CVE-2016-7078: Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
value: foreman before version 1.15.0 is vulnerable to an information leak through organizations and locations feature. When a user is assigned _no_ organizations/locations, they are able to view all resources instead of none (mirroring an administrator's view). The user's actions are still limited by their assigned permissions, e.g. to control viewing, editing and deletion.
CWE description: The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
CVSS v3 base score: 4.3
Published: 2018-09-10T15:29Z
Repository: https://github.com/theforeman/foreman
Language: Ruby
Files changed: app/controllers/concerns/foreman/controller/smart_proxy_auth.rb, app/controllers/users_controller.rb, app/models/concerns/taxonomix.rb, app/models/host/base.rb, app/services/sso/base.rb, app/services/sso/oauth.rb, app/services/tax_host.rb, db/migrate/20130908100439_delete_orphaned_records.rb, db/seeds.d/07-provisioning_templates.rb, db/seeds.d/08-partition_tables.rb, db/seeds.d/10-installation_media.rb, test/active_support_test_case_helper.rb, test/controllers/api/v1/auth_source_ldaps_controller_test.rb, test/controllers/api/v1/compute_resources_controller_test.rb, test/controllers/api/v1/config_templates_controller_test.rb, test/controllers/api/v1/domains_controller_test.rb, test/controllers/api/v1/environments_controller_test.rb, test/controllers/api/v1/hostgroups_controller_test.rb, test/controllers/api/v1/media_controller_test.rb, test/controllers/api/v1/ptables_controller_test.rb, test/controllers/api/v1/smart_proxies_controller_test.rb, test/controllers/api/v1/subnets_controller_test.rb, test/controllers/api/v1/users_controller_test.rb, test/controllers/api/v2/auth_source_ldaps_controller_test.rb, test/controllers/api/v2/compute_resources_controller_test.rb, test/controllers/api/v2/config_reports_controller_test.rb, test/controllers/api/v2/config_templates_controller_test.rb, test/controllers/api/v2/domains_controller_test.rb, test/controllers/api/v2/environments_controller_test.rb, test/controllers/api/v2/hostgroups_controller_test.rb, test/controllers/api/v2/hosts_controller_test.rb, test/controllers/api/v2/locations_controller_test.rb, test/controllers/api/v2/media_controller_test.rb, test/controllers/api/v2/parameters_controller_test.rb, test/controllers/api/v2/provisioning_templates_controller_test.rb, test/controllers/api/v2/ptables_controller_test.rb, test/controllers/api/v2/realms_controller_test.rb, test/controllers/api/v2/reports_controller_test.rb, test/controllers/api/v2/smart_proxies_controller_test.rb, test/controllers/api/v2/subnets_controller_test.rb, test/controllers/api/v2/users_controller_test.rb, test/controllers/application_controller_subclass_test.rb, test/controllers/auth_source_ldaps_controller_test.rb, test/controllers/compute_resources_controller_test.rb, test/controllers/compute_resources_vms_controller_test.rb, test/controllers/domains_controller_test.rb, test/controllers/environments_controller_test.rb, test/controllers/fact_values_controller_test.rb, test/controllers/hostgroups_controller_test.rb, test/controllers/hosts_controller_test.rb, test/controllers/images_controller_test.rb, test/controllers/locations_controller_test.rb, test/controllers/media_controller_test.rb, test/controllers/organizations_controller_test.rb, test/controllers/provisioning_templates_controller_test.rb, test/controllers/puppetclasses_controller_test.rb, test/controllers/realms_controller_test.rb, test/controllers/smart_proxies_controller_test.rb, test/controllers/subnets_controller_test.rb, test/controllers/unattended_controller_test.rb, test/controllers/users_controller_test.rb, test/controllers/variable_lookup_keys_controller_test.rb, test/factories/domain.rb, test/factories/host_related.rb, test/factories/smart_proxy.rb, test/factories/subnet.rb, test/factories/user_related.rb, test/fixtures/taxable_taxonomies.yml, test/integration/location_test.rb, test/integration/organization_test.rb, test/models/concerns/api_taxonomy_scope_test.rb, test/models/fact_value_test.rb, test/models/host_test.rb, test/models/nic_test.rb, test/models/report_test.rb, test/models/shared/taxonomies_base_test.rb, test/models/subnet/ipv6_test.rb, test/models/subnet_test.rb, test/models/taxonomix_test.rb, test/models/taxonomy_test.rb, test/models/user_test.rb, test/test_helper.rb, test/unit/has_many_common_test.rb, test/unit/puppet_class_importer_test.rb, test/unit/sso/basic_test.rb, test/unit/tasks/seeds_test.rb
Commit date: 2017-02-22 10:26:06 +0200
Commit message: Fixes #16982 - Scope properly when no taxonomies are set

The default scope for hosts and other objects did not restrict
properly by taxonomies. An user without organizations or
locations, could do anything it's permissions allow to.
The list of hosts was unrestricted and showed hosts in
any location or organization.

This is fixed to work so that:

Users without taxonomies, when set to 'any context' cannot see
anything (at all)

Users with taxonomies, when set to 'any context' can see
everything within all of their taxonomies context (including
children taxonomies).

Admins set to 'any context' can see everything - regardless
of whether it has a taxonomy or not.

Users or admins set to some organization/location scope
can only see stuff within scope.

Diff: diff --git a/app/controllers/concerns/foreman/controller/smart_proxy_auth.rb b/app/controllers/concerns/foreman/controller/smart_proxy_auth.rb
index 999760df54..01704ea7bc 100644
--- a/app/controllers/concerns/foreman/controller/smart_proxy_auth.rb
+++ b/app/controllers/concerns/foreman/controller/smart_proxy_auth.rb
@@ -28,11 +28,15 @@ module Foreman::Controller::SmartProxyAuth
   private
 
   # Permits registered Smart Proxies or a user with permission
   def require_smart_proxy_or_login(features = nil)
     features = features.call if features.respond_to?(:call)
-    allowed_smart_proxies = features.blank? ? SmartProxy.all : SmartProxy.with_features(*features)
+    allowed_smart_proxies = if features.blank?
+                              SmartProxy.unscoped.all
+                            else
+                              SmartProxy.unscoped.with_features(*features)
+                            end
 
     if !Setting[:restrict_registered_smart_proxies] || auth_smart_proxy(allowed_smart_proxies, Setting[:require_ssl_smart_proxies])
       set_admin_user
       return true
     end
@@ -45,11 +49,11 @@ module Foreman::Controller::SmartProxyAuth
     authorize
   end
 
   # Filter requests to only permit from hosts with a registered smart proxy
   # Uses rDNS of the request to match proxy hostnames
-  def auth_smart_proxy(proxies = SmartProxy.all, require_cert = true)
+  def auth_smart_proxy(proxies = SmartProxy.unscoped.all, require_cert = true)
     request_hosts = nil
     if request.ssl?
       # If we have the client certficate in the request environment we can extract the dn and sans from there
       # if not we use the dn in the request environment
       # SAN validation requires "SSLOptions +ExportCertData" in Apache httpd
diff --git a/app/controllers/users_controller.rb b/app/controllers/users_controller.rb
index 9823438c28..b94c12f1d5 100644
--- a/app/controllers/users_controller.rb
+++ b/app/controllers/users_controller.rb
@@ -156,11 +156,11 @@ class UsersController < ApplicationController
   def parameter_filter_context
     Foreman::Controller::Parameters::User::Context.new(:ui, controller_name, params[:action], editing_self?)
   end
 
   def verify_active_session
-    if !request.post? && params[:status].blank? && User.exists?(session[:user].presence)
+    if !request.post? && params[:status].blank? && User.unscoped.exists?(session[:user].presence)
       warning _("You have already logged in")
       redirect_back_or_to hosts_path
       return
     end
   end
diff --git a/app/models/concerns/taxonomix.rb b/app/models/concerns/taxonomix.rb
index c3ffd48d7e..fb36601fe6 100644
--- a/app/models/concerns/taxonomix.rb
+++ b/app/models/concerns/taxonomix.rb
@@ -1,17 +1,17 @@
 module Taxonomix
   extend ActiveSupport::Concern
   include DirtyAssociations
+  TAXONOMY_JOIN_TABLE = :taxable_taxonomies
 
   included do
-    taxonomy_join_table = :taxable_taxonomies
-    has_many taxonomy_join_table.to_sym, :dependent => :destroy, :as => :taxable
+    has_many TAXONOMY_JOIN_TABLE, :dependent => :destroy, :as => :taxable
     has_many :locations, -> { where(:type => 'Location') },
-             :through => taxonomy_join_table, :source => :taxonomy,
+             :through => TAXONOMY_JOIN_TABLE, :source => :taxonomy,
              :validate => false
     has_many :organizations, -> { where(:type => 'Organization') },
-             :through => taxonomy_join_table, :source => :taxonomy,
+             :through => TAXONOMY_JOIN_TABLE, :source => :taxonomy,
              :validate => false
     after_initialize :set_current_taxonomy
 
     scoped_search :relation => :locations, :on => :name, :rename => :location, :complete_value => true
     scoped_search :relation => :locations, :on => :id, :rename => :location_id, :complete_enabled => false, :only_explicit => true, :validator => ScopedSearch::Validators::INTEGER
@@ -26,14 +26,15 @@ module Taxonomix
   module ClassMethods
     attr_accessor :which_ancestry_method, :which_location, :which_organization
 
     # default inner_method includes children (subtree_ids)
     def with_taxonomy_scope(loc = Location.current, org = Organization.current, inner_method = :subtree_ids)
+      scope = block_given? ? yield : where(nil)
+      return scope unless Taxonomy.enabled_taxonomies.present?
       self.which_ancestry_method = inner_method
       self.which_location        = Location.expand(loc) if SETTINGS[:locations_enabled]
       self.which_organization    = Organization.expand(org) if SETTINGS[:organizations_enabled]
-      scope = block_given? ? yield : where('1=1')
       scope = scope_by_taxable_ids(scope)
       scope.readonly(false)
     end
 
     # default inner_method includes parents (path_ids)
@@ -67,30 +68,49 @@ module Taxonomix
     def enforce_default
       self.where(nil).limit(0).all unless which_ancestry_method.present?
     end
 
     def taxable_ids(loc = which_location, org = which_organization, inner_method = which_ancestry_method)
-      if SETTINGS[:locations_enabled] && loc.present?
-        inner_ids_loc = if Location.ignore?(self.to_s)
-                          self.unscoped.pluck("#{table_name}.id")
-                        else
-                          inner_select(loc, inner_method)
-                        end
+      # Return everything (represented by nil), including objects without
+      # taxonomies. This value should only be returned for admin users.
+      return nil if any_context?(loc) && any_context?(org) &&
+        User.current.try(:admin?)
+
+      ids = unscoped.pluck(:id)
+      ids &= inner_ids(loc, Location, inner_method) if SETTINGS[:locations_enabled]
+      ids &= inner_ids(org, Organization, inner_method) if SETTINGS[:organizations_enabled]
+
+      if self == User
+        # In the case of users we want the taxonomy scope to get both the users
+        # of the taxonomy, admins, and the current user.
+        ids.concat(admin_ids)
+        ids << User.current.id if User.current.present?
       end
-      if SETTINGS[:organizations_enabled] && org.present?
-        inner_ids_org = if Organization.ignore?(self.to_s)
-                          self.unscoped.pluck("#{table_name}.id")
-                        else
-                          inner_select(org, inner_method)
-                        end
-      end
-      inner_ids   = inner_ids_loc & inner_ids_org if (inner_ids_loc && inner_ids_org)
-      inner_ids ||= inner_ids_loc if inner_ids_loc
-      inner_ids ||= inner_ids_org if inner_ids_org
-      # In the case of users we want the taxonomy scope to get both the users of the taxonomy and admins.
-      inner_ids.concat(admin_ids) if inner_ids && self == User
-      inner_ids
+
+      ids
+    end
+
+    # Returns the IDs available for the passed context.
+    # Passing a nil or [] value as taxonomy equates to "Any context".
+    # Any other value will be understood as 'IDs available in this taxonomy'.
+    def inner_ids(taxonomy, taxonomy_class, inner_method)
+      return unscoped.pluck("#{table_name}.id") if taxonomy_class.ignore?(to_s)
+      return inner_select(taxonomy, inner_method) if taxonomy.present?
+      return [] unless User.current.present?
+      # Any available taxonomy to the current user
+      return unscoped.pluck("#{table_name}.id") if User.current.admin?
+
+      taxonomy_relation = taxonomy_class.to_s.underscore.pluralize
+      any_context_taxonomies = User.current.
+        taxonomy_and_child_ids(:"#{taxonomy_relation}")
+      unscoped.joins(TAXONOMY_JOIN_TABLE).
+        where("#{TAXONOMY_JOIN_TABLE}.taxonomy_id" => any_context_taxonomies).
+        pluck(:id)
+    end
+
+    def any_context?(taxonomy)
+      taxonomy.blank?
     end
 
     # taxonomy can be either specific taxonomy object or array of these objects
     # it can also be an empty array that means all taxonomies (user is not assigned to any)
     def inner_select(taxonomy, inner_method = which_ancestry_method)
diff --git a/app/models/host/base.rb b/app/models/host/base.rb
index 3cdc0a1d79..8a2c895474 100644
--- a/app/models/host/base.rb
+++ b/app/models/host/base.rb
@@ -47,12 +47,12 @@ module Host
 
     def self.taxonomy_conditions
       org = Organization.expand(Organization.current) if SETTINGS[:organizations_enabled]
       loc = Location.expand(Location.current) if SETTINGS[:locations_enabled]
       conditions = {}
-      conditions[:organization_id] = Array(org).map { |o| o.subtree_ids }.flatten.uniq if org.present?
-      conditions[:location_id] = Array(loc).map { |l| l.subtree_ids }.flatten.uniq if loc.present?
+      conditions[:organization_id] = Array(org).map { |o| o.subtree_ids }.flatten.uniq unless org.nil?
+      conditions[:location_id] = Array(loc).map { |l| l.subtree_ids }.flatten.uniq unless loc.nil?
       conditions
     end
 
     scope :no_location,     -> { rewhere(:location_id => nil) }
     scope :no_organization, -> { rewhere(:organization_id => nil) }
diff --git a/app/services/sso/base.rb b/app/services/sso/base.rb
index ab9b5e63ea..a464095221 100644
--- a/app/services/sso/base.rb
+++ b/app/services/sso/base.rb
@@ -39,9 +39,9 @@ module SSO
     def authenticate!
       raise NotImplementedError, "#{__method__} not implemented for this authentication method"
     end
 
     def current_user
-      User.except_hidden.find_by_login(self.user)
+      User.unscoped.except_hidden.find_by_login(self.user)
     end
   end
 end
diff --git a/app/services/sso/oauth.rb b/app/services/sso/oauth.rb
index 33253b3b82..c8ed60b0ff 100644
--- a/app/services/sso/oauth.rb
+++ b/app/services/sso/oauth.rb
@@ -18,11 +18,11 @@ module SSO
       end
 
       if OAuth::Signature.verify(request, :consumer_secret => Setting['oauth_consumer_secret'])
         if Setting['oauth_map_users']
           user_name = request.headers['HTTP_FOREMAN_USER'].to_s
-          User.find_by_login(user_name).tap do |obj|
+          User.unscoped.find_by_login(user_name).tap do |obj|
             Rails.logger.warn "Oauth: mapping to user '#{user_name}' failed" if obj.nil?
           end.try(:login)
         else
           User::ANONYMOUS_API_ADMIN
         end
diff --git a/app/services/tax_host.rb b/app/services/tax_host.rb
index 40976702aa..d03b0ac94a 100644
--- a/app/services/tax_host.rb
+++ b/app/services/tax_host.rb
@@ -25,15 +25,15 @@ class TaxHost
   def selected_ids
     return @selected_ids if @selected_ids
     ids = default_ids_hash
     #types NOT ignored - get ids that are selected
     hash_keys.each do |col|
-      ids[col] = Array(taxonomy.send(col))
+      ids[col] = Array(taxonomy.send(col)).uniq
     end
     #types that ARE ignored - get ALL ids for object
     Array(taxonomy.ignore_types).each do |taxonomy_type|
-      ids["#{taxonomy_type.tableize.singularize}_ids"] = taxonomy_type.constantize.pluck(:id)
+      ids["#{taxonomy_type.tableize.singularize}_ids"] = taxonomy_type.constantize.pluck(:id).uniq
     end
 
     ids["#{opposite_taxonomy_type}_ids"] = Array(taxonomy.send("#{opposite_taxonomy_type}_ids"))
     @selected_ids                        = ids
   end
@@ -211,10 +211,10 @@ class TaxHost
   end
 
   def default_ids_hash(populate_values = false)
     ids = HashWithIndifferentAccess.new
     hash_keys.each do |col|
-      ids[col] = populate_values ? Array(self.send(col)) : []
+      ids[col] = populate_values ? Array(self.send(col)).uniq : []
     end
     ids
   end
 end
diff --git a/db/migrate/20130908100439_delete_orphaned_records.rb b/db/migrate/20130908100439_delete_orphaned_records.rb
index 915947c8e0..cff9d8d4f2 100644
--- a/db/migrate/20130908100439_delete_orphaned_records.rb
+++ b/db/migrate/20130908100439_delete_orphaned_records.rb
@@ -35,27 +35,27 @@ class DeleteOrphanedRecords < ActiveRecord::Migration
     Log.where("message_id NOT IN (?) OR report_id NOT IN (?) OR source_id NOT IN (?)", Message.pluck(:id), Report.pluck(:id), Source.pluck(:id)).delete_all
     Token.where("host_id NOT IN (?)", Host::Base.pluck(:id)).delete_all
     TrendCounter.where("trend_id NOT IN (?)", Trend.pluck(:id)).delete_all
 
