Returns a client connected to the Keystone backend.

    Several forms of authentication are supported:

        * Username + password -> Unscoped authentication
        * Username + password + tenant id -> Scoped authentication
        * Unscoped token -> Unscoped authentication
        * Unscoped token + tenant id -> Scoped authentication
        * Scoped token -> Scoped authentication

    Available services and data from the backend will vary depending on
    whether the authentication was scoped or unscoped.

    Lazy authentication if an ``endpoint`` parameter is provided.

    Calls requiring the admin endpoint should have ``admin=True`` passed in
    as a keyword argument.

    The client is cached so that subsequent API calls during the same
    request/response cycle don't have to be re-authenticated.

def keystoneclient(request, admin=False):
    """Returns a client connected to the Keystone backend.

    Several forms of authentication are supported:

        * Username + password -> Unscoped authentication
        * Username + password + tenant id -> Scoped authentication
        * Unscoped token -> Unscoped authentication
        * Unscoped token + tenant id -> Scoped authentication
        * Scoped token -> Scoped authentication

    Available services and data from the backend will vary depending on
    whether the authentication was scoped or unscoped.

    Lazy authentication if an ``endpoint`` parameter is provided.

    Calls requiring the admin endpoint should have ``admin=True`` passed in
    as a keyword argument.

    The client is cached so that subsequent API calls during the same
    request/response cycle don't have to be re-authenticated.
    """
    client_version = VERSIONS.get_active_version()
    user = request.user
    token_id = user.token.id

    if is_multi_domain_enabled():
        # Cloud Admin, Domain Admin or Mixed Domain Admin
        if is_domain_admin(request):
            domain_token = request.session.get('domain_token')
            if domain_token:
                token_id = getattr(domain_token, 'auth_token', None)

    if admin:
        if not policy.check((("identity", "admin_required"),), request):
            raise exceptions.NotAuthorized
        endpoint_type = 'adminURL'
    else:
        endpoint_type = getattr(settings,
                                'OPENSTACK_ENDPOINT_TYPE',
                                'publicURL')

    # Take care of client connection caching/fetching a new client.
    # Admin vs. non-admin clients are cached separately for token matching.
    cache_attr = "_keystoneclient_admin" if admin \
        else backend.KEYSTONE_CLIENT_ATTR
    if (hasattr(request, cache_attr) and
        (not user.token.id or
         getattr(request, cache_attr).auth_token == user.token.id)):
        conn = getattr(request, cache_attr)
    else:
        endpoint = _get_endpoint_url(request, endpoint_type)
        verify = not getattr(settings, 'OPENSTACK_SSL_NO_VERIFY', False)
        cacert = getattr(settings, 'OPENSTACK_SSL_CACERT', None)
        verify = verify and cacert
        LOG.debug("Creating a new keystoneclient connection to %s.", endpoint)
        remote_addr = request.environ.get('REMOTE_ADDR', '')
        token_auth = token_endpoint.Token(endpoint=endpoint,
                                          token=token_id)
        keystone_session = session.Session(auth=token_auth,
                                           original_ip=remote_addr,
                                           verify=verify)
        conn = client_version['client'].Client(session=keystone_session,
                                               debug=settings.DEBUG)
        setattr(request, cache_attr, conn)
    return conn