%s" % (p.id, p.location)
        return
    elif args.quota_list:
        print "ID\tSpecs"
        for q in Quota.objects.all().order_by('id'):
            print "%s\t%s" % (q.id, q)
        return

    #Debugging args
    if dry_run:
        print "Dry run initialized.."

    #Optional args
    if args.quota_id:
        quota = Quota.objects.get(id=args.quota_id)

    if not args.provider_id:
        print "ERROR: provider-id is required. To get a list of providers use"\
            " --provider-list"
    provider = Provider.objects.get(id=args.provider_id)
    print "Provider Selected:%s" % provider

    acct_driver = get_account_driver(provider)

    groups = args.groups.split(",") if args.groups else []
    total_added = process_groups(acct_driver, groups, quota, make_admins, dry_run)

    users = args.users.split(",") if args.users else []
    total_added += process_users(acct_driver, users, quota, make_admins, dry_run)

    print "Processing complete. %d users processed." % total_added

def start_instance_maintenances(provider, action, users=[], sleep_time=None, dry_run=False):
    accounts = get_account_driver(provider)
    all_insts = accounts.list_all_instances()
    all_tenants = accounts.list_projects()
    all_insts = make_user_instances(all_insts, all_tenants, users)
    hostname_map = _create_hostname_mapping(all_insts)
    finished = False
    while not finished:
        #Iterate the list of hosts, complete
        finished = True
        for host in hostname_map.keys():
            inst_list = hostname_map[host]
            if len(inst_list) == 0:
                continue
            instance = inst_list.pop()
            print "Instance %s - Hostname %s" % (instance.id, host)
            status = instance.extra['status']
            if status != 'active':
                print "Skipping instance %s in state %s" % (instance.id, status)
                continue
            finished = False
            identity = Identity.objects.get(
                    created_by__username=instance.username,
                    provider=provider)
            print 'Performing Instance Maintenance - %s - %s' % (instance.id, host)
            try:
                _execute_action(identity, instance, action, dry_run)
            except Exception, e:
                print "Could not %s Instance %s - Error %s" % (action, instance.id, e)
                continue
        print "Waiting %s seconds" % sleep_time
        if not dry_run:
            time.sleep(sleep_time)

def validate_new_image(image_id, machine_request_id):
    machine_request = MachineRequest.objects.get(id=machine_request_id)
    new_status, _ = StatusType.objects.get_or_create(name="validating")
    machine_request.status = new_status
    machine_request.old_status = 'validating'
    machine_request.save()
    accounts = get_account_driver(machine_request.new_machine.provider)
    accounts.clear_cache()
    from service.instance import launch_machine_instance
    admin_driver = accounts.admin_driver
    admin_ident = machine_request.new_admin_identity()
    if not admin_driver:
        celery_logger.warn(
            "Need admin_driver functionality to auto-validate instance")
        return False
    if not admin_ident:
        celery_logger.warn(
            "Need to know the AccountProvider to auto-validate instance")
        return False
    # Attempt to launch using the admin_driver
    admin_driver.identity.user = admin_ident.created_by
    machine = admin_driver.get_machine(image_id)
    small_size = admin_driver.list_sizes()[0]
    instance = launch_machine_instance(
        admin_driver, admin_ident,
        machine, small_size,
        'Automated Image Verification - %s' % image_id,
        username='atmoadmin',
        using_admin=True)
    return instance.id

def main():
    parser = argparse.ArgumentParser()
    parser.add_argument("--provider", type=int,
                        help="Atmosphere provider ID"
                        " to use when importing users.")
    parser.add_argument("--provider-id", type=int,
                        help="Atmosphere provider ID"
                        " to use when importing users."
                        " DEPRECATION WARNING -- THIS WILL BE REMOVED SOON!")
    parser.add_argument("--provider-list",
                        action="store_true",
                        help="List of provider names and IDs")
    parser.add_argument("--rebuild", action="store_true",
                        help="Rebuild all accounts that are in the provider")
    parser.add_argument("--group",
                        help="LDAP group of usernames to import.")
    parser.add_argument("--users",
                        help="usernames to add to Atmosphere. (comma separated list with no spaces)")
    parser.add_argument("--admin", action="store_true",
                        help="Users addded as admin and staff users.")
    args = parser.parse_args()

    if args.provider_list:
        print "ID\tName"
        for p in Provider.objects.all().order_by('id'):
            print "%d\t%s" % (p.id, p.location)
        return

    usernames = []
    if args.provider_id and not args.provider:
        print "WARNING: --provider-id has been *DEPRECATED*! Use --provider instead!"
        args.provider = args.provider_id
    if args.provider:
        provider = Provider.objects.get(id=args.provider)
    else:
        raise Exception("Missing required argument: --provider <id>. use --provider-list to get a list of provider ID+names")
    print "Using Provider: %s" % provider
    try:
        acct_driver = get_account_driver(provider, raise_exception=True)
    except:
        account_provider = provider.accountprovider_set.first()
        print "Could not create the account Driver for this Provider."\
              " Check the configuration of this identity:%s" % account_provider
        raise
    if args.group:
        print "Retrieving all '%s' members in LDAP." % args.group
        usernames = get_members(args.group)
    elif args.users:
        usernames = args.users.split(",")
    else: # if not args.users
        if not args.rebuild:
            print "Retrieving all 'atmo-user' members in LDAP."
            usernames = get_members('atmo-user')
        else:
            print "Rebuilding all existing users."
            usernames = get_usernames(provider)
    return run_create_accounts(acct_driver, provider, usernames,
                               args.rebuild, args.admin)