     # NULLIFY FOREIGN KEY VALUE IF IT HAS AN ORPHANED FOREIGN KEY
-    Audit.unscoped.where("user_id NOT IN (?)", User.pluck(:id)).update_all(:user_id => nil)
+    Audit.unscoped.where("user_id NOT IN (?)", User.unscoped.pluck(:id)).update_all(:user_id => nil)
     FakeConfigTemplate.where("template_kind_id NOT IN (?)", TemplateKind.pluck(:id)).update_all(:template_kind_id => nil)
-    Domain.where("dns_id NOT IN (?)", SmartProxy.pluck(:id)).update_all(:dns_id => nil)
-    Subnet.where("dhcp_id NOT IN (?)", SmartProxy.pluck(:id)).update_all(:dhcp_id => nil)
-    Subnet.where("dns_id NOT IN (?)", SmartProxy.pluck(:id)).update_all(:dns_id => nil)
-    Subnet.where("tftp_id NOT IN (?)", SmartProxy.pluck(:id)).update_all(:tftp_id => nil)
-    Image.where("architecture_id NOT IN (?)", Architecture.pluck(:id)).update_all(:architecture_id => nil)
-    Image.where("compute_resource_id NOT IN (?)", ComputeResource.pluck(:id)).update_all(:compute_resource_id => nil)
+    Domain.where("dns_id NOT IN (?)", SmartProxy.unscoped.pluck(:id)).update_all(:dns_id => nil)
+    Subnet.where("dhcp_id NOT IN (?)", SmartProxy.unscoped.pluck(:id)).update_all(:dhcp_id => nil)
+    Subnet.where("dns_id NOT IN (?)", SmartProxy.unscoped.pluck(:id)).update_all(:dns_id => nil)
+    Subnet.where("tftp_id NOT IN (?)", SmartProxy.unscoped.pluck(:id)).update_all(:tftp_id => nil)
+    Image.where("architecture_id NOT IN (?)", Architecture.unscoped.pluck(:id)).update_all(:architecture_id => nil)
+    Image.where("compute_resource_id NOT IN (?)", ComputeResource.unscoped.pluck(:id)).update_all(:compute_resource_id => nil)
     Image.where("operatingsystem_id NOT IN (?)", Operatingsystem.unscoped.pluck(:id)).update_all(:operatingsystem_id => nil)
-    Nic::Base.where("domain_id NOT IN (?)", Domain.pluck(:id)).update_all(:domain_id => nil)
-    Nic::Base.where("host_id NOT IN (?)", Host::Base.pluck(:id)).update_all(:host_id => nil)
-    Nic::Base.where("subnet_id NOT IN (?)", Subnet.pluck(:id)).update_all(:subnet_id => nil)
-    OsDefaultTemplate.where("config_template_id NOT IN (?)", FakeConfigTemplate.pluck(:id)).update_all(:config_template_id => nil)
+    Nic::Base.where("domain_id NOT IN (?)", Domain.unscoped.pluck(:id)).update_all(:domain_id => nil)
+    Nic::Base.where("host_id NOT IN (?)", Host::Base.unscoped.pluck(:id)).update_all(:host_id => nil)
+    Nic::Base.where("subnet_id NOT IN (?)", Subnet.unscoped.pluck(:id)).update_all(:subnet_id => nil)
+    OsDefaultTemplate.where("config_template_id NOT IN (?)", FakeConfigTemplate.unscoped.pluck(:id)).update_all(:config_template_id => nil)
     OsDefaultTemplate.where("operatingsystem_id NOT IN (?)", Operatingsystem.unscoped.pluck(:id)).update_all(:operatingsystem_id => nil)
-    OsDefaultTemplate.where("template_kind_id NOT IN (?)", TemplateKind.pluck(:id)).update_all(:template_kind_id => nil)
-    TemplateCombination.where("config_template_id NOT IN (?)", FakeConfigTemplate.pluck(:id)).update_all(:config_template_id => nil)
-    TemplateCombination.where("environment_id NOT IN (?)", Environment.pluck(:id)).update_all(:environment_id => nil)
+    OsDefaultTemplate.where("template_kind_id NOT IN (?)", TemplateKind.unscoped.pluck(:id)).update_all(:template_kind_id => nil)
+    TemplateCombination.where("config_template_id NOT IN (?)", FakeConfigTemplate.unscoped.pluck(:id)).update_all(:config_template_id => nil)
+    TemplateCombination.where("environment_id NOT IN (?)", Environment.unscoped.pluck(:id)).update_all(:environment_id => nil)
     TemplateCombination.where("hostgroup_id NOT IN (?)", Hostgroup.unscoped.pluck(:id)).update_all(:hostgroup_id => nil)
 
     host_groups_up
     hosts_up
   end
diff --git a/db/seeds.d/07-provisioning_templates.rb b/db/seeds.d/07-provisioning_templates.rb
index e30d237be8..8fda75123e 100644
--- a/db/seeds.d/07-provisioning_templates.rb
+++ b/db/seeds.d/07-provisioning_templates.rb
@@ -5,18 +5,18 @@ os_suse    = Operatingsystem.where(:type => "Suse") || Operatingsystem.where("na
 os_windows = Operatingsystem.where(:type => "Windows")
 
 # Template kinds
 kinds = {}
 TemplateKind.default_template_labels.keys.collect(&:to_sym).each do |type|
-  kinds[type] = TemplateKind.find_by_name(type)
-  kinds[type] ||= TemplateKind.create(:name => type)
+  kinds[type] = TemplateKind.unscoped.find_by_name(type)
+  kinds[type] ||= TemplateKind.unscoped.create(:name => type)
   raise "Unable to create template kind: #{format_errors kinds[type]}" if kinds[type].nil? || kinds[type].errors.any?
 end
 
 # Provisioning templates
-organizations = Organization.all
-locations = Location.all
+organizations = Organization.unscoped.all
+locations = Location.unscoped.all
 ProvisioningTemplate.without_auditing do
   [
     # Generic PXE files
     { :name => 'PXELinux global default', :source => 'pxe/PXELinux_default.erb', :template_kind => kinds[:PXELinux], :locked => true },
     { :name => 'PXEGrub global default', :source => 'pxe/PXEGrub_default.erb', :template_kind => kinds[:PXEGrub], :locked => true },
@@ -79,11 +79,10 @@ ProvisioningTemplate.without_auditing do
     { :name => 'kickstart_networking_setup', :source => 'snippets/_kickstart_networking_setup.erb', :snippet => true },
     { :name => 'preseed_networking_setup', :source => 'snippets/_preseed_networking_setup.erb', :snippet => true },
     { :name => 'puppet.conf', :source => 'snippets/_puppet.conf.erb', :snippet => true },
     { :name => 'puppet_setup', :source => 'snippets/_puppet_setup.erb', :snippet => true },
     { :name => 'puppetlabs_repo', :source => 'snippets/_puppetlabs_repo.erb', :snippet => true },
-    { :name => 'pxelinux_discovery', :source => 'snippets/_pxelinux_discovery.erb', :snippet => true },
     { :name => 'redhat_register', :source => 'snippets/_redhat_register.erb', :snippet => true },
     { :name => 'remote_execution_ssh_keys', :source => 'snippets/_remote_execution_ssh_keys.erb', :snippet => true },
     { :name => 'saltstack_minion', :source => 'snippets/_saltstack_minion.erb', :snippet => true },
     { :name => 'saltstack_setup', :source => 'snippets/_saltstack_setup.erb', :snippet => true },
     { :name => 'pxelinux_chainload', :source => 'snippets/_pxelinux_chainload.erb', :snippet => true },
@@ -93,11 +92,11 @@ ProvisioningTemplate.without_auditing do
     { :name => 'pxegrub_discovery', :source => 'snippets/_pxegrub_discovery.erb', :snippet => true },
     { :name => 'pxegrub2_discovery', :source => 'snippets/_pxegrub2_discovery.erb', :snippet => true }
   ].each do |input|
     contents = File.read(File.join("#{Rails.root}/app/views/unattended", input.delete(:source)))
 
-    if (t = ProvisioningTemplate.find_by_name(input[:name])) && !audit_modified?(ProvisioningTemplate, input[:name])
+    if (t = ProvisioningTemplate.unscoped.find_by_name(input[:name])) && !audit_modified?(ProvisioningTemplate, input[:name])
       if t.template != contents
         t.template = contents
         raise "Unable to update template #{t.name}: #{format_errors t}" unless t.save
       end
     else
diff --git a/db/seeds.d/08-partition_tables.rb b/db/seeds.d/08-partition_tables.rb
index 4c1152262b..68495625f5 100644
--- a/db/seeds.d/08-partition_tables.rb
+++ b/db/seeds.d/08-partition_tables.rb
@@ -1,8 +1,8 @@
 # Partition tables
-organizations = Organization.all
-locations = Location.all
+organizations = Organization.unscoped.all
+locations = Location.unscoped.all
 Ptable.without_auditing do
   [
     { :name => 'AutoYaST entire SCSI disk', :os_family => 'Suse', :source => 'autoyast/disklayout_scsi.erb' },
     { :name => 'AutoYaST entire virtual disk', :os_family => 'Suse', :source => 'autoyast/disklayout_virtual.erb' },
     { :name => 'AutoYaST LVM', :os_family => 'Suse', :source => 'autoyast/disklayout_lvm.erb' },
@@ -17,11 +17,11 @@ Ptable.without_auditing do
     { :name => 'Preseed custom LVM', :os_family => 'Debian', :source => 'preseed/disklayout_lvm.erb' },
     { :name => 'XenServer default', :os_family => 'Xenserver', :source => 'xenserver/disklayout.erb' }
   ].each do |input|
     contents = File.read(File.join("#{Rails.root}/app/views/unattended", input.delete(:source)))
 
-    if (p = Ptable.find_by_name(input[:name])) && !audit_modified?(Ptable, input[:name])
+    if (p = Ptable.unscoped.find_by_name(input[:name])) && !audit_modified?(Ptable, input[:name])
       if p.layout != contents
         p.layout = contents
         raise "Unable to update partition table: #{format_errors p}" unless p.save
       end
     else
diff --git a/db/seeds.d/10-installation_media.rb b/db/seeds.d/10-installation_media.rb
index 06286c8c7f..959ef45951 100644
--- a/db/seeds.d/10-installation_media.rb
+++ b/db/seeds.d/10-installation_media.rb
@@ -1,6 +1,6 @@
-os_suse = Operatingsystem.where(:type => "Suse") || Operatingsystem.where("name LIKE ?", "suse")
+os_suse = Operatingsystem.unscoped.where(:type => "Suse") || Operatingsystem.unscoped.where("name LIKE ?", "suse")
 
 # Installation media: default mirrors
 Medium.without_auditing do
   [
     { :name => "CentOS mirror", :os_family => "Redhat", :path => "http://mirror.centos.org/centos/$version/os/$arch" },
@@ -10,11 +10,11 @@ Medium.without_auditing do
     { :name => "FreeBSD mirror", :os_family => "Freebsd", :path => "http://ftp.freebsd.org/pub/FreeBSD/releases/$arch/$version-RELEASE/" },
     { :name => "OpenSUSE mirror", :os_family => "Suse", :path => "http://download.opensuse.org/distribution/$version/repo/oss", :operatingsystems => os_suse },
     { :name => "Ubuntu mirror", :os_family => "Debian", :path => "http://archive.ubuntu.com/ubuntu" },
     { :name => "CoreOS mirror", :os_family => "Coreos", :path => "http://$release.release.core-os.net" }
   ].each do |input|
-    next if Medium.where(['name = ? OR path = ?', input[:name], input[:path]]).any?
+    next if Medium.unscoped.where(['name = ? OR path = ?', input[:name], input[:path]]).any?
     next if audit_modified? Medium, input[:name]
     m = Medium.create input
     raise "Unable to create medium: #{format_errors m}" if m.nil? || m.errors.any?
   end
 end
diff --git a/test/active_support_test_case_helper.rb b/test/active_support_test_case_helper.rb
index f6da26cd69..bee4f9e589 100644
--- a/test/active_support_test_case_helper.rb
+++ b/test/active_support_test_case_helper.rb
@@ -7,10 +7,11 @@ class ActiveSupport::TestCase
   set_fixture_class :nics => Nic::BMC
 
   setup :begin_gc_deferment
   setup :reset_setting_cache
   setup :skip_if_plugin_asked_to
+  setup :set_admin
 
   teardown :reconsider_gc_deferment
   teardown :clear_current_user
   teardown :clear_current_taxonomies
   teardown :reset_setting_cache
@@ -38,10 +39,14 @@ class ActiveSupport::TestCase
     if skips.any?{|name| @NAME.end_with?(name)}
       skip "Test was disabled by plugin"
     end
   end
 
+  def set_admin
+    User.current = users(:admin)
+  end
+
   def clear_current_user
     User.current = nil
   end
 
   def clear_current_taxonomies
@@ -123,11 +128,12 @@ class ActiveSupport::TestCase
 
   # if a method receieves a block it will be yielded just before user save
   def setup_user(operation, type = "", search = nil, user = :one)
     @one = users(user)
     as_admin do
-      permission = Permission.find_by_name("#{operation}_#{type}") || FactoryGirl.create(:permission, :name => "#{operation}_#{type}")
+      permission = Permission.find_by_name("#{operation}_#{type}") ||
+        FactoryGirl.create(:permission, :name => "#{operation}_#{type}")
       filter = FactoryGirl.build(:filter, :search => search)
       filter.permissions = [ permission ]
       role = Role.where(:name => "#{operation}_#{type}").first_or_create
       role.filters = [ filter ]
       role.save!
diff --git a/test/controllers/api/v1/auth_source_ldaps_controller_test.rb b/test/controllers/api/v1/auth_source_ldaps_controller_test.rb
index 4e68d5dabb..f67273e495 100644
--- a/test/controllers/api/v1/auth_source_ldaps_controller_test.rb
+++ b/test/controllers/api/v1/auth_source_ldaps_controller_test.rb
@@ -17,11 +17,11 @@ class Api::V1::AuthSourceLdapsControllerTest < ActionController::TestCase
     show_response = ActiveSupport::JSON.decode(@response.body)
     assert !show_response.empty?
   end
 
   test "should create auth_source_ldap" do
-    assert_difference('AuthSourceLdap.count', 1) do
+    assert_difference('AuthSourceLdap.unscoped.count', 1) do
       post :create, { :auth_source_ldap => valid_attrs }
     end
     assert_response :success
   end
 
@@ -29,11 +29,11 @@ class Api::V1::AuthSourceLdapsControllerTest < ActionController::TestCase
     put :update, { :id => auth_sources(:one).to_param, :auth_source_ldap => { :host => "ldap3" } }
     assert_response :success
   end
 
   test "should destroy auth_source_ldap" do
-    assert_difference('AuthSourceLdap.count', -1) do
+    assert_difference('AuthSourceLdap.unscoped.count', -1) do
       auth = auth_sources(:one)
       User.where(:auth_source_id => auth.id).update_all(:auth_source_id => nil)
       delete :destroy, { :id => auth.id }
     end
     assert_response :success
diff --git a/test/controllers/api/v1/compute_resources_controller_test.rb b/test/controllers/api/v1/compute_resources_controller_test.rb
index a9b44a8027..2659f8ad20 100644
--- a/test/controllers/api/v1/compute_resources_controller_test.rb
+++ b/test/controllers/api/v1/compute_resources_controller_test.rb
@@ -33,16 +33,17 @@ class Api::V1::ComputeResourcesControllerTest < ActionController::TestCase
     assert !show_response.empty?
   end
 
   test "should update compute resource" do
     put :update, { :id => compute_resources(:mycompute).to_param, :compute_resource => { :description => "new_description" } }
-    assert_equal "new_description", ComputeResource.find_by_name('mycompute').description
+    assert_equal "new_description",
+      ComputeResource.unscoped.find_by_name('mycompute').description
     assert_response :success
   end
 
   test "should destroy compute resource" do
-    assert_difference('ComputeResource.count', -1) do
+    assert_difference('ComputeResource.unscoped.count', -1) do
       delete :destroy, { :id => compute_resources(:yourcompute).id }
     end
     assert_response :success
   end
 
@@ -64,16 +65,17 @@ class Api::V1::ComputeResourcesControllerTest < ActionController::TestCase
   end
 
   test "should update compute resource for owner" do
     setup_user 'edit', 'compute_resources', "id = #{compute_resources(:mycompute).id}"
     put :update, { :id => compute_resources(:mycompute).to_param, :compute_resource => { :description => "new_description" } }
-    assert_equal "new_description", ComputeResource.find_by_name('mycompute').description
+    assert_equal "new_description",
+      ComputeResource.unscoped.find_by_name('mycompute').description
     assert_response :success
   end
 
   test "should destroy compute resource for owner" do
-    assert_difference('ComputeResource.count', -1) do
+    assert_difference('ComputeResource.unscoped.count', -1) do
       setup_user 'destroy', 'compute_resources', "id = #{compute_resources(:mycompute).id}"
       delete :destroy, { :id => compute_resources(:mycompute).id }
     end
     assert_response :success
   end
diff --git a/test/controllers/api/v1/config_templates_controller_test.rb b/test/controllers/api/v1/config_templates_controller_test.rb
index dfb523402b..1a57946024 100644
--- a/test/controllers/api/v1/config_templates_controller_test.rb
+++ b/test/controllers/api/v1/config_templates_controller_test.rb
@@ -49,19 +49,19 @@ class Api::V1::ConfigTemplatesControllerTest < ActionController::TestCase
 
   test "should not destroy template with associated hosts" do
     config_template = templates(:pxekickstart)
     delete :destroy, { :id => config_template.to_param }
     assert_response :unprocessable_entity
-    assert ProvisioningTemplate.exists?(config_template.id)
+    assert ProvisioningTemplate.unscoped.exists?(config_template.id)
   end
 
   test "should destroy" do
     config_template = templates(:pxekickstart)
     config_template.os_default_templates.clear
     delete :destroy, { :id => config_template.to_param }
     assert_response :success
-    refute ProvisioningTemplate.exists?(config_template.id)
+    refute ProvisioningTemplate.unscoped.exists?(config_template.id)
   end
 
   test "should build pxe menu" do
     ProxyAPI::TFTP.any_instance.stubs(:create_default).returns(true)
     ProxyAPI::TFTP.any_instance.stubs(:fetch_boot_file).returns(true)
diff --git a/test/controllers/api/v1/domains_controller_test.rb b/test/controllers/api/v1/domains_controller_test.rb
index ee5a002705..e5981ed359 100644
--- a/test/controllers/api/v1/domains_controller_test.rb
+++ b/test/controllers/api/v1/domains_controller_test.rb
@@ -25,12 +25,12 @@ class Api::V1::DomainsControllerTest < ActionController::TestCase
     post :create, { :domain => { :fullname => "" } }
     assert_response :unprocessable_entity
   end
 
   test "should update valid domain" do
-    put :update, { :id => Domain.first.to_param, :domain => { :name => "domain.new" } }
-    assert_equal "domain.new", Domain.first.name
+    put :update, { :id => Domain.unscoped.first.to_param, :domain => { :name => "domain.new" } }
+    assert_equal "domain.new", Domain.unscoped.first.name
     assert_response :success
   end
 
   test "should not update invalid domain" do
     put :update, { :id => Domain.first.to_param, :domain => { :name => "" } }
diff --git a/test/controllers/api/v1/environments_controller_test.rb b/test/controllers/api/v1/environments_controller_test.rb
index 52d2e78491..81e509e34d 100644
--- a/test/controllers/api/v1/environments_controller_test.rb
+++ b/test/controllers/api/v1/environments_controller_test.rb
@@ -17,11 +17,11 @@ class Api::V1::EnvironmentsControllerTest < ActionController::TestCase
     show_response = ActiveSupport::JSON.decode(@response.body)
     assert !show_response.empty?
   end
 
   test "should create environment" do
-    assert_difference('Environment.count') do
+    assert_difference('Environment.unscoped.count') do
       post :create, { :environment => development_environment }
     end
     assert_response :success
   end
 
