Import fernet providers only if used in keystone-manage

The fernet provider is optional and has extra requirements beyond
other token providers. keystone-manage shouldn't require these
extra requirements just to run.

Closes-Bug: 1440123
Change-Id: I2363e090372bdb709a6754a216db45fc649a5aed

1 files changed, 4 insertions, 1 deletions

diff --git a/keystone/cli.py b/keystone/cli.py
index 6158973f2..8df48348b 100644
--- a/keystone/cli.py
+++ b/keystone/cli.py
@@ -29,7 +29,6 @@ from keystone import config
 from keystone.i18n import _, _LW
 from keystone import identity
 from keystone import token
-from keystone.token.providers.fernet import utils as fernet
 
 
 CONF = cfg.CONF
@@ -192,6 +191,8 @@ class FernetSetup(BasePermissionsSetup):
 
     @classmethod
     def main(cls):
+        from keystone.token.providers.fernet import utils as fernet
+
         keystone_user_id, keystone_group_id = cls.get_user_group()
         fernet.create_key_directory(keystone_user_id, keystone_group_id)
         if fernet.validate_key_repository():
@@ -221,6 +222,8 @@ class FernetRotate(BasePermissionsSetup):
 
     @classmethod
     def main(cls):
+        from keystone.token.providers.fernet import utils as fernet
+
         keystone_user_id, keystone_group_id = cls.get_user_group()
         if fernet.validate_key_repository():
             fernet.rotate_keys(keystone_user_id, keystone_group_id)