@@ -29,11 +29,11 @@ class Api::V1::EnvironmentsControllerTest < ActionController::TestCase
     put :update, { :id => environments(:production).to_param, :environment => development_environment }
     assert_response :success
   end
 
   test "should destroy environments" do
-    assert_difference('Environment.count', -1) do
+    assert_difference('Environment.unscoped.count', -1) do
       delete :destroy, { :id => environments(:testing).to_param }
     end
     assert_response :success
   end
 end
diff --git a/test/controllers/api/v1/hostgroups_controller_test.rb b/test/controllers/api/v1/hostgroups_controller_test.rb
index 040f586fb3..ec0968c2ac 100644
--- a/test/controllers/api/v1/hostgroups_controller_test.rb
+++ b/test/controllers/api/v1/hostgroups_controller_test.rb
@@ -33,11 +33,11 @@ class Api::V1::HostgroupsControllerTest < ActionController::TestCase
     show_response = ActiveSupport::JSON.decode(@response.body)
     assert !show_response.empty?
   end
 
   test "should create hostgroup" do
-    assert_difference('Hostgroup.count') do
+    assert_difference('Hostgroup.unscoped.count') do
       post :create, { :hostgroup => valid_attrs }
     end
     assert_response :success
   end
 
@@ -46,36 +46,36 @@ class Api::V1::HostgroupsControllerTest < ActionController::TestCase
     assert_response :success
   end
 
   test "should destroy hostgroups" do
     hostgroup = FactoryGirl.create(:hostgroup)
-    assert_difference('Hostgroup.count', -1) do
+    assert_difference('Hostgroup.unscoped.count', -1) do
       delete :destroy, :id => hostgroup
     end
     assert_response :success
   end
 
   test "blocks API deletion of hosts with children" do
     assert hostgroups(:parent).has_children?
-    assert_no_difference('Hostgroup.count') do
+    assert_no_difference('Hostgroup.unscoped.count') do
       delete :destroy, { :id => hostgroups(:parent).to_param }
     end
     assert_response :conflict
   end
 
   test "should create nested hostgroup with a parent" do
-    assert_difference('Hostgroup.count') do
+    assert_difference('Hostgroup.unscoped.count') do
       post :create, { :hostgroup => valid_attrs.merge(:parent_id => hostgroups(:common).id) }
     end
     assert_response :success
     assert_equal hostgroups(:common).id.to_s, Hostgroup.unscoped.order(:id).last.ancestry
   end
 
   test "should update a hostgroup to nested by passing parent_id" do
     put :update, { :id => hostgroups(:db).to_param, :hostgroup => {:parent_id => hostgroups(:common).id} }
     assert_response :success
-    assert_equal hostgroups(:common).id.to_s, Hostgroup.find_by_name("db").ancestry
+    assert_equal hostgroups(:common).id.to_s, Hostgroup.unscoped.find_by_name("db").ancestry
   end
 
   private
 
   def last_record
diff --git a/test/controllers/api/v1/media_controller_test.rb b/test/controllers/api/v1/media_controller_test.rb
index c41814ffc8..175a36f7fa 100644
--- a/test/controllers/api/v1/media_controller_test.rb
+++ b/test/controllers/api/v1/media_controller_test.rb
@@ -21,11 +21,11 @@ class Api::V1::MediaControllerTest < ActionController::TestCase
     show_response = ActiveSupport::JSON.decode(@response.body)
     assert !show_response.empty?
   end
 
   test "should create medium" do
-    assert_difference('Medium.count', +1) do
+    assert_difference('Medium.unscoped.count', +1) do
       post :create, { :medium => new_medium }
     end
     assert_response :created
     assert_not_nil assigns(:medium)
   end
@@ -35,11 +35,11 @@ class Api::V1::MediaControllerTest < ActionController::TestCase
     put :update, { :id => Medium.first.id.to_param, :name => name.to_s.to_param }
     assert_response :success
   end
 
   test "should destroy medium" do
-    assert_difference('Medium.count', -1) do
+    assert_difference('Medium.unscoped.count', -1) do
       delete :destroy, { :id => media(:unused).id.to_param }
     end
     assert_response :success
   end
 end
diff --git a/test/controllers/api/v1/ptables_controller_test.rb b/test/controllers/api/v1/ptables_controller_test.rb
index 94636403fe..90ac5f207b 100644
--- a/test/controllers/api/v1/ptables_controller_test.rb
+++ b/test/controllers/api/v1/ptables_controller_test.rb
@@ -21,11 +21,11 @@ class Api::V1::PtablesControllerTest < ActionController::TestCase
     show_response = ActiveSupport::JSON.decode(@response.body)
     assert !show_response.empty?
   end
 
   test "should create ptable" do
-    assert_difference('Ptable.count') do
+    assert_difference('Ptable.unscoped.count') do
       post :create, { :ptable => valid_attrs }
     end
     assert_response :success
   end
 
@@ -35,18 +35,18 @@ class Api::V1::PtablesControllerTest < ActionController::TestCase
   end
 
   test "should NOT destroy ptable in use" do
     FactoryGirl.create(:host, :ptable_id => @ptable.id)
 
-    assert_difference('Ptable.count', -0) do
+    assert_difference('Ptable.unscoped.count', -0) do
       delete :destroy, { :id => @ptable.to_param }
     end
     assert_response :unprocessable_entity
   end
 
   test "should destroy ptable that is NOT in use" do
-    assert_difference('Ptable.count', -1) do
+    assert_difference('Ptable.unscoped.count', -1) do
       delete :destroy, { :id => @ptable.to_param }
     end
     assert_response :success
   end
 end
diff --git a/test/controllers/api/v1/smart_proxies_controller_test.rb b/test/controllers/api/v1/smart_proxies_controller_test.rb
index e52283d895..cf12029ca9 100644
--- a/test/controllers/api/v1/smart_proxies_controller_test.rb
+++ b/test/controllers/api/v1/smart_proxies_controller_test.rb
@@ -42,11 +42,11 @@ class Api::V1::SmartProxiesControllerTest < ActionController::TestCase
     show_response = ActiveSupport::JSON.decode(@response.body)
     assert_not show_response.empty?
   end
 
   test "should create smart_proxy" do
-    assert_difference('SmartProxy.count') do
+    assert_difference('SmartProxy.unscoped.count') do
       post :create, { :smart_proxy => valid_attrs }
     end
     assert_response :success
   end
 
@@ -54,11 +54,11 @@ class Api::V1::SmartProxiesControllerTest < ActionController::TestCase
     put :update, { :id => smart_proxies(:one).to_param, :smart_proxy => valid_attrs }
     assert_response :success
   end
 
   test "should destroy smart_proxy" do
-    assert_difference('SmartProxy.count', -1) do
+    assert_difference('SmartProxy.unscoped.count', -1) do
       delete :destroy, { :id => smart_proxies(:four).to_param }
     end
     assert_response :success
   end
 
@@ -126,11 +126,11 @@ class Api::V1::SmartProxiesControllerTest < ActionController::TestCase
       Host::Managed.update_all(:environment_id => nil)
       Hostgroup.update_all(:environment_id => nil)
       Puppetclass.destroy_all
       Environment.destroy_all
     end
-    assert_difference('Environment.count', 2) do
+    assert_difference('Environment.unscoped.count', 2) do
       post :import_puppetclasses, {:id => smart_proxies(:puppetmaster).id}, set_session_user
     end
     assert_response :success
     response = ActiveSupport::JSON.decode(@response.body)
     assert_equal 2, response['environments_with_new_puppetclasses']
@@ -142,11 +142,11 @@ class Api::V1::SmartProxiesControllerTest < ActionController::TestCase
       as_admin do
         Host::Managed.update_all(:environment_id => nil)
         Hostgroup.update_all(:environment_id => nil)
         Puppetclass.destroy_all
         Environment.destroy_all
-        assert_difference('Puppetclass.count', 1) do
+        assert_difference('Puppetclass.unscoped.count', 1) do
           post :import_puppetclasses,
                { :id => smart_proxies(:puppetmaster).id }.merge(dryrun_param),
                set_session_user
         end
       end
@@ -159,11 +159,11 @@ class Api::V1::SmartProxiesControllerTest < ActionController::TestCase
     as_admin do
       Host::Managed.update_all(:environment_id => nil)
       Hostgroup.update_all(:environment_id => nil)
       Puppetclass.destroy_all
       Environment.destroy_all
-      assert_difference('Puppetclass.count', 0) do
+      assert_difference('Puppetclass.unscoped.count', 0) do
         post :import_puppetclasses, { :id => smart_proxies(:puppetmaster).id, :dryrun => true }, set_session_user
       end
     end
     assert_response :success
   end
@@ -171,40 +171,40 @@ class Api::V1::SmartProxiesControllerTest < ActionController::TestCase
   test "should obsolete environment" do
     setup_import_classes
     as_admin do
       Environment.create!(:name => 'xyz')
     end
-    assert_difference('Environment.count', -1) do
+    assert_difference('Environment.unscoped.count', -1) do
       post :import_puppetclasses, {:id => smart_proxies(:puppetmaster).id}, set_session_user
     end
     assert_response :success
   end
 
   test "should obsolete puppetclasses" do
     setup_import_classes
     as_admin do
-      assert_difference('Environment.find_by_name("env1").puppetclasses.count', -2) do
+      assert_difference('Environment.unscoped.find_by_name("env1").puppetclasses.count', -2) do
         post :import_puppetclasses, {:id => smart_proxies(:puppetmaster).id}, set_session_user
       end
     end
     assert_response :success
   end
 
   test "should update puppetclass smart class parameters" do
     setup_import_classes
     LookupKey.destroy_all
-    assert_difference('LookupKey.count', 1) do
+    assert_difference('LookupKey.unscoped.count', 1) do
       post :import_puppetclasses, {:id => smart_proxies(:puppetmaster).id}, set_session_user
     end
     assert_response :success
   end
 
   test "no changes on import_puppetclasses" do
     setup_import_classes
     Puppetclass.find_by_name('b').destroy
     Puppetclass.find_by_name('c').destroy
-    assert_difference('Environment.count', 0) do
+    assert_difference('Environment.unscoped.count', 0) do
       post :import_puppetclasses, {:id => smart_proxies(:puppetmaster).id}, set_session_user
     end
     assert_response :success
     response = ActiveSupport::JSON.decode(@response.body)
     assert_equal 'Successfully updated environment and puppetclasses from the on-disk puppet installation', response['message']
@@ -213,11 +213,11 @@ class Api::V1::SmartProxiesControllerTest < ActionController::TestCase
   test "should import new environment that does not exist in db" do
     setup_import_classes
     as_admin do
       env_name = 'env1'
       assert Environment.find_by_name(env_name).destroy
-      assert_difference('Environment.count', 1) do
+      assert_difference('Environment.unscoped.count', 1) do
         post :import_puppetclasses, {:id => smart_proxies(:puppetmaster).id, :environment_id => env_name}, set_session_user
       end
       assert_response :success
       response = ActiveSupport::JSON.decode(@response.body)
       assert_equal env_name, response['results']['name']
diff --git a/test/controllers/api/v1/subnets_controller_test.rb b/test/controllers/api/v1/subnets_controller_test.rb
index 89ef5f1006..fa61574a1a 100644
--- a/test/controllers/api/v1/subnets_controller_test.rb
+++ b/test/controllers/api/v1/subnets_controller_test.rb
@@ -18,23 +18,23 @@ class Api::V1::SubnetsControllerTest < ActionController::TestCase
     show_response = ActiveSupport::JSON.decode(@response.body)
     assert !show_response.empty?
   end
 
   test "should create IPv4 subnet" do
-    assert_difference('Subnet::Ipv4.count') do
+    assert_difference('Subnet::Ipv4.unscoped.count') do
       post :create, { :subnet => valid_v4_attrs }
     end
     assert_response :success
-    assert_equal 'Subnet::Ipv4', Subnet.find_by_name('QA2').type
+    assert_equal 'Subnet::Ipv4', Subnet.unscoped.find_by_name('QA2').type
   end
 
   test "should create IPv6 subnet" do
-    assert_difference('Subnet::Ipv6.count') do
+    assert_difference('Subnet::Ipv6.unscoped.count') do
       post :create, { :subnet => valid_v6_attrs }
     end
     assert_response :success
-    assert_equal 'Subnet::Ipv6', Subnet.find_by_name('QA2').type
+    assert_equal 'Subnet::Ipv6', Subnet.unscoped.find_by_name('QA2').type
   end
 
   test "does not create subnet with non-existent domain" do
     post :create, { :subnet => valid_v4_attrs.merge(:domain_ids => [1, 2]) }
     assert_response :not_found
@@ -44,18 +44,18 @@ class Api::V1::SubnetsControllerTest < ActionController::TestCase
     put :update, { :id => subnets(:one).to_param, :subnet => valid_v4_attrs }
     assert_response :success
   end
 
   test "should destroy subnets" do
-    assert_difference('Subnet.count', -1) do
+    assert_difference('Subnet.unscoped.count', -1) do
       delete :destroy, { :id => subnets(:four).to_param }
     end
     assert_response :success
   end
 
   test "should NOT destroy subnet that is in use" do
-    assert_difference('Subnet.count', 0) do
+    assert_difference('Subnet.unscoped.count', 0) do
       delete :destroy, { :id => subnets(:one).to_param }
     end
     assert_response :unprocessable_entity
   end
 
diff --git a/test/controllers/api/v1/users_controller_test.rb b/test/controllers/api/v1/users_controller_test.rb
index 1b57c58a48..689e29fd79 100644
--- a/test/controllers/api/v1/users_controller_test.rb
+++ b/test/controllers/api/v1/users_controller_test.rb
@@ -29,31 +29,31 @@ class Api::V1::UsersControllerTest < ActionController::TestCase
   test "should update user" do
     user = User.create :login => "foo", :mail => "foo@bar.com", :auth_source => auth_sources(:one)
     put :update, { :id => user.id, :user => valid_attrs }
     assert_response :success
 
-    mod_user = User.find_by_id(user.id)
+    mod_user = User.unscoped.find_by_id(user.id)
     assert mod_user.login == "johnsmith"
   end
 
   test "should update admin flag" do
     user = users(:one)
     put :update, { :id => user.id, :user => { :admin => true } }
 
     assert_response :success
-    assert User.find_by_id(user.id).admin?
+    assert User.unscoped.find_by_id(user.id).admin?
   end
 
   test "should not remove the default role" do
     user = User.create :login => "foo", :mail => "foo@bar.com", :auth_source => auth_sources(:one)
 
     assert user.roles =([roles(:default_role)])
 
     put :update, { :id => user.id, :user => { :login => "johnsmith" } }
     assert_response :success
 
-    mod_user = User.find_by_id(user.id)
+    mod_user = User.unscoped.find_by_id(user.id)
 
     assert mod_user.roles =([roles(:default_role)])
   end
 
   test "should set password" do
@@ -62,11 +62,11 @@ class Api::V1::UsersControllerTest < ActionController::TestCase
     assert user.save
 
     put :update, { :id => user.id, :user => { :login => "johnsmith", :password => "dummy", :password_confirmation => "dummy" } }
     assert_response :success
 
-    mod_user = User.find_by_id(user.id)
+    mod_user = User.unscoped.find_by_id(user.id)
     assert mod_user.matching_password?("dummy")
   end
 
   test "should detect password validation mismatches" do
     user          = User.new :login => "foo", :mail => "foo@bar.com", :firstname => "john", :lastname => "smith", :auth_source => auth_sources(:internal)
@@ -74,21 +74,21 @@ class Api::V1::UsersControllerTest < ActionController::TestCase
     assert user.save
 
     put :update, { :id => user.id, :user => { :login => "johnsmith", :password => "dummy", :password_confirmation => "DUMMY" } }
     assert_response :unprocessable_entity
 
-    mod_user = User.find_by_id(user.id)
+    mod_user = User.unscoped.find_by_id(user.id)
     assert mod_user.matching_password?("changeme")
   end
 
   test "should delete different user" do
     user = users(:one)
 
     delete :destroy, { :id => user.id }
     assert_response :success
 
-    assert !User.exists?(user.id)
+    refute User.unscoped.exists?(user.id)
   end
 
   test "should not delete same user" do
     user = users(:one)
     user.update_attribute :admin, true
@@ -98,11 +98,11 @@ class Api::V1::UsersControllerTest < ActionController::TestCase
       assert_response :forbidden
 
       response = ActiveSupport::JSON.decode(@response.body)
       assert response['details'] == "You are trying to delete your own account"
       assert response['message'] == "Access denied"
-      assert User.exists?(user.id)
+      assert User.unscoped.exists?(user.id)
     end
   end
 
   def user_one_as_anonymous_viewer
     users(:one).roles = [Role.default, Role.find_by_name('Viewer')]
@@ -136,11 +136,11 @@ class Api::V1::UsersControllerTest < ActionController::TestCase
     as_user :one do
       post :create, { :user => {
         :admin => true, :login => 'new_admin', :auth_source_id => auth_sources(:one).id }
       }
       assert_response :success
-      assert User.find_by_login('new_admin').admin?
+      assert User.unscoped.find_by_login('new_admin').admin?
     end
   end
 
   test "#index should not show hidden users" do
     get :index, { :search => "login == #{users(:anonymous).login}" }
@@ -173,11 +173,11 @@ class Api::V1::UsersControllerTest < ActionController::TestCase
       put :update, { :id => user.id, :user => valid_attrs }
     end
     assert_response :forbidden
   end
 
-  test "#update should allow updating mysel without any special permissions" do
+  test "#update should allow updating myself without any special permissions" do
     user = User.create :login => "foo", :mail => "foo@bar.com", :auth_source => auth_sources(:one)
     as_user user do
       put :update, { :id => user.id, :user => valid_attrs }
     end
     assert_response :success
diff --git a/test/controllers/api/v2/auth_source_ldaps_controller_test.rb b/test/controllers/api/v2/auth_source_ldaps_controller_test.rb
index f6bd44f9e3..97f337a5fb 100644
--- a/test/controllers/api/v2/auth_source_ldaps_controller_test.rb
+++ b/test/controllers/api/v2/auth_source_ldaps_controller_test.rb
@@ -17,11 +17,11 @@ class Api::V2::AuthSourceLdapsControllerTest < ActionController::TestCase
     show_response = ActiveSupport::JSON.decode(@response.body)
     assert !show_response.empty?
   end
 
   test "should create auth_source_ldap" do
-    assert_difference('AuthSourceLdap.count', 1) do
+    assert_difference('AuthSourceLdap.unscoped.count', 1) do
       post :create, { :auth_source_ldap => valid_attrs }
     end
     assert_response :created
   end
 
@@ -29,11 +29,11 @@ class Api::V2::AuthSourceLdapsControllerTest < ActionController::TestCase
     put :update, { :id => auth_sources(:one).to_param, :auth_source_ldap => valid_attrs }
     assert_response :success
   end
 
   test "should destroy auth_source_ldap" do
-    assert_difference('AuthSourceLdap.count', -1) do
+    assert_difference('AuthSourceLdap.unscoped.count', -1) do
       auth = auth_sources(:one)
       User.where(:auth_source_id => auth.id).update_all(:auth_source_id => nil)
       delete :destroy, { :id => auth.id }
     end
     assert_response :success
diff --git a/test/controllers/api/v2/compute_resources_controller_test.rb b/test/controllers/api/v2/compute_resources_controller_test.rb
index 469dcadf31..87350870c3 100644
--- a/test/controllers/api/v2/compute_resources_controller_test.rb
+++ b/test/controllers/api/v2/compute_resources_controller_test.rb
@@ -33,16 +33,17 @@ class Api::V2::ComputeResourcesControllerTest < ActionController::TestCase
     assert !show_response.empty?
   end
 
   test "should update compute resource" do
     put :update, { :id => compute_resources(:mycompute).to_param, :compute_resource => { :description => "new_description" } }
-    assert_equal "new_description", ComputeResource.find_by_name('mycompute').description
+    assert_equal "new_description",
+      ComputeResource.unscoped.find_by_name('mycompute').description
     assert_response :success
   end
 
   test "should destroy compute resource" do
-    assert_difference('ComputeResource.count', -1) do
+    assert_difference('ComputeResource.unscoped.count', -1) do
       delete :destroy, { :id => compute_resources(:yourcompute).id }
     end
     assert_response :success
   end
 
@@ -64,16 +65,17 @@ class Api::V2::ComputeResourcesControllerTest < ActionController::TestCase
   end
 
   test "should update compute resource for owner" do
     setup_user 'edit', 'compute_resources', "id = #{compute_resources(:mycompute).id}"
     put :update, { :id => compute_resources(:mycompute).to_param, :compute_resource => { :description => "new_description" } }
-    assert_equal "new_description", ComputeResource.find_by_name('mycompute').description
+    assert_equal "new_description",
+      ComputeResource.unscoped.find_by_name('mycompute').description
     assert_response :success
   end
 
   test "should destroy compute resource for owner" do
-    assert_difference('ComputeResource.count', -1) do
+    assert_difference('ComputeResource.unscoped.count', -1) do
       setup_user 'destroy', 'compute_resources', "id = #{compute_resources(:mycompute).id}"
       delete :destroy, { :id => compute_resources(:mycompute).id }
     end
     assert_response :success
   end
diff --git a/test/controllers/api/v2/config_reports_controller_test.rb b/test/controllers/api/v2/config_reports_controller_test.rb
index f1ac1a1276..2e08b9ad92 100644
--- a/test/controllers/api/v2/config_reports_controller_test.rb
+++ b/test/controllers/api/v2/config_reports_controller_test.rb
@@ -46,24 +46,25 @@ class Api::V2::ConfigReportsControllerTest < ActionController::TestCase
     test 'hosts with a registered smart proxy on should create a report successfully' do
       Setting[:restrict_registered_smart_proxies] = true
       Setting[:require_ssl_smart_proxies] = false
 
       proxy = smart_proxies(:puppetmaster)
+      proxy.update_attribute(:url, 'http://configreports.foreman')
       host = URI.parse(proxy.url).host
       Resolv.any_instance.stubs(:getnames).returns([host])
-      post :create, {:config_report => create_a_puppet_transaction_report }
+      post :create, { :config_report => create_a_puppet_transaction_report }
       assert_equal proxy, @controller.detected_proxy
       assert_response :created
     end
 
     test 'hosts without a registered smart proxy on should not be able to create a report' do
       Setting[:restrict_registered_smart_proxies] = true
       Setting[:require_ssl_smart_proxies] = false
 
       Resolv.any_instance.stubs(:getnames).returns(['another.host'])
       post :create, {:config_report => create_a_puppet_transaction_report }
-      assert_equal 403, @response.status
+      assert_response :forbidden
     end
 
     test 'hosts with a registered smart proxy and SSL cert should create a report successfully' do
       Setting[:restrict_registered_smart_proxies] = true
       Setting[:require_ssl_smart_proxies] = true
@@ -81,32 +82,32 @@ class Api::V2::ConfigReportsControllerTest < ActionController::TestCase
 
       @request.env['HTTPS'] = 'on'
       @request.env['SSL_CLIENT_S_DN'] = 'CN=another.host'
       @request.env['SSL_CLIENT_VERIFY'] = 'SUCCESS'
       post :create, {:config_report => create_a_puppet_transaction_report }
-      assert_equal 403, @response.status
+      assert_response :forbidden
     end
 
     test 'hosts with an unverified SSL cert should not be able to create a report' do
       Setting[:restrict_registered_smart_proxies] = true
       Setting[:require_ssl_smart_proxies] = true
 
       @request.env['HTTPS'] = 'on'
       @request.env['SSL_CLIENT_S_DN'] = 'CN=else.where'
       @request.env['SSL_CLIENT_VERIFY'] = 'FAILED'
       post :create, {:config_report => create_a_puppet_transaction_report }
-      assert_equal 403, @response.status
+      assert_response :forbidden
     end
 
     test 'when "require_ssl_smart_proxies" and "require_ssl" are true, HTTP requests should not be able to create a report' do
       Setting[:restrict_registered_smart_proxies] = true
       Setting[:require_ssl_smart_proxies] = true
       SETTINGS[:require_ssl] = true
 
       Resolv.any_instance.stubs(:getnames).returns(['else.where'])
       post :create, {:config_report => create_a_puppet_transaction_report }
-      assert_equal 403, @response.status
+      assert_response :forbidden
     end
 
     test 'when "require_ssl_smart_proxies" is true and "require_ssl" is false, HTTP requests should be able to create reports' do
       # since require_ssl_smart_proxies is only applicable to HTTPS connections, both should be set
       Setting[:restrict_registered_smart_proxies] = true
@@ -140,11 +141,11 @@ class Api::V2::ConfigReportsControllerTest < ActionController::TestCase
     report = FactoryGirl.create(:config_report)
     assert_difference('ConfigReport.count', -1) do
       delete :destroy, { :id => report.to_param }
     end
     assert_response :success
-    refute Report.find_by_id(report.id)
+    refute Report.unscoped.find_by_id(report.id)
   end
 
   test "should get reports for given host only" do
     report = FactoryGirl.create(:config_report)
     get :index, {:host_id => report.host.to_param }
diff --git a/test/controllers/api/v2/config_templates_controller_test.rb b/test/controllers/api/v2/config_templates_controller_test.rb
index 2a95c5021c..cc9b45ac5b 100644
--- a/test/controllers/api/v2/config_templates_controller_test.rb
+++ b/test/controllers/api/v2/config_templates_controller_test.rb
@@ -63,19 +63,19 @@ class Api::V2::ConfigTemplatesControllerTest < ActionController::TestCase
 
   test "should not destroy template with associated hosts" do
     config_template = templates(:pxekickstart)
     delete :destroy, { :id => config_template.to_param }
     assert_response 422
-    assert ProvisioningTemplate.exists?(config_template.id)
+    assert ProvisioningTemplate.unscoped.exists?(config_template.id)
   end
 
   test "should destroy" do
     config_template = templates(:pxekickstart)
     config_template.os_default_templates.clear
     delete :destroy, { :id => config_template.to_param }
     assert_response :ok
-    refute ProvisioningTemplate.exists?(config_template.id)
+    refute ProvisioningTemplate.unscoped.exists?(config_template.id)
   end
 
   test "should build pxe menu" do
     ProxyAPI::TFTP.any_instance.stubs(:create_default).returns(true)
     ProxyAPI::TFTP.any_instance.stubs(:fetch_boot_file).returns(true)
@@ -124,9 +124,11 @@ class Api::V2::ConfigTemplatesControllerTest < ActionController::TestCase
     assert !templates.empty?, "Should respond with templates"
   end
 
   test "should show template with non-admin user" do
     setup_user('view', 'provisioning_templates')
+    templates(:pxekickstart).organizations = User.current.organizations
+    templates(:pxekickstart).locations = User.current.locations
     get :show, { :id => templates(:pxekickstart).to_param }, set_session_user.merge(:user => User.current.id)
     assert_response :success
   end
 end
diff --git a/test/controllers/api/v2/domains_controller_test.rb b/test/controllers/api/v2/domains_controller_test.rb
index 17bcc03030..48ea9e3d9f 100644
--- a/test/controllers/api/v2/domains_controller_test.rb
+++ b/test/controllers/api/v2/domains_controller_test.rb
@@ -38,11 +38,11 @@ class Api::V2::DomainsControllerTest < ActionController::TestCase
     assert_response :unprocessable_entity
   end
 
   test "should update valid domain" do
     put :update, { :id => Domain.first.to_param, :domain => { :name => "domain.new" } }
-    assert_equal "domain.new", Domain.first.name
+    assert_equal "domain.new", Domain.unscoped.first.name
     assert_response :success
   end
 
   test "should not update invalid domain" do
     put :update, { :id => Domain.first.to_param, :domain => { :name => "" } }
@@ -67,19 +67,19 @@ class Api::V2::DomainsControllerTest < ActionController::TestCase
   end
 
   test "should get domains for location only" do
     get :index, {:location_id => taxonomies(:location1).id }
     assert_response :success
-    assert_equal 2, assigns(:domains).length
-    assert_equal assigns(:domains), [domains(:mydomain), domains(:yourdomain)]
+    assert_equal taxonomies(:location1).domains.length, assigns(:domains).length
+    assert_equal assigns(:domains), taxonomies(:location1).domains
   end
 
   test "should get domains for organization only" do
     get :index, {:organization_id => taxonomies(:organization1).id }
     assert_response :success
-    assert_equal 1, assigns(:domains).length
-    assert_equal assigns(:domains), [domains(:mydomain)]
+    assert_equal taxonomies(:organization1).domains.length, assigns(:domains).length
+    assert_equal taxonomies(:organization1).domains, assigns(:domains)
   end
 
   test "should get domains for both location and organization" do
     get :index, {:location_id => taxonomies(:location1).id, :organization_id => taxonomies(:organization1).id }
     assert_response :success
diff --git a/test/controllers/api/v2/environments_controller_test.rb b/test/controllers/api/v2/environments_controller_test.rb
index 5bed956636..16a4bf7baf 100644
--- a/test/controllers/api/v2/environments_controller_test.rb
+++ b/test/controllers/api/v2/environments_controller_test.rb
@@ -26,11 +26,11 @@ class Api::V2::EnvironmentsControllerTest < ActionController::TestCase
     get :show, { :id => environments(:production).name }
     assert_response :success
   end
 
   test "should create environment" do
-    assert_difference('Environment.count') do
+    assert_difference('Environment.unscoped.count') do
       post :create, { :environment => development_environment }
     end
     assert_response :created
   end
 
@@ -38,11 +38,11 @@ class Api::V2::EnvironmentsControllerTest < ActionController::TestCase
     put :update, { :id => environments(:production).to_param, :environment => development_environment }
     assert_response :success
   end
 
   test "should destroy environments" do
-    assert_difference('Environment.count', -1) do
+    assert_difference('Environment.unscoped.count', -1) do
       delete :destroy, { :id => environments(:testing).to_param }
     end
     assert_response :success
   end
 end
diff --git a/test/controllers/api/v2/hostgroups_controller_test.rb b/test/controllers/api/v2/hostgroups_controller_test.rb
index d1ca3bd8c4..b22893f588 100644
--- a/test/controllers/api/v2/hostgroups_controller_test.rb
+++ b/test/controllers/api/v2/hostgroups_controller_test.rb
@@ -33,11 +33,11 @@ class Api::V2::HostgroupsControllerTest < ActionController::TestCase
     show_response = ActiveSupport::JSON.decode(@response.body)
     assert !show_response.empty?
   end
 
   test "should create hostgroup" do
-    assert_difference('Hostgroup.count') do
+    assert_difference('Hostgroup.unscoped.count') do
       post :create, { :hostgroup => valid_attrs }
     end
     assert_response :created
   end
 
@@ -45,43 +45,44 @@ class Api::V2::HostgroupsControllerTest < ActionController::TestCase
     put :update, { :id => hostgroups(:common).to_param, :hostgroup => valid_attrs }
     assert_response :success
   end
 
   test "should destroy hostgroups" do
-    assert_difference('Hostgroup.count', -1) do
+    assert_difference('Hostgroup.unscoped.count', -1) do
       delete :destroy, { :id => hostgroups(:unusual).to_param }
     end
     assert_response :success
   end
 
   test "should clone hostgroup" do
-    assert_difference('Hostgroup.count') do
+    assert_difference('Hostgroup.unscoped.count') do
       post :clone, { :id => hostgroups(:common).to_param, :name => Time.now.utc.to_s }
     end
     assert_response :success
   end
 
   test "blocks API deletion of hosts with children" do
     assert hostgroups(:parent).has_children?
-    assert_no_difference('Hostgroup.count') do
+    assert_no_difference('Hostgroup.unscoped.count') do
       delete :destroy, { :id => hostgroups(:parent).to_param }
     end
     assert_response :conflict
   end
 
   test "should create nested hostgroup with a parent" do
-    assert_difference('Hostgroup.count') do
+    assert_difference('Hostgroup.unscoped.count') do
       post :create, { :hostgroup => valid_attrs.merge(:parent_id => hostgroups(:common).id) }
     end
     assert_response :success
     assert_equal hostgroups(:common).id.to_s, last_record.ancestry
   end
 
   test "should update a hostgroup to nested by passing parent_id" do
     put :update, { :id => hostgroups(:db).to_param, :hostgroup => {:parent_id => hostgroups(:common).id} }
     assert_response :success
-    assert_equal hostgroups(:common).id.to_s, Hostgroup.find_by_name("db").ancestry
+    assert_equal hostgroups(:common).id.to_s,
+      Hostgroup.unscoped.find_by_name("db").ancestry
   end
 
   test "user without view_params permission can't see hostgroup parameters" do
     setup_user "view", "hostgroups"
     hostgroup_with_parameter = FactoryGirl.create(:hostgroup, :with_parameter)
diff --git a/test/controllers/api/v2/hosts_controller_test.rb b/test/controllers/api/v2/hosts_controller_test.rb
index 6f8a63a287..91ef2ea5dd 100644
--- a/test/controllers/api/v2/hosts_controller_test.rb
+++ b/test/controllers/api/v2/hosts_controller_test.rb
@@ -233,13 +233,18 @@ class Api::V2::HostsControllerTest < ActionController::TestCase
 
     compute_attrs = compute_attributes(:with_interfaces)
     post :create, { :host => basic_attrs_with_profile(compute_attrs).merge(:interfaces_attributes =>  nics_attrs) }
     assert_response :created
 
-    assert_equal compute_attrs.vm_interfaces.count, last_record.interfaces.count
-    assert_equal expected_compute_attributes(compute_attrs, 0), last_record.interfaces.find_by_mac('00:11:22:33:44:00').compute_attributes
-    assert_equal expected_compute_attributes(compute_attrs, 1), last_record.interfaces.find_by_mac('00:11:22:33:44:01').compute_attributes
+    as_admin do
+      assert_equal compute_attrs.vm_interfaces.count,
+        last_record.interfaces.count
+      assert_equal expected_compute_attributes(compute_attrs, 0),
+        last_record.interfaces.find_by_mac('00:11:22:33:44:00').compute_attributes
+      assert_equal expected_compute_attributes(compute_attrs, 1),
+        last_record.interfaces.find_by_mac('00:11:22:33:44:01').compute_attributes
+    end
   end
 
   test "should create host with managed is false if parameter is passed" do
     disable_orchestration
     post :create, { :host => valid_attrs.merge!(:managed => false) }
@@ -278,14 +283,16 @@ class Api::V2::HostsControllerTest < ActionController::TestCase
     compute_attrs = compute_attributes(:with_interfaces)
 
     put :update, { :id => @host.to_param, :host => basic_attrs_with_profile(compute_attrs) }
     assert_response :success
 
-    @host.interfaces.reload
-    assert_equal compute_attrs.vm_interfaces.count, @host.interfaces.count
-    assert_equal expected_compute_attributes(compute_attrs, 0), @host.interfaces.find_by_primary(true).compute_attributes
-    assert_equal expected_compute_attributes(compute_attrs, 1), @host.interfaces.find_by_primary(false).compute_attributes
+    as_admin do
+      @host.interfaces.reload
+      assert_equal compute_attrs.vm_interfaces.count, @host.interfaces.count
+      assert_equal expected_compute_attributes(compute_attrs, 0), @host.interfaces.find_by_primary(true).compute_attributes
+      assert_equal expected_compute_attributes(compute_attrs, 1), @host.interfaces.find_by_primary(false).compute_attributes
+    end
   end
 
   test "should update host without :host root node and rails wraps it correctly" do
     put :update, { :id => @host.to_param, :name => 'newhostname' }
     request_parameters = @request.env['action_dispatch.request.request_parameters']
@@ -486,11 +493,11 @@ class Api::V2::HostsControllerTest < ActionController::TestCase
     hostname = fact_json['name']
     facts    = fact_json['facts']
     facts['foreman_hostgroup'] = hostgroup.title
     post :facts, {:name => hostname, :facts => facts}
     assert_response :success
-    assert_equal hostgroup, Host.find_by(:name => hostname).hostgroup
+    assert_equal hostgroup.id, Host.find_by(:name => hostname).hostgroup_id
   end
 
   test 'assign hostgroup attributes when foreman_hostgroup present in facts' do
     Setting[:create_new_host_when_facts_are_uploaded] = true
     hostgroup = FactoryGirl.create(:hostgroup, :with_rootpass)
@@ -519,10 +526,11 @@ class Api::V2::HostsControllerTest < ActionController::TestCase
     User.current = users(:one) #use an unprivileged user, not apiadmin
     Setting[:restrict_registered_smart_proxies] = true
     Setting[:require_ssl_smart_proxies] = false
 
     proxy = smart_proxies(:puppetmaster)
+    proxy.update_attribute(:url, 'https://factsimporter.foreman')
     host = URI.parse(proxy.url).host
     Resolv.any_instance.stubs(:getnames).returns([host])
     hostname = fact_json['name']
     facts    = fact_json['facts']
     post :facts, {:name => hostname, :facts => facts}
diff --git a/test/controllers/api/v2/locations_controller_test.rb b/test/controllers/api/v2/locations_controller_test.rb
index 7633bf725c..d6294bd2d4 100644
--- a/test/controllers/api/v2/locations_controller_test.rb
+++ b/test/controllers/api/v2/locations_controller_test.rb
@@ -63,11 +63,11 @@ class Api::V2::LocationsControllerTest < ActionController::TestCase
     put :update, { :id => Location.first.to_param, :location => { :name => "" } }
     assert_response :unprocessable_entity
   end
 
   test "should destroy location if hosts do not use it" do
-    assert_difference('Location.count', -1) do
+    assert_difference('Location.unscoped.count', -1) do
       delete :destroy, { :id => taxonomies(:location2).to_param }
     end
     assert_response :success
   end
 
@@ -84,24 +84,33 @@ class Api::V2::LocationsControllerTest < ActionController::TestCase
     end
   end
 
   test "should dissociate hosts from the destroyed location" do
     host = FactoryGirl.create(:host, :location => taxonomies(:location1))
-    assert_difference('Location.count', -1) do
+    assert_difference('Location.unscoped.count', -1) do
       delete :destroy, { :id => taxonomies(:location1).to_param }
     end
     assert_response :success
     assert_nil Host::Managed.find(host.id).location
   end
 
   test "should update *_ids. test for domain_ids" do
     # ignore all but Domain
-    @location.ignore_types = ["Hostgroup", "Environment", "User", "Medium", "Subnet", "SmartProxy", "ProvisioningTemplate", "ComputeResource", "Realm"]
+    @location.ignore_types = ["Hostgroup", "Environment", "User", "Medium",
+                              "Subnet", "SmartProxy", "ProvisioningTemplate",
+                              "ComputeResource", "Realm"]
     as_admin do
       @location.save(:validate => false)
       assert_difference('@location.domains.count', 2) do
-        put :update, { :id => @location.to_param, :location => { :domain_ids => Domain.pluck(:id) } }
+        put :update, {
+          :id => @location.to_param,
+          :location => { :domain_ids => Domain.unscoped.pluck(:id) }
+        }
+        User.current = users(:admin)
+        # as_admin gets invalidated after the call, so we need to restore it
+        # in order to make the call to @location.domains.count  in the right
+        # context
       end
     end
     assert_response :success
   end
 
diff --git a/test/controllers/api/v2/media_controller_test.rb b/test/controllers/api/v2/media_controller_test.rb
index 8cdf380f93..41dd28eaa4 100644
--- a/test/controllers/api/v2/media_controller_test.rb
+++ b/test/controllers/api/v2/media_controller_test.rb
@@ -21,11 +21,11 @@ class Api::V2::MediaControllerTest < ActionController::TestCase
     show_response = ActiveSupport::JSON.decode(@response.body)
     assert !show_response.empty?
   end
 
   test "should create medium" do
-    assert_difference('Medium.count', +1) do
+    assert_difference('Medium.unscoped.count', +1) do
       post :create, { :medium => new_medium }
     end
     assert_response :created
     assert_not_nil assigns(:medium)
   end
@@ -35,11 +35,11 @@ class Api::V2::MediaControllerTest < ActionController::TestCase
     put :update, { :id => Medium.first.id.to_param, :name => name.to_s.to_param }
     assert_response :success
   end
 
   test "should destroy medium" do
-    assert_difference('Medium.count', -1) do
+    assert_difference('Medium.unscoped.count', -1) do
       delete :destroy, { :id => media(:unused).id.to_param }
     end
     assert_response :success
   end
 end
diff --git a/test/controllers/api/v2/parameters_controller_test.rb b/test/controllers/api/v2/parameters_controller_test.rb
index 3813ad9a6f..5bb3d1f6e8 100644
--- a/test/controllers/api/v2/parameters_controller_test.rb
+++ b/test/controllers/api/v2/parameters_controller_test.rb
@@ -155,35 +155,40 @@ class Api::V2::ParametersControllerTest < ActionController::TestCase
   end
 
   test "should update nested host parameter" do
     put :update, { :host_id => @host.to_param, :id => @host.parameters.first.to_param, :parameter => valid_attrs }
     assert_response :success
-    assert_equal '123', Host.find_by_name(@host.name).parameters.order("parameters.updated_at").last.value
+    assert_equal '123', Host.unscoped.find_by_name(@host.name).parameters.
+      order("parameters.updated_at").last.value
   end
 
   test "should update nested domain parameter" do
     put :update, { :domain_id => domains(:mydomain).to_param, :id => parameters(:domain).to_param, :parameter => valid_attrs }
     assert_response :success
-    assert_equal Domain.find_by_name("mydomain.net").parameters.order("parameters.updated_at").last.value, "123"
+    assert_equal Domain.unscoped.find_by_name("mydomain.net").parameters.
+      order("parameters.updated_at").last.value, "123"
   end
 
   test "should update nested subnet parameter" do
     put :update, { :subnet_id => subnets(:five).to_param, :id => parameters(:subnet).to_param, :parameter => valid_attrs }
     assert_response :success
-    assert_equal Subnet.find_by_name("five").parameters.order("parameters.updated_at").last.value, "123"
+    assert_equal Subnet.unscoped.find_by_name("five").parameters.
+      order("parameters.updated_at").last.value, "123"
   end
 
   test "should update nested hostgroup parameter" do
     put :update, { :hostgroup_id => hostgroups(:common).to_param, :id => parameters(:group).to_param, :parameter => valid_attrs }
     assert_response :success
-    assert_equal Hostgroup.find_by_name("Common").group_parameters.order("parameters.updated_at").last.value, "123"
+    assert_equal Hostgroup.unscoped.find_by_name("Common").group_parameters.
+      order("parameters.updated_at").last.value, "123"
   end
 
   test "should update nested os parameter" do
     put :update, { :operatingsystem_id => operatingsystems(:redhat).to_param, :id => parameters(:os).to_param, :parameter => valid_attrs }
     assert_response :success
-    assert_equal Operatingsystem.find_by_name("Redhat").parameters.order("parameters.updated_at").last.value, "123"
+    assert_equal Operatingsystem.unscoped.find_by_name("Redhat").parameters.
+      order("parameters.updated_at").last.value, "123"
   end
 
   test "should destroy nested host parameter" do
     assert_difference('HostParameter.count', -1) do
       delete :destroy, { :host_id => @host.to_param, :id => @host.parameters.first.to_param }
diff --git a/test/controllers/api/v2/provisioning_templates_controller_test.rb b/test/controllers/api/v2/provisioning_templates_controller_test.rb
index 0245231765..8a8e3ec028 100644
--- a/test/controllers/api/v2/provisioning_templates_controller_test.rb
+++ b/test/controllers/api/v2/provisioning_templates_controller_test.rb
@@ -51,19 +51,19 @@ class Api::V2::ProvisioningTemplatesControllerTest < ActionController::TestCase
 
   test "should not destroy template with associated hosts" do
     provisioning_template = templates(:pxekickstart)
     delete :destroy, { :id => provisioning_template.to_param }
     assert_response 422
-    assert ProvisioningTemplate.exists?(provisioning_template.id)
+    assert ProvisioningTemplate.unscoped.exists?(provisioning_template.id)
   end
 
   test "should destroy" do
     provisioning_template = templates(:pxekickstart)
     provisioning_template.os_default_templates.clear
     delete :destroy, { :id => provisioning_template.to_param }
     assert_response :ok
-    refute ProvisioningTemplate.exists?(provisioning_template.id)
+    refute ProvisioningTemplate.unscoped.exists?(provisioning_template.id)
   end
 
   test "should build pxe menu" do
     ProxyAPI::TFTP.any_instance.stubs(:create_default).returns(true)
     ProxyAPI::TFTP.any_instance.stubs(:fetch_boot_file).returns(true)
diff --git a/test/controllers/api/v2/ptables_controller_test.rb b/test/controllers/api/v2/ptables_controller_test.rb
index 97128d888a..8775e560b8 100644
--- a/test/controllers/api/v2/ptables_controller_test.rb
+++ b/test/controllers/api/v2/ptables_controller_test.rb
@@ -21,18 +21,18 @@ class Api::V2::PtablesControllerTest < ActionController::TestCase
     show_response = ActiveSupport::JSON.decode(@response.body)
     assert !show_response.empty?
   end
 
   test "should create ptable" do
-    assert_difference('Ptable.count') do
+    assert_difference('Ptable.unscoped.count') do
       post :create, { :ptable => valid_attrs }
     end
     assert_response :created
   end
 
   test "should created ptable with unwrapped 'layout'" do
-    assert_difference('Ptable.count') do
+    assert_difference('Ptable.unscoped.count') do
       post :create, valid_attrs
     end
     assert_response :created
   end
 
@@ -50,18 +50,18 @@ class Api::V2::PtablesControllerTest < ActionController::TestCase
     assert_equal operatingsystems(:redhat).id, show_response["operatingsystems"].first["id"]
   end
 
   test "should NOT destroy ptable in use" do
     FactoryGirl.create(:host, :ptable_id => @ptable.id)
-    assert_difference('Ptable.count', -0) do
+    assert_difference('Ptable.unscoped.count', 0) do
       delete :destroy, { :id => @ptable.to_param }
     end
     assert_response :unprocessable_entity
   end
 
   test "should destroy ptable that is NOT in use" do
-    assert_difference('Ptable.count', -1) do
+    assert_difference('Ptable.unscoped.count', -1) do
       delete :destroy, { :id => @ptable.to_param }
     end
     assert_response :success
   end
 
diff --git a/test/controllers/api/v2/realms_controller_test.rb b/test/controllers/api/v2/realms_controller_test.rb
index eccac0c8b6..5c5e809f4c 100644
--- a/test/controllers/api/v2/realms_controller_test.rb
+++ b/test/controllers/api/v2/realms_controller_test.rb
@@ -25,12 +25,13 @@ class Api::V2::RealmsControllerTest < ActionController::TestCase
     show_response = ActiveSupport::JSON.decode(@response.body)
     assert !show_response.empty?
   end
 
   test "should update valid realm" do
-    put :update, { :id => Realm.first.to_param, :realm => { :name => "realm.new" } }
-    assert_equal "realm.new", Realm.first.name
+    realm_id = Realm.unscoped.first.id
+    put :update, { :id => realm_id, :realm => { :name => "realm.new" } }
+    assert_equal "realm.new", Realm.unscoped.find(realm_id).name
     assert_response :success
   end
 
   test "should not update invalid realm" do
     put :update, { :id => Realm.first.to_param, :realm => { :name => "" } }
@@ -42,11 +43,11 @@ class Api::V2::RealmsControllerTest < ActionController::TestCase
     realm.hosts.clear
     realm.hostgroups.clear
     delete :destroy, { :id => realm.to_param }
     realm = ActiveSupport::JSON.decode(@response.body)
     assert_response :ok
-    refute Realm.find_by_id(realm['id'])
+    refute Realm.unscoped.find_by_id(realm['id'])
   end
 
   #test that taxonomy scope works for api for realms
   def setup
     taxonomies(:location1).realm_ids = [realms(:myrealm).id, realms(:yourrealm).id]
@@ -54,19 +55,19 @@ class Api::V2::RealmsControllerTest < ActionController::TestCase
   end
 
   test "should get realms for location only" do
     get :index, {:location_id => taxonomies(:location1).id }
     assert_response :success
-    assert_equal 2, assigns(:realms).length
-    assert_equal assigns(:realms), [realms(:myrealm), realms(:yourrealm)]
+    assert_equal taxonomies(:location1).realms.length, assigns(:realms).length
+    assert_equal assigns(:realms), taxonomies(:location1).realms
   end
 
   test "should get realms for organization only" do
     get :index, {:organization_id => taxonomies(:organization1).id }
     assert_response :success
-    assert_equal 1, assigns(:realms).length
-    assert_equal assigns(:realms), [realms(:myrealm)]
+    assert_equal taxonomies(:organization1).realms.length, assigns(:realms).length
+    assert_equal assigns(:realms), taxonomies(:organization1).realms
   end
 
   test "should get realms for both location and organization" do
     get :index, {:location_id => taxonomies(:location1).id, :organization_id => taxonomies(:organization1).id }
     assert_response :success
diff --git a/test/controllers/api/v2/reports_controller_test.rb b/test/controllers/api/v2/reports_controller_test.rb
index b67ffdab93..6b087a862d 100644
--- a/test/controllers/api/v2/reports_controller_test.rb
+++ b/test/controllers/api/v2/reports_controller_test.rb
@@ -51,10 +51,11 @@ class Api::V2::ReportsControllerTest < ActionController::TestCase
     test 'hosts with a registered smart proxy on should create a report successfully' do
       Setting[:restrict_registered_smart_proxies] = true
       Setting[:require_ssl_smart_proxies] = false
 
       proxy = smart_proxies(:puppetmaster)
+      proxy.update_attribute(:url, 'http://foremanimporter.report')
       host = URI.parse(proxy.url).host
       Resolv.any_instance.stubs(:getnames).returns([host])
       post :create, {:report => create_a_puppet_transaction_report }
       assert_equal proxy, @controller.detected_proxy
       assert_response :created
diff --git a/test/controllers/api/v2/smart_proxies_controller_test.rb b/test/controllers/api/v2/smart_proxies_controller_test.rb
index c76a53f3e4..8f56a860d5 100644
--- a/test/controllers/api/v2/smart_proxies_controller_test.rb
+++ b/test/controllers/api/v2/smart_proxies_controller_test.rb
@@ -21,11 +21,11 @@ class Api::V2::SmartProxiesControllerTest < ActionController::TestCase
     refute_empty assigns(:smart_proxies)
     smart_proxies = ActiveSupport::JSON.decode(@response.body)
     refute_empty smart_proxies
 
     returned_proxy_ids = smart_proxies['results'].map { |p| p["id"] }
-    expected_proxy_ids = SmartProxy.with_features("TFTP").map { |p| p.id }
+    expected_proxy_ids = SmartProxy.unscoped.with_features("TFTP").map { |p| p.id }
     assert_equal expected_proxy_ids, returned_proxy_ids
   end
 
   test "should get index filtered by name" do
     get :index, { :search => "name ~ \"*TFTP*\"" }
@@ -33,11 +33,11 @@ class Api::V2::SmartProxiesControllerTest < ActionController::TestCase
     refute_empty assigns(:smart_proxies)
     smart_proxies = ActiveSupport::JSON.decode(@response.body)
     refute_empty smart_proxies
 
     returned_proxy_ids = smart_proxies['results'].map { |p| p["id"] }
-    expected_proxy_ids = SmartProxy.with_features("TFTP").map { |p| p.id }
+    expected_proxy_ids = SmartProxy.unscoped.with_features("TFTP").map { |p| p.id }
     assert_equal expected_proxy_ids, returned_proxy_ids
   end
 
   test "should show individual record" do
     get :show, { :id => smart_proxies(:one).to_param }
@@ -45,11 +45,11 @@ class Api::V2::SmartProxiesControllerTest < ActionController::TestCase
     show_response = ActiveSupport::JSON.decode(@response.body)
     assert !show_response.empty?
   end
 
   test "should create smart_proxy" do
-    assert_difference('SmartProxy.count') do
+    assert_difference('SmartProxy.unscoped.count') do
       post :create, { :smart_proxy => valid_attrs }
     end
     assert_response :created
   end
 
@@ -57,11 +57,11 @@ class Api::V2::SmartProxiesControllerTest < ActionController::TestCase
     put :update, { :id => smart_proxies(:one).to_param, :smart_proxy => valid_attrs }
     assert_response :success
   end
 
   test "should destroy smart_proxy" do
-    assert_difference('SmartProxy.count', -1) do
+    assert_difference('SmartProxy.unscoped.count', -1) do
       delete :destroy, { :id => smart_proxies(:four).to_param }
     end
     assert_response :success
   end
 
@@ -129,11 +129,11 @@ class Api::V2::SmartProxiesControllerTest < ActionController::TestCase
       Host::Managed.update_all(:environment_id => nil)
       Hostgroup.update_all(:environment_id => nil)
       Puppetclass.destroy_all
       Environment.destroy_all
     end
-    assert_difference('Environment.count', 2) do
+    assert_difference('Environment.unscoped.count', 2) do
       post :import_puppetclasses, {:id => smart_proxies(:puppetmaster).id}, set_session_user
     end
     assert_response :success
     response = ActiveSupport::JSON.decode(@response.body)
     assert_equal 2, response['environments_with_new_puppetclasses']
@@ -145,11 +145,11 @@ class Api::V2::SmartProxiesControllerTest < ActionController::TestCase
       as_admin do
         Host::Managed.update_all(:environment_id => nil)
         Hostgroup.update_all(:environment_id => nil)
         Puppetclass.destroy_all
         Environment.destroy_all
-        assert_difference('Puppetclass.count', 1) do
+        assert_difference('Puppetclass.unscoped.count', 1) do
           post :import_puppetclasses,
                { :id => smart_proxies(:puppetmaster).id }.merge(dryrun_param),
                set_session_user
         end
       end
@@ -162,11 +162,11 @@ class Api::V2::SmartProxiesControllerTest < ActionController::TestCase
     as_admin do
       Host::Managed.update_all(:environment_id => nil)
       Hostgroup.update_all(:environment_id => nil)
       Puppetclass.destroy_all
       Environment.destroy_all
-      assert_difference('Puppetclass.count', 0) do
+      assert_difference('Puppetclass.unscoped.count', 0) do
         post :import_puppetclasses, { :id => smart_proxies(:puppetmaster).id, :dryrun => true }, set_session_user
       end
     end
     assert_response :success
   end
@@ -174,40 +174,40 @@ class Api::V2::SmartProxiesControllerTest < ActionController::TestCase
   test "should obsolete environment" do
     setup_import_classes
     as_admin do
       Environment.create!(:name => 'xyz')
     end
-    assert_difference('Environment.count', -1) do
+    assert_difference('Environment.unscoped.count', -1) do
       post :import_puppetclasses, {:id => smart_proxies(:puppetmaster).id}, set_session_user
     end
     assert_response :success
   end
 
   test "should obsolete puppetclasses" do
     setup_import_classes
     as_admin do
-      assert_difference('Environment.find_by_name("env1").puppetclasses.count', -2) do
+      assert_difference('Environment.unscoped.find_by_name("env1").puppetclasses.count', -2) do
         post :import_puppetclasses, {:id => smart_proxies(:puppetmaster).id}, set_session_user
       end
     end
     assert_response :success
   end
 
   test "should update puppetclass smart class parameters" do
     setup_import_classes
     LookupKey.destroy_all
-    assert_difference('LookupKey.count', 1) do
+    assert_difference('LookupKey.unscoped.count', 1) do
       post :import_puppetclasses, {:id => smart_proxies(:puppetmaster).id}, set_session_user
     end
     assert_response :success
   end
 
   test "no changes on import_puppetclasses" do
     setup_import_classes
     Puppetclass.find_by_name('b').destroy
     Puppetclass.find_by_name('c').destroy
-    assert_difference('Environment.count', 0) do
+    assert_difference('Environment.unscoped.count', 0) do
       post :import_puppetclasses, {:id => smart_proxies(:puppetmaster).id}, set_session_user
     end
     assert_response :success
     response = ActiveSupport::JSON.decode(@response.body)
     assert_equal 'Successfully updated environment and puppetclasses from the on-disk puppet installation', response['message']
@@ -216,11 +216,11 @@ class Api::V2::SmartProxiesControllerTest < ActionController::TestCase
   test "should import new environment that does not exist in db" do
     setup_import_classes
     as_admin do
       env_name = 'env1'
       assert Environment.find_by_name(env_name).destroy
-      assert_difference('Environment.count', 1) do
+      assert_difference('Environment.unscoped.count', 1) do
         post :import_puppetclasses, {:id => smart_proxies(:puppetmaster).id, :environment_id => env_name}, set_session_user
       end
       assert_response :success
       response = ActiveSupport::JSON.decode(@response.body)
       assert_equal env_name, response['results']['name']
@@ -230,21 +230,21 @@ class Api::V2::SmartProxiesControllerTest < ActionController::TestCase
   test "should NOT delete environment if pass ?except=obsolete" do
     setup_import_classes
     as_admin do
       Environment.create!(:name => 'xyz')
     end
-    assert_difference('Environment.count', 0) do
+    assert_difference('Environment.unscoped.count', 0) do
       post :import_puppetclasses, {:id => smart_proxies(:puppetmaster).id, :except => 'obsolete'}, set_session_user
     end
     assert_response :success
   end
 
   test "should NOT add or update puppetclass smart class parameters if pass ?except=new,updated" do
     setup_import_classes
     LookupKey.destroy_all
-    assert_difference('LookupKey.count', 0) do
-     post :import_puppetclasses, {:id => smart_proxies(:puppetmaster).id, :except => 'new,updated'}, set_session_user
+    assert_difference('LookupKey.unscoped.count', 0) do
+      post :import_puppetclasses, {:id => smart_proxies(:puppetmaster).id, :except => 'new,updated'}, set_session_user
     end
     assert_response :success
   end
 
   context 'import puppetclasses' do
@@ -263,20 +263,20 @@ class Api::V2::SmartProxiesControllerTest < ActionController::TestCase
         assert_template "api/v2/import_puppetclasses/index"
       end
     end
 
     test "should import puppetclasses for specified environment only" do
-      assert_difference('Puppetclass.count', 1) do
+      assert_difference('Puppetclass.unscoped.count', 1) do
         post :import_puppetclasses, {:id => smart_proxies(:puppetmaster).id, :environment_id => 'env1'}, set_session_user
         assert_includes Puppetclass.pluck(:name), 'a'
         refute_includes Puppetclass.pluck(:name), 'b'
       end
       assert_response :success
     end
 
     test "should import puppetclasses for all environments if none specified" do
-      assert_difference('Puppetclass.count', 2) do
+      assert_difference('Puppetclass.unscoped.count', 2) do
         post :import_puppetclasses, {:id => smart_proxies(:puppetmaster).id}, set_session_user
         assert_includes Puppetclass.pluck(:name), 'a'
         assert_includes Puppetclass.pluck(:name), 'b'
       end
       assert_response :success
diff --git a/test/controllers/api/v2/subnets_controller_test.rb b/test/controllers/api/v2/subnets_controller_test.rb
index f607bdb462..5607563904 100644
--- a/test/controllers/api/v2/subnets_controller_test.rb
+++ b/test/controllers/api/v2/subnets_controller_test.rb
@@ -18,27 +18,27 @@ class Api::V2::SubnetsControllerTest < ActionController::TestCase
     show_response = ActiveSupport::JSON.decode(@response.body)
     assert !show_response.empty?
   end
 
   test "should create IPv4 subnet" do
-    assert_difference('Subnet.count') do
+    assert_difference('Subnet.unscoped.count') do
       post :create, { :subnet => valid_v4_attrs }
     end
     assert_response :created
   end
 
   test "should create IPv4 subnet if type is not defined" do
-    assert_difference('Subnet.count') do
+    assert_difference('Subnet.unscoped.count') do
       post :create, { :subnet => valid_v4_attrs.reject {|k, v| k == :network_type} }
     end
-    subnet = Subnet.find_by_name(valid_v4_attrs[:name])
+    subnet = Subnet.unscoped.find_by_name(valid_v4_attrs[:name])
     assert_equal valid_v4_attrs[:network_type], subnet.network_type
     assert_response :created
   end
 
   test "should create IPv6 subnet" do
-    assert_difference('Subnet.count') do
+    assert_difference('Subnet.unscoped.count') do
       post :create, { :subnet => valid_v6_attrs }
     end
     assert_response :created
   end
 
@@ -56,18 +56,18 @@ class Api::V2::SubnetsControllerTest < ActionController::TestCase
     put :update, { :id => subnets(:one).to_param, :subnet => valid_v6_attrs }
     assert_response :unprocessable_entity
   end
 
   test "should destroy subnets" do
-    assert_difference('Subnet.count', -1) do
+    assert_difference('Subnet.unscoped.count', -1) do
       delete :destroy, { :id => subnets(:four).to_param }
     end
     assert_response :success
   end
 
   test "should NOT destroy subnet that is in use" do
-    assert_difference('Subnet.count', 0) do
+    assert_difference('Subnet.unscoped.count', 0) do
       delete :destroy, { :id => subnets(:one).to_param }
     end
     assert_response :unprocessable_entity
   end
 
diff --git a/test/controllers/api/v2/users_controller_test.rb b/test/controllers/api/v2/users_controller_test.rb
index 21cd9ce2e3..e9fd275b75 100644
--- a/test/controllers/api/v2/users_controller_test.rb
+++ b/test/controllers/api/v2/users_controller_test.rb
@@ -59,31 +59,31 @@ class Api::V2::UsersControllerTest < ActionController::TestCase
   test "should update user" do
     user = User.create :login => "foo", :mail => "foo@bar.com", :auth_source => auth_sources(:one)
     put :update, { :id => user.id, :user => valid_attrs }
     assert_response :success
 
-    mod_user = User.find_by_id(user.id)
+    mod_user = User.unscoped.find_by_id(user.id)
     assert mod_user.login == "johnsmith"
   end
 
   test "should update admin flag" do
     user = users(:one)
     put :update, { :id => user.id, :user => { :admin => true } }
 
     assert_response :success
-    assert User.find_by_id(user.id).admin?
+    assert User.unscoped.find_by_id(user.id).admin?
   end
 
   test "should not remove the default role" do
     user = User.create :login => "foo", :mail => "foo@bar.com", :auth_source => auth_sources(:one)
 
     assert user.roles =([roles(:default_role)])
 
     put :update, { :id => user.id, :user => { :login => "johnsmith" } }
     assert_response :success
 
-    mod_user = User.find_by_id(user.id)
+    mod_user = User.unscoped.find_by_id(user.id)
 
     assert mod_user.roles =([roles(:default_role)])
   end
 
   test "should set password" do
@@ -92,11 +92,11 @@ class Api::V2::UsersControllerTest < ActionController::TestCase
     assert user.save
 
     put :update, { :id => user.id, :user => { :login => "johnsmith", :password => "dummy", :password_confirmation => "dummy" } }
     assert_response :success
 
-    mod_user = User.find_by_id(user.id)
+    mod_user = User.unscoped.find_by_id(user.id)
     assert mod_user.matching_password?("dummy")
   end
 
   test "should detect password validation mismatches" do
     user          = User.new :login => "foo", :mail => "foo@bar.com", :firstname => "john", :lastname => "smith", :auth_source => auth_sources(:internal)
@@ -104,21 +104,21 @@ class Api::V2::UsersControllerTest < ActionController::TestCase
     assert user.save
 
     put :update, { :id => user.id, :user => { :login => "johnsmith", :password => "dummy", :password_confirmation => "DUMMY" } }
     assert_response :unprocessable_entity
 
-    mod_user = User.find_by_id(user.id)
+    mod_user = User.unscoped.find_by_id(user.id)
     assert mod_user.matching_password?("changeme")
   end
 
   test "should delete different user" do
     user = users(:one)
 
     delete :destroy, { :id => user.id }
     assert_response :success
 
-    assert !User.exists?(user.id)
+    refute User.unscoped.exists?(user.id)
   end
 
   test "should not delete same user" do
     user = users(:one)
     user.update_attribute :admin, true
@@ -128,11 +128,11 @@ class Api::V2::UsersControllerTest < ActionController::TestCase
       assert_response :forbidden
 
       response = ActiveSupport::JSON.decode(@response.body)
       assert_equal "You are trying to delete your own account", response['error']['details']
       assert_equal "Access denied", response['error']['message']
-      assert User.exists?(user.id)
+      assert User.unscoped.exists?(user.id)
     end
   end
 
   def user_one_as_anonymous_viewer
     users(:one).roles = [Role.default, Role.find_by_name('Viewer')]
diff --git a/test/controllers/application_controller_subclass_test.rb b/test/controllers/application_controller_subclass_test.rb
index 1dfc59a548..a089eda570 100644
--- a/test/controllers/application_controller_subclass_test.rb
+++ b/test/controllers/application_controller_subclass_test.rb
@@ -78,14 +78,16 @@ class TestableResourcesControllerTest < ActionController::TestCase
       get :index
       assert_equal '/realms', session[:original_uri]
     end
 
     it "requires an account with mail" do
-      user = FactoryGirl.create(:user)
-      get :index, {}, set_session_user.merge(:user => user.id)
+      as_admin do
+        @user = FactoryGirl.create(:user)
+      end
+      get :index, {}, set_session_user.merge(:user => @user.id)
       assert_response :redirect
-      assert_redirected_to edit_user_path(user)
+      assert_redirected_to edit_user_path(@user)
       assert_equal "An email address is required, please update your account details", flash[:error]
     end
 
     context "and SSO authenticates" do
       setup do
diff --git a/test/controllers/auth_source_ldaps_controller_test.rb b/test/controllers/auth_source_ldaps_controller_test.rb
index 76a35964a6..4a06cddfff 100644
--- a/test/controllers/auth_source_ldaps_controller_test.rb
+++ b/test/controllers/auth_source_ldaps_controller_test.rb
@@ -1,10 +1,10 @@
 require 'test_helper'
 
 class AuthSourceLdapsControllerTest < ActionController::TestCase
   setup do
-    @model = AuthSourceLdap.first
+    @model = AuthSourceLdap.unscoped.first
   end
 
   basic_index_test
   basic_new_test
   basic_edit_test
@@ -15,46 +15,46 @@ class AuthSourceLdapsControllerTest < ActionController::TestCase
     assert_template 'new'
   end
 
   def test_create_valid
     AuthSourceLdap.any_instance.stubs(:valid?).returns(true)
-    post :create, {:auth_source_ldap => {:name => AuthSourceLdap.first.name}}, set_session_user
+    post :create, {:auth_source_ldap => {:name => AuthSourceLdap.unscoped.first.name}}, set_session_user
     assert_redirected_to auth_source_ldaps_url
   end
 
   def test_update_invalid
     AuthSourceLdap.any_instance.stubs(:valid?).returns(false)
-    put :update, {:id => AuthSourceLdap.first, :auth_source_ldap => {:name => AuthSourceLdap.first.name} }, set_session_user
+    put :update, {:id => AuthSourceLdap.unscoped.first, :auth_source_ldap => {:name => AuthSourceLdap.unscoped.first.name} }, set_session_user
     assert_template 'edit'
   end
 
   def test_formats_valid
     AuthSourceLdap.any_instance.stubs(:valid?).returns(false)
-    put :update, {:id => AuthSourceLdap.first.id, :format => "weird", :auth_source_ldap => {:name => AuthSourceLdap.first.name} }, set_session_user
+    put :update, {:id => AuthSourceLdap.unscoped.first.id, :format => "weird", :auth_source_ldap => {:name => AuthSourceLdap.unscoped.first.name} }, set_session_user
     assert_response :success
 
-    wierd_id = "#{AuthSourceLdap.first.id}.weird"
-    put :update, {:id => wierd_id, :auth_source_ldap => {:name => AuthSourceLdap.first.name} }, set_session_user
+    wierd_id = "#{AuthSourceLdap.unscoped.first.id}.weird"
+    put :update, {:id => wierd_id, :auth_source_ldap => {:name => AuthSourceLdap.unscoped.first.name} }, set_session_user
     assert_response :success
 
-    parameterized_id = "#{AuthSourceLdap.first.id}-#{AuthSourceLdap.first.name.parameterize}"
-    put :update, {:id => parameterized_id, :auth_source_ldap => {:name => AuthSourceLdap.first.name} }, set_session_user
+    parameterized_id = "#{AuthSourceLdap.unscoped.first.id}-#{AuthSourceLdap.unscoped.first.name.parameterize}"
+    put :update, {:id => parameterized_id, :auth_source_ldap => {:name => AuthSourceLdap.unscoped.first.name} }, set_session_user
     assert_response :success
   end
 
   def test_update_valid
     AuthSourceLdap.any_instance.stubs(:valid?).returns(true)
-    put :update, {:id => AuthSourceLdap.first, :auth_source_ldap => {:name => AuthSourceLdap.first.name} }, set_session_user
+    put :update, {:id => AuthSourceLdap.unscoped.first, :auth_source_ldap => {:name => AuthSourceLdap.unscoped.first.name} }, set_session_user
     assert_redirected_to auth_source_ldaps_url
   end
 
   def test_destroy
-    auth_source_ldap = AuthSourceLdap.first
-    User.where(:auth_source_id => auth_source_ldap.id).update_all(:auth_source_id => nil)
+    auth_source_ldap = AuthSourceLdap.unscoped.first
+    User.unscoped.where(:auth_source_id => auth_source_ldap.id).update_all(:auth_source_id => nil)
     delete :destroy, {:id => auth_source_ldap}, set_session_user
     assert_redirected_to auth_source_ldaps_url
-    assert !AuthSourceLdap.exists?(auth_source_ldap.id)
+    refute AuthSourceLdap.unscoped.exists?(auth_source_ldap.id)
   end
 
   context 'user with viewer rights' do
     # The 'Viewer' role has '*_authenticators' filters, so these tests test
     # the override of 'controller_name' to 'authorizers' instead of
@@ -64,11 +64,11 @@ class AuthSourceLdapsControllerTest < ActionController::TestCase
       @request.session[:user] = users(:one).id
       users(:one).roles       = [Role.default, Role.find_by_name('Viewer')]
     end
 
     test 'should fail to edit authentication source' do
-      get :edit, { :id => AuthSourceLdap.first.id },
+      get :edit, { :id => AuthSourceLdap.unscoped.first.id },
         set_session_user(users(:one))
       assert_response :forbidden
       assert_includes @response.body, 'edit_authenticators'
     end
   end
@@ -77,11 +77,11 @@ class AuthSourceLdapsControllerTest < ActionController::TestCase
     auth_source_ldap = FactoryGirl.create(:auth_source_ldap, :service_account)
     old_pass = auth_source_ldap.account_password
     as_admin do
       put :update, {:commit => "Update", :id => auth_source_ldap.id, :auth_source_ldap => {:name => auth_source_ldap.name} }, set_session_user
     end
-    auth_source_ldap = AuthSourceLdap.find(auth_source_ldap.id)
+    auth_source_ldap = AuthSourceLdap.unscoped.find(auth_source_ldap.id)
     assert_equal old_pass, auth_source_ldap.account_password
   end
 
   test "#update with blank account_password erases password" do
     auth_source_ldap = FactoryGirl.create(:auth_source_ldap, :service_account)
@@ -92,28 +92,28 @@ class AuthSourceLdapsControllerTest < ActionController::TestCase
     assert_empty auth_source_ldap.account_password
   end
 
   test "LDAP test succeeded" do
     AuthSourceLdap.any_instance.stubs(:test_connection).returns(:success => true)
-    put :test_connection, {:id => AuthSourceLdap.first, :auth_source_ldap => {:name => AuthSourceLdap.first.name} }, set_session_user
+    put :test_connection, {:id => AuthSourceLdap.unscoped.first, :auth_source_ldap => {:name => AuthSourceLdap.unscoped.first.name} }, set_session_user
     assert_response :success
   end
 
   test "LDAP test failed" do
     AuthSourceLdap.any_instance.stubs(:test_connection).raises(Foreman::Exception, 'Exception message')
-    put :test_connection, {:id => AuthSourceLdap.first, :auth_source_ldap => {:name => AuthSourceLdap.first.name} }, set_session_user
+    put :test_connection, {:id => AuthSourceLdap.unscoped.first, :auth_source_ldap => {:name => AuthSourceLdap.unscoped.first.name} }, set_session_user
     assert_response :unprocessable_entity
   end
 
   test 'organizations/locations can be assigned to it' do
-    auth_source_ldap_params = { :name => AuthSourceLdap.first.name,
+    auth_source_ldap_params = { :name => AuthSourceLdap.unscoped.first.name,
                                 :organization_ids => [taxonomies(:organization1).id],
                                 :location_names => [taxonomies(:location1).name] }
-    put :update, { :id => AuthSourceLdap.first,
+    put :update, { :id => AuthSourceLdap.unscoped.first,
                    :auth_source_ldap => auth_source_ldap_params },
                    set_session_user
     assert_equal [taxonomies(:organization1)],
-      AuthSourceLdap.first.organizations.to_a
+      AuthSourceLdap.unscoped.first.organizations.to_a
     assert_equal [taxonomies(:location1)],
-      AuthSourceLdap.first.locations.to_a
+      AuthSourceLdap.unscoped.first.locations.to_a
   end
 end
diff --git a/test/controllers/compute_resources_controller_test.rb b/test/controllers/compute_resources_controller_test.rb
index c9ba1590ea..23d6435391 100644
--- a/test/controllers/compute_resources_controller_test.rb
+++ b/test/controllers/compute_resources_controller_test.rb
@@ -31,20 +31,20 @@ class ComputeResourcesControllerTest < ActionController::TestCase
     assert_response :success
   end
 
   test "should not create compute resource when not permitted" do
     setup_user "view"
-    assert_difference('ComputeResource.count', 0) do
+    assert_difference('ComputeResource.unscoped.count', 0) do
       attrs = {:name => "test", :provider => "Libvirt", :url => "qemu://host/system"}
       post :create, {:compute_resource => attrs}, set_session_user
     end
     assert_response 403
   end
 
   test "should create compute resource" do
     setup_user "create"
-    assert_difference('ComputeResource.count', +1) do
+    assert_difference('ComputeResource.unscoped.count', +1) do
       attrs = {:name => "test", :provider => "Libvirt", :url => "qemu://host/system"}
       post :create, {:compute_resource => attrs}, set_session_user
     end
 
     assert_redirected_to compute_resource_url(assigns('compute_resource'))
@@ -76,18 +76,18 @@ class ComputeResourcesControllerTest < ActionController::TestCase
 
   test "host update without  password in the params does not erase existing password" do
     old_password = @compute_resource.password
     setup_user "edit"
     put :update, {:id => @compute_resource.to_param, :compute_resource => {:name => "editing_self"}}, set_session_user
-    @compute_resource = ComputeResource.find(@compute_resource.id)
+    @compute_resource = ComputeResource.unscoped.find(@compute_resource.id)
     assert_equal old_password, @compute_resource.password
   end
 
   test 'blank password submitted in compute resource edit form unsets password' do
     setup_user "edit"
     put :update, {:id => @compute_resource.to_param, :compute_resource => {:name => "editing_self", :password => ''}}, set_session_user
-    @compute_resource = ComputeResource.find(@compute_resource.id)
+    @compute_resource = ComputeResource.unscoped.find(@compute_resource.id)
     assert @compute_resource.password.empty?
   end
 
   test "should not get edit when restricted" do
     setup_user "edit"
@@ -119,29 +119,29 @@ class ComputeResourcesControllerTest < ActionController::TestCase
     assert_redirected_to compute_resources_path
   end
 
   test "should not destroy compute resource when not permitted" do
     setup_user "view"
-    assert_difference('ComputeResource.count', 0) do
+    assert_difference('ComputeResource.unscoped.count', 0) do
       delete :destroy, {:id => @compute_resource.to_param}, set_session_user
     end
 
     assert_response 403
   end
 
   test "should not destroy compute resource when restricted" do
     setup_user "destroy"
-    assert_difference('ComputeResource.count', 0) do
+    assert_difference('ComputeResource.unscoped.count', 0) do
       delete :destroy, {:id => @your_compute_resource.to_param}, set_session_user
     end
 
     assert_response 404
   end
 
   test "should destroy compute resource" do
     setup_user "destroy"
-    assert_difference('ComputeResource.count', -1) do
+    assert_difference('ComputeResource.unscoped.count', -1) do
       delete :destroy, {:id => @compute_resource.to_param}, set_session_user
     end
 
     assert_redirected_to compute_resources_path
   end
diff --git a/test/controllers/compute_resources_vms_controller_test.rb b/test/controllers/compute_resources_vms_controller_test.rb
index 0607a2eadf..571caa917b 100644
--- a/test/controllers/compute_resources_vms_controller_test.rb
+++ b/test/controllers/compute_resources_vms_controller_test.rb
@@ -137,10 +137,12 @@ class ComputeResourcesVmsControllerTest < ActionController::TestCase
     @compute_resource.tenant = 'personal'
     Fog.credentials[:openstack_auth_url] = @compute_resource.url
     @test_vm = @compute_resource.vms.create({:flavor_ref => 2, :name => 'test', :image_ref => 2})
     as_admin { @compute_resource.save }
     setup_user "power"
+    @compute_resource.organizations = User.current.organizations
+    @compute_resource.locations = User.current.locations
 
     Fog::Compute::OpenStack::Server.any_instance.expects(:state).returns('ACTIVE').at_least_once
     Fog::Compute::OpenStack::Server.any_instance.expects(:pause).returns(true)
     get :pause, { :format => 'json', :id => @test_vm.id, :compute_resource_id => @compute_resource.to_param}, set_session_user
     assert_redirected_to compute_resource_vm_path(:compute_resource_id => @compute_resource.to_param, :id => @test_vm.identity)
diff --git a/test/controllers/domains_controller_test.rb b/test/controllers/domains_controller_test.rb
index f80e52355f..b37f42186f 100644
--- a/test/controllers/domains_controller_test.rb
+++ b/test/controllers/domains_controller_test.rb
@@ -1,10 +1,10 @@
 require 'test_helper'
 
 class DomainsControllerTest < ActionController::TestCase
   setup do
-    @model = Domain.first
+    @model = domains(:mydomain)
   end
 
   basic_index_test
   basic_new_test
   basic_edit_test
@@ -21,33 +21,33 @@ class DomainsControllerTest < ActionController::TestCase
     assert_redirected_to domains_url
   end
 
   def test_update_invalid
     Domain.any_instance.stubs(:valid?).returns(false)
-    put :update, {:id => Domain.first.to_param, :domain => {:name => Domain.first.name }}, set_session_user
+    put :update, {:id => @model.to_param, :domain => {:name => @model.name }}, set_session_user
     assert_template 'edit'
   end
 
   def test_update_valid
     Domain.any_instance.stubs(:valid?).returns(true)
-    put :update, {:id => Domain.first.to_param, :domain => {:name => Domain.first.name }}, set_session_user
+    put :update, {:id => @model.to_param, :domain => {:name => @model.name }}, set_session_user
     assert_redirected_to domains_url
   end
 
   def test_destroy
-    domain = Domain.first
+    domain = @model
     domain.hosts.clear
     domain.hostgroups.clear
     domain.subnets.clear
     delete :destroy, {:id => domain}, set_session_user
     assert_redirected_to domains_url
     assert !Domain.exists?(domain.id)
   end
 
   def user_with_viewer_rights_should_fail_to_edit_a_domain
     setup_users
-    get :edit, {:id => Domain.first.id}
+    get :edit, {:id => @model.id}
     assert @response.status == '403 Forbidden'
   end
 
   def user_with_viewer_rights_should_succeed_in_viewing_domains
     setup_users
diff --git a/test/controllers/environments_controller_test.rb b/test/controllers/environments_controller_test.rb
index cce70ce82f..54672d0dbb 100644
--- a/test/controllers/environments_controller_test.rb
+++ b/test/controllers/environments_controller_test.rb
@@ -8,11 +8,11 @@ class EnvironmentsControllerTest < ActionController::TestCase
   basic_index_test
   basic_new_test
   basic_edit_test
 
   test "should create new environment" do
-    assert_difference 'Environment.count' do
+    assert_difference 'Environment.unscoped.count' do
       post :create, { :commit => "Create", :environment => {:name => "some_environment"} }, set_session_user
     end
     assert_redirected_to environments_path
   end
 
@@ -20,22 +20,22 @@ class EnvironmentsControllerTest < ActionController::TestCase
     setup_users
     environment = Environment.new :name => "some_environment"
     assert environment.save!
 
     put :update, { :commit => "Update", :id => environment.name, :environment => {:name => "other_environment"} }, set_session_user
-    env = Environment.find(environment.id)
+    env = Environment.unscoped.find(environment.id)
     assert env.name == "other_environment"
 
     assert_redirected_to environments_path
   end
 
   test "should destroy environment" do
     setup_users
     environment = Environment.new :name => "some_environment"
     assert environment.save!
 
-    assert_difference('Environment.count', -1) do
+    assert_difference('Environment.unscoped.count', -1) do
       delete :destroy, {:id => environment.name}, set_session_user
     end
 
     assert_redirected_to environments_path
   end
@@ -81,11 +81,12 @@ class EnvironmentsControllerTest < ActionController::TestCase
           {"env1" => '{"a":{"new":{}}}'}
         }
       }, set_session_user
     assert_redirected_to environments_url
     assert_equal "Successfully updated environments and Puppet classes from the on-disk Puppet installation", flash[:notice]
-    assert Environment.find_by_name("env1").puppetclasses.map(&:name).sort == ["a", "b", "c"]
+    assert_equal ["a", "b", "c"],
+      Environment.unscoped.find_by_name("env1").puppetclasses.map(&:name).sort
   end
 
   test "should handle disk environment containing less classes" do
     setup_import_classes
     as_admin {Puppetclass.create(:name => "d")}
@@ -101,12 +102,12 @@ class EnvironmentsControllerTest < ActionController::TestCase
           {"env1" => '["d"]'}
         }
       }, set_session_user
     assert_redirected_to environments_url
     assert_equal "Successfully updated environments and Puppet classes from the on-disk Puppet installation", flash[:notice]
-    envs = Environment.find_by_name("env1").puppetclasses.map(&:name).sort
-    assert envs == ["a", "b", "c"]
+    envs = Environment.unscoped.find_by_name("env1").puppetclasses.map(&:name).sort
+    assert_equal ["a", "b", "c"], envs
   end
   test "should handle disk environment containing less environments" do
     setup_import_classes
     as_admin {Environment.create(:name => "env3")}
     #db_tree   of {"env1" => ["a", "b", "c"], "env2" => ["a", "b", "c"], "env3" => []}
@@ -120,11 +121,11 @@ class EnvironmentsControllerTest < ActionController::TestCase
           {"env3" => '[]'}
         }
       }, set_session_user
     assert_redirected_to environments_url
     assert_equal "Successfully updated environments and Puppet classes from the on-disk Puppet installation", flash[:notice]
-    assert Environment.find_by_name("env3").puppetclasses.map(&:name).sort == []
+    assert_equal [], Environment.unscoped.find_by_name("env3").puppetclasses.map(&:name).sort
   end
 
   test "should fail to remove active environments" do
     disable_orchestration
     setup_import_classes
@@ -138,17 +139,17 @@ class EnvironmentsControllerTest < ActionController::TestCase
     end
 
     # assert_template "puppetclasses_or_envs_changed". This assertion will fail. And it should fail. See above.
     post :obsolete_and_new,
       {"changed"=>
-        {"obsolete" =>
-          {"env1"  => '["a","b","c","_destroy_"]'}
-        }
-      }, set_session_user
-    assert Environment.find_by_name("env1").hosts.count > 0
+       {"obsolete" =>
+        {"env1"  => '["a","b","c","_destroy_"]'}
+       }
+    }, set_session_user
+    assert Environment.unscoped.find_by_name("env1").hosts.count > 0
     #assert flash[:error] =~ /^Failed to update the environments and puppetclasses from the on-disk puppet installation/
-    assert Environment.find_by_name("env1")
+    assert Environment.unscoped.find_by_name("env1")
   end
 
   test "should obey config/ignored_environments.yml" do
     @request.env["HTTP_REFERER"] = environments_url
     setup_import_classes
@@ -205,13 +206,13 @@ class EnvironmentsControllerTest < ActionController::TestCase
   test "should accept environment with name 'name'" do
     @request.env["HTTP_REFERER"] = environments_url
     ProxyAPI::Puppet.any_instance.stubs(:environments).returns(["new"])
     get :import_environments, {:proxy => smart_proxies(:puppetmaster)}, set_session_user
     post :obsolete_and_new,
-         {"changed" =>
-              {"new" =>
-                   {"new" => '{"a":{"new":{}}}'}
-              }
-         }, set_session_user
-    assert(Environment.all.map(&:name).include?('new'), 'Should include environment with name "new"')
+      {"changed" =>
+       {"new" =>
+        {"new" => '{"a":{"new":{}}}'}
+       }
+    }, set_session_user
+    assert(Environment.unscoped.all.map(&:name).include?('new'), 'Should include environment with name "new"')
   end
 end
diff --git a/test/controllers/fact_values_controller_test.rb b/test/controllers/fact_values_controller_test.rb
index 09e04b8bdb..b08652256c 100644
--- a/test/controllers/fact_values_controller_test.rb
+++ b/test/controllers/fact_values_controller_test.rb
@@ -11,10 +11,12 @@ class FactValuesControllerTest < ActionController::TestCase
     assert_template FactValue.unconfigured? ? 'welcome' : 'index'
     assert_not_nil :fact_values
   end
 
   test 'user with viewer rights should succeed in viewing facts' do
-    users(:one).roles = [Role.default, Role.find_by_name('Viewer')]
+    as_admin do
+      users(:one).roles = [Role.default, Role.find_by_name('Viewer')]
+    end
     get :index, {}, set_session_user.merge(:user => users(:one).id)
     assert_response :success
   end
 end
diff --git a/test/controllers/hostgroups_controller_test.rb b/test/controllers/hostgroups_controller_test.rb
index b8606f6d74..776bbf9366 100644
--- a/test/controllers/hostgroups_controller_test.rb
+++ b/test/controllers/hostgroups_controller_test.rb
@@ -10,11 +10,11 @@ class HostgroupsControllerTest < ActionController::TestCase
     get :new, {}, set_session_user
     assert_template 'new'
   end
 
   def test_nest
-    get :nest, {:id => Hostgroup.first.id}, set_session_user
+    get :nest, {:id => hostgroups(:common).id}, set_session_user
     assert_template 'new'
   end
 
   def test_create_invalid
     Hostgroup.any_instance.stubs(:valid?).returns(false)
@@ -29,26 +29,26 @@ class HostgroupsControllerTest < ActionController::TestCase
                    :puppetclass_ids=>["", pc.id.to_s], :realm_id => realms(:myrealm).id}}, set_session_user
     assert_redirected_to hostgroups_url
   end
 
   def test_clone
-    get :clone, {:id => Hostgroup.first}, set_session_user
+    get :clone, {:id => hostgroups(:common)}, set_session_user
     assert_template 'new'
   end
 
   def test_edit
-    get :edit, {:id => Hostgroup.first}, set_session_user
+    get :edit, {:id => hostgroups(:common)}, set_session_user
     assert_template 'edit'
   end
 
   def test_update_invalid
-    put :update, {:id => Hostgroup.first, :hostgroup => { :name => '' }}, set_session_user
+    put :update, {:id => hostgroups(:common), :hostgroup => { :name => '' }}, set_session_user
     assert_template 'edit'
   end
 
   def test_update_valid
-    put :update, {:id => Hostgroup.first, :hostgroup => { :name => Hostgroup.first.name }}, set_session_user
+    put :update, {:id => hostgroups(:common), :hostgroup => { :name => hostgroups(:common).name }}, set_session_user
     assert_redirected_to hostgroups_url
   end
 
   def test_destroy
     hostgroup = hostgroups(:unusual)
@@ -61,12 +61,12 @@ class HostgroupsControllerTest < ActionController::TestCase
     super
   end
 
   test 'user with viewer rights should fail to edit a hostgroup ' do
     setup_user "view"
-    get :edit, {:id => Hostgroup.first.id}, set_session_user.merge(:user => users(:one).id)
-    assert_equal @response.status, 403
+    get :edit, {:id => hostgroups(:common).id}, set_session_user.merge(:user => users(:one).id)
+    assert_response :forbidden
   end
 
   test 'user with viewer rights should succeed in viewing hostgroups' do
     setup_user "view"
     get :index, {}, set_session_user.merge(:user => users(:one).id)
@@ -122,23 +122,23 @@ class HostgroupsControllerTest < ActionController::TestCase
   test "domain_selected should return subnets" do
     domain = FactoryGirl.create(:domain)
     subnet = FactoryGirl.create(:subnet_ipv4)
     domain.subnets << subnet
     domain.save
-    xhr :post, :domain_selected, {:id => Hostgroup.first, :hostgroup => {}, :domain_id => domain.id, :format => :json}, set_session_user
+    xhr :post, :domain_selected, {:id => hostgroups(:common), :hostgroup => {}, :domain_id => domain.id, :format => :json}, set_session_user
     assert_equal subnet.name, JSON.parse(response.body)[0]["subnet"]["name"]
     assert_equal subnet.unused_ip.suggest_new?, JSON.parse(response.body)[0]["subnet"]["unused_ip"]["suggest_new"]
   end
 
   test "domain_selected should return empty on no domain_id" do
-    xhr :post, :domain_selected, {:id => Hostgroup.first, :hostgroup => {}, :format => :json, :domain_id => nil}, set_session_user
+    xhr :post, :domain_selected, {:id => hostgroups(:common), :hostgroup => {}, :format => :json, :domain_id => nil}, set_session_user
     assert_response :success
     assert_empty JSON.parse(response.body)
   end
 
   test "architecture_selected should not fail when no architecture selected" do
-    post :architecture_selected, {:id => Hostgroup.first, :hostgroup => {}, :architecture_id => nil}, set_session_user
+    post :architecture_selected, {:id => hostgroups(:common), :hostgroup => {}, :architecture_id => nil}, set_session_user
     assert_response :success
     assert_template :partial => "common/os_selection/_architecture"
   end
 
   describe '#environment_selected' do
@@ -200,24 +200,28 @@ class HostgroupsControllerTest < ActionController::TestCase
 
     it "creates a hostgroup with a parent parameter" do
       post :create, {"hostgroup" => {"name"=>"test_it", "parent_id" => @base.id, :realm_id => realms(:myrealm).id,
                                      :group_parameters_attributes => {"0" => {:name => "x", :value =>"overridden", :_destroy => ""}}}}, set_session_user
       assert_redirected_to hostgroups_url
-      hostgroup = Hostgroup.where(:name => "test_it").last
-      assert_equal "overridden", hostgroup.parameters["x"]
+      hostgroup = Hostgroup.unscoped.where(:name => "test_it").last
+      as_admin do
+        assert_equal "overridden", hostgroup.parameters["x"]
+      end
     end
 
     it "updates a hostgroup with a parent parameter" do
       child = FactoryGirl.create(:hostgroup, :parent => @base)
       as_admin do
         assert_equal "original", child.parameters["x"]
       end
       post :update, {"id" => child.id, "hostgroup" => {"name" => child.name,
                                                        :group_parameters_attributes => {"0" => {:name => "x", :value =>"overridden", :_destroy => ""}}}}, set_session_user
       assert_redirected_to hostgroups_url
-      child.reload
-      assert_equal "overridden", child.parameters["x"]
+      as_admin do
+        child.reload
+        assert_equal "overridden", child.parameters["x"]
+      end
     end
 
     it "updates a hostgroup with a parent parameter, allows empty values" do
       child = FactoryGirl.create(:hostgroup, :parent => @base)
       as_admin do
@@ -225,13 +229,15 @@ class HostgroupsControllerTest < ActionController::TestCase
       end
       post :update, {"id" => child.id, "hostgroup" => {"name" => child.name,
                                                        :group_parameters_attributes => {"0" => {:name => "x", :value => "", :_destroy => ""},
                                                                                         "1" => {:name => "y", :value => "overridden", :_destroy => ""}}}}, set_session_user
       assert_redirected_to hostgroups_url
-      child.reload
-      assert_equal "overridden", child.parameters["y"]
-      assert_equal "", child.parameters["x"]
+      as_admin do
+        child.reload
+        assert_equal "overridden", child.parameters["y"]
+        assert_equal "", child.parameters["x"]
+      end
     end
 
     it "changes the hostgroup's parent and check the parameters are updated" do
       child = FactoryGirl.create(:hostgroup, :parent => @base)
       as_admin do
diff --git a/test/controllers/hosts_controller_test.rb b/test/controllers/hosts_controller_test.rb
index 55b89baba2..d92b842e57 100644
--- a/test/controllers/hosts_controller_test.rb
+++ b/test/controllers/hosts_controller_test.rb
@@ -61,11 +61,11 @@ class HostsControllerTest < ActionController::TestCase
     assert_response :success
     assert_template 'new'
   end
 
   test "should create new host" do
-    assert_difference 'Host.count' do
+    assert_difference 'Host.unscoped.count' do
       post :create, { :commit => "Create",
         :host => {:name => "myotherfullhost",
           :mac => "aabbecddee06",
           :ip => "2.3.4.125",
           :domain_id => domains(:mydomain).id,
@@ -89,11 +89,11 @@ class HostsControllerTest < ActionController::TestCase
 
   test "should create new host with hostgroup inherited fields" do
     leftovers = Host.search_for('myotherfullhost').first
     refute leftovers
     hostgroup = hostgroups(:common)
-    assert_difference 'Host.count' do
+    assert_difference 'Host.unscoped.count' do
       post :create, { :commit => "Create",
         :host => {:name => "myotherfullhost",
           :mac => "aabbecddee06",
           :ip => "2.3.4.125",
           :domain_id => domains(:mydomain).id,
@@ -139,11 +139,11 @@ class HostsControllerTest < ActionController::TestCase
     put :update, {:id => Host.first.name, :host => {:name => "Updated_#{Host.first.name}"}}, set_session_user
     assert_redirected_to host_url(assigns(:host))
   end
 
   test "should destroy host" do
-    assert_difference('Host.count', -1) do
+    assert_difference('Host.unscoped.count', -1) do
       delete :destroy, {:id => @host.name}, set_session_user
     end
     assert_redirected_to hosts_url
   end
 
@@ -300,10 +300,12 @@ class HostsControllerTest < ActionController::TestCase
   test 'user with view host rights and ownership is set should succeed in viewing host1 but fail for host2' do
     setup_user_and_host "view", "owner_id = #{users(:one).id} and owner_type = User"
     as_admin do
       @host1.owner = @one
       @host2.owner = users(:two)
+      @host2.organization = users(:two).organizations.first
+      @host2.location = users(:two).locations.first
       @host1.save!
       @host2.save!
     end
     get :index, {}, set_session_user.merge(:user => @one.id)
     assert_response :success
@@ -380,12 +382,13 @@ class HostsControllerTest < ActionController::TestCase
     hostgroup = hostgroups(:unusual)
     post :update_multiple_hostgroup, { :host_ids => hosts.map(&:id), :hostgroup => { :id => hostgroup.id } }, set_session_user
     assert_response :redirect
 
     # reloads hosts
-    hosts.map! {|h| Host.find(h.id)}
-    hosts.each { |host| assert_equal hostgroup, host.hostgroup }
+    as_admin do
+      hosts.each { |host| assert_equal hostgroup, host.reload.hostgroup }
+    end
   end
 
   test 'multiple hostgroup change by host names' do
     @request.env['HTTP_REFERER'] = hosts_path
     hosts = FactoryGirl.create_list(:host, 2)
@@ -400,13 +403,15 @@ class HostsControllerTest < ActionController::TestCase
     hostgroup = hostgroups(:common)
     post :update_multiple_hostgroup, { :host_names => host_names, :hostgroup  => { :id => hostgroup.id} }, set_session_user
     assert_response :redirect
 
     host_names.each do |name|
-      host = Host.find_by_name name
-      assert_not_nil host
-      assert_equal host.hostgroup, hostgroup
+      as_admin do
+        host = Host.unscoped.find_by_name(name)
+        assert_not_nil host
+        assert_equal host.hostgroup, hostgroup
+      end
     end
   end
 
   def setup_multiple_environments
     setup_user_and_host "edit"
@@ -421,12 +426,14 @@ class HostsControllerTest < ActionController::TestCase
     assert @host1.environment == environments(:production)
     assert @host2.environment == environments(:production)
     post :update_multiple_environment, { :host_ids => [@host1.id, @host2.id],
       :environment => { :id => environments(:global_puppetmaster).id}},
       set_session_user.merge(:user => users(:admin).id)
-    assert_equal environments(:global_puppetmaster), Host.find(@host1.id).environment
-    assert_equal environments(:global_puppetmaster), Host.find(@host2.id).environment
+    as_admin do
+      assert_equal environments(:global_puppetmaster), @host1.reload.environment
+      assert_equal environments(:global_puppetmaster), @host2.reload.environment
+    end
     assert_equal "Updated hosts: changed environment", flash[:notice]
   end
 
   test "should inherit the hostgroup environment if *inherit from hostgroup* selected" do
     @request.env['HTTP_REFERER'] = hosts_path
@@ -447,24 +454,26 @@ class HostsControllerTest < ActionController::TestCase
       :environment => { :id => 'inherit' } }
 
     post :update_multiple_environment, params,
       set_session_user.merge(:user => users(:admin).id)
 
-    assert Host.find(@host1.id).environment == hostgroup.environment
-    assert Host.find(@host2.id).environment == hostgroup.environment
+    assert_equal hostgroup.environment_id, Host.unscoped.find(@host1.id).environment_id
+    assert_equal hostgroup.environment_id, Host.unscoped.find(@host2.id).environment_id
   end
 
   test "user with edit host rights with update owner should change owner" do
     @request.env['HTTP_REFERER'] = hosts_path
     setup_user_and_host "edit"
     assert_equal users(:admin).id_and_type, @host1.is_owned_by
     assert_equal users(:admin).id_and_type, @host2.is_owned_by
     post :update_multiple_owner, { :host_ids => [@host1.id, @host2.id],
       :owner => { :id => users(:one).id_and_type}},
       set_session_user.merge(:user => users(:admin).id)
-    assert_equal users(:one).id_and_type, Host.find(@host1.id).is_owned_by
-    assert_equal users(:one).id_and_type, Host.find(@host2.id).is_owned_by
+    as_admin do
+      assert_equal users(:one).id_and_type, @host1.reload.is_owned_by
+      assert_equal users(:one).id_and_type, @host2.reload.is_owned_by
+    end
   end
 
   def setup_multiple_compute_resource
     setup_user_and_host "edit"
     as_admin do
@@ -550,11 +559,13 @@ class HostsControllerTest < ActionController::TestCase
         set_session_user.merge(:user => users(:admin).id)
 
       assert_empty flash[:error]
 
       @hosts.each do |host|
-        assert_equal proxy, host.reload.puppet_ca_proxy
+        as_admin do
+          assert_equal proxy, host.reload.puppet_ca_proxy
+        end
       end
     end
 
     test "should clear the puppet ca proxy" do
       @request.env['HTTP_REFERER'] = hosts_path
@@ -638,15 +649,15 @@ class HostsControllerTest < ActionController::TestCase
     assert_response :success
   end
 
   test "if only authorize_login_delegation is set, REMOTE_USER should be
         ignored for API requests" do
+    host = Host.first
     Setting[:authorize_login_delegation] = true
     Setting[:authorize_login_delegation_api] = false
     set_remote_user_to users(:admin)
     User.current = nil # User.current is admin at this point (from initialize_host)
-    host = Host.first
     get :show, {:id => host.to_param, :format => 'json'}
     assert_response 401
     get :show, {:id => host.to_param}
     assert_response :success
   end
@@ -929,11 +940,11 @@ class HostsControllerTest < ActionController::TestCase
   #Optimistic - Location
   test "update multiple location updates location of hosts if succeeds on optimistic import" do
     @request.env['HTTP_REFERER'] = hosts_path
     location = taxonomies(:location1)
     cnt_hosts_location = location.hosts.count
-    assert_difference "location.hosts.count", (Host.count - cnt_hosts_location) do
+    assert_difference "location.hosts.count", (Host.unscoped.count - cnt_hosts_location) do
       post :update_multiple_location, {
         :location => {:id => location.id, :optimistic_import => "yes"},
         :host_ids => Host.pluck('hosts.id')
       }, set_session_user
     end
@@ -1000,11 +1011,11 @@ class HostsControllerTest < ActionController::TestCase
   end
   test "update multiple organization updates organization of hosts if succeeds on optimistic import" do
     @request.env['HTTP_REFERER'] = hosts_path
     organization = taxonomies(:organization1)
     cnt_hosts_organization = organization.hosts.count
-    assert_difference "organization.hosts.count", (Host.count - cnt_hosts_organization) do
+    assert_difference "organization.hosts.count", (Host.unscoped.count - cnt_hosts_organization) do
       post :update_multiple_organization, {
         :organization => {:id => organization.id, :optimistic_import => "yes"},
         :host_ids => Host.pluck('hosts.id')
       }, set_session_user
     end
@@ -1081,10 +1092,12 @@ class HostsControllerTest < ActionController::TestCase
     assert_equal new_password, @host.interfaces.bmc.first.password
   end
 
   test "test non admin multiple action" do
     setup_user 'edit', 'hosts', "owner_type = User and owner_id = #{users(:restricted).id}", :restricted
+    User.current.organizations << taxonomies(:organization1)
+    User.current.locations << taxonomies(:location1)
     host = FactoryGirl.create(:host)
     host_ids = [host.id]
     #the ajax can be any of the multiple actions, toke multiple_parameters for example
     xhr :get, :multiple_parameters, {:host_ids => host_ids}, set_session_user(:restricted)
     assert_response :success
diff --git a/test/controllers/images_controller_test.rb b/test/controllers/images_controller_test.rb
index 8734ef748d..289c8b69c0 100644
--- a/test/controllers/images_controller_test.rb
+++ b/test/controllers/images_controller_test.rb
@@ -16,34 +16,40 @@ class ImagesControllerTest < ActionController::TestCase
     get :new, { :compute_resource_id => @image.compute_resource_id }, set_session_user
     assert_response :success
   end
 
   test "should create image" do
-    assert_difference('Image.count') do
+    assert_difference('Image.unscoped.count') do
       image_attributes = {:name => 'gold', :username => 'ec2-user', :uuid => Foreman.uuid.to_s, :operatingsystem_id => Operatingsystem.first.id, :architecture_id => Architecture.first.id, :compute_resource_id => @image.compute_resource_id}
       post :create, { :image => image_attributes, :compute_resource_id => @image.compute_resource_id }, set_session_user
     end
 
-    assert_redirected_to compute_resource_path(@image.compute_resource)
+    as_admin do
+      assert_redirected_to compute_resource_path(@image.compute_resource)
+    end
   end
 
   test "should get edit" do
     get :edit, { :id => @image.to_param, :compute_resource_id => @image.compute_resource_id }, set_session_user
     assert_response :success
   end
 
   test "should update image" do
     put :update, { :id => @image.to_param, :image => {:name => 'lala', :username => 'ec2-user'}, :compute_resource_id => @image.compute_resource_id }, set_session_user
-    assert_redirected_to compute_resource_path(@image.compute_resource)
+    as_admin do
+      assert_redirected_to compute_resource_path(@image.compute_resource)
+    end
   end
 
   test "should destroy image" do
     assert_difference('Image.count', -1) do
       delete :destroy, { :id => @image.to_param, :compute_resource_id => @image.compute_resource_id }, set_session_user
     end
 
-    assert_redirected_to compute_resource_path(@image.compute_resource)
+    as_admin do
+      assert_redirected_to compute_resource_path(@image.compute_resource)
+    end
   end
 
   # listing images in /hosts/new requries a JSON response from this controller
   test "should list json images" do
     # This value is tested by the deprecation warning in application_controller
diff --git a/test/controllers/locations_controller_test.rb b/test/controllers/locations_controller_test.rb
index 4e30d4cf97..0ef10bb336 100644
--- a/test/controllers/locations_controller_test.rb
+++ b/test/controllers/locations_controller_test.rb
@@ -149,44 +149,35 @@ class LocationsControllerTest < ActionController::TestCase
     location = taxonomies(:location1)
     get :clone_taxonomy, {:id => location.id}, set_session_user
     assert_response :success
     assert_match "Clone", @response.body
   end
-  test "should clone location with assocations" do
+  test "should clone location with associations" do
     location = taxonomies(:location1)
     FactoryGirl.create(:host, :location => nil)
     location_dup = location.clone
 
-    assert_difference "Location.count", 1 do
-      post :create, {:location => {:name => "location_dup_name",
-                                 :environment_ids => location_dup.environment_ids,
-                                 :hostgroup_ids => location_dup.hostgroup_ids,
-                                 :subnet_ids => location_dup.hostgroup_ids,
-                                 :domain_ids => location_dup.domain_ids,
-                                 :medium_ids => location_dup.medium_ids,
-                                 :user_ids => location_dup.user_ids,
-                                 :smart_proxy_ids => location_dup.smart_proxy_ids,
-                                 :provisioning_template_ids => location_dup.provisioning_template_ids,
-                                 :compute_resource_ids => location_dup.compute_resource_ids,
-                                 :organization_ids => location_dup.organization_ids
-                               }
-                   }, set_session_user
+    assert_difference "Location.unscoped.count", 1 do
+      post :create, {
+        :location => location_dup.selected_ids.each { |_,v| v.uniq! }
+          .merge(:name => 'location_dup_name')
+      }, set_session_user
     end
 
     new_location = Location.unscoped.order(:id).last
     assert_redirected_to :controller => :locations, :action => :step2, :id => new_location.to_param
 
-    assert_equal new_location.environment_ids.sort, location.environment_ids.sort
-    assert_equal new_location.hostgroup_ids.sort, location.hostgroup_ids.sort
-    assert_equal new_location.environment_ids.sort, location.environment_ids.sort
-    assert_equal new_location.domain_ids.sort, location.domain_ids.sort
-    assert_equal new_location.medium_ids.sort, location.medium_ids.sort
-    assert_equal new_location.user_ids.sort, location.user_ids.sort
-    assert_equal new_location.smart_proxy_ids.sort, location.smart_proxy_ids.sort
-    assert_equal new_location.provisioning_template_ids.sort, location.provisioning_template_ids.sort
-    assert_equal new_location.compute_resource_ids.sort, location.compute_resource_ids.sort
-    assert_equal new_location.organization_ids.sort, location.organization_ids.sort
+    assert_equal new_location.environment_ids.uniq.sort, location.environment_ids.uniq.sort
+    assert_equal new_location.hostgroup_ids.uniq.sort, location.hostgroup_ids.uniq.sort
+    assert_equal new_location.environment_ids.uniq.sort, location.environment_ids.uniq.sort
+    assert_equal new_location.domain_ids.uniq.sort, location.domain_ids.uniq.sort
+    assert_equal new_location.medium_ids.uniq.sort, location.medium_ids.uniq.sort
+    assert_equal new_location.user_ids.uniq.sort, location.user_ids.uniq.sort
+    assert_equal new_location.smart_proxy_ids.uniq.sort, location.smart_proxy_ids.uniq.sort
+    assert_equal new_location.provisioning_template_ids.uniq.sort, location.provisioning_template_ids.uniq.sort
+    assert_equal new_location.compute_resource_ids.uniq.sort, location.compute_resource_ids.uniq.sort
+    assert_equal new_location.organization_ids.uniq.sort, location.organization_ids.uniq.sort
   end
 
   test "should clear out Location.current" do
     @request.env['HTTP_REFERER'] = root_url
     get :clear, {}, set_session_user
diff --git a/test/controllers/media_controller_test.rb b/test/controllers/media_controller_test.rb
index 1b11445ac9..0d2cae45c9 100644
--- a/test/controllers/media_controller_test.rb
+++ b/test/controllers/media_controller_test.rb
@@ -21,17 +21,17 @@ class MediaControllerTest < ActionController::TestCase
     assert_redirected_to media_url
   end
 
   def test_update_invalid
     Medium.any_instance.stubs(:valid?).returns(false)
-    put :update, {:id => Medium.first, :medium => {:name => nil}}, set_session_user
+    put :update, {:id => @model, :medium => {:name => nil}}, set_session_user
     assert_template 'edit'
   end
 
   def test_update_valid
     Medium.any_instance.stubs(:valid?).returns(true)
-    put :update, {:id => Medium.first, :medium => {:name => "MyUpdatedMedia"}}, set_session_user
+    put :update, {:id => @model, :medium => {:name => "MyUpdatedMedia"}}, set_session_user
     assert_redirected_to media_url
   end
 
   def test_destroy
     medium = media(:unused)
@@ -45,11 +45,11 @@ class MediaControllerTest < ActionController::TestCase
     users(:one).roles       = [Role.default, Role.find_by_name('Viewer')]
   end
 
   test 'user with viewer rights should fail to edit a medium' do
     setup_user
-    get :edit, {:id => Medium.first.id}, set_session_user.merge(:user => users(:one).id)
+    get :edit, {:id => @model.id}, set_session_user.merge(:user => users(:one).id)
     assert_equal @response.status, 403
   end
 
   test 'user with viewer rights should succeed in viewing media' do
     setup_user
diff --git a/test/controllers/organizations_controller_test.rb b/test/controllers/organizations_controller_test.rb
index d7a00f9dbb..da9a384784 100644
--- a/test/controllers/organizations_controller_test.rb
+++ b/test/controllers/organizations_controller_test.rb
@@ -161,44 +161,35 @@ class OrganizationsControllerTest < ActionController::TestCase
     organization = taxonomies(:organization1)
     get :clone_taxonomy, {:id => organization.id}, set_session_user
     assert_response :success
     assert_match "Clone", @response.body
   end
-  test "should clone organization with assocations" do
+  test "should clone organization with associations" do
     organization = taxonomies(:organization1)
     FactoryGirl.create(:host, :organization => nil)
     organization_dup = organization.clone
 
-    assert_difference "Organization.count", 1 do
-      post :create, {:organization => {:name => "organization_dup_name",
-                                       :environment_ids => organization_dup.environment_ids,
-                                       :hostgroup_ids => organization_dup.hostgroup_ids,
-                                       :subnet_ids => organization_dup.hostgroup_ids,
-                                       :domain_ids => organization_dup.domain_ids,
-                                       :medium_ids => organization_dup.medium_ids,
-                                       :user_ids => organization_dup.user_ids,
-                                       :smart_proxy_ids => organization_dup.smart_proxy_ids,
-                                       :provisioning_template_ids => organization_dup.provisioning_template_ids,
-                                       :compute_resource_ids => organization_dup.compute_resource_ids,
-                                       :location_ids => organization_dup.location_ids
-      }
+    assert_difference "Organization.unscoped.count", 1 do
+      post :create, {
+        :organization => organization_dup.selected_ids.each { |_,v| v.uniq! }
+          .merge(:name => 'organization_dup_name')
       }, set_session_user
     end
 
     new_organization = Organization.unscoped.order(:id).last
     assert_redirected_to :controller => :organizations, :action => :step2, :id => new_organization.to_param
 
-    assert_equal new_organization.environment_ids.sort, organization.environment_ids.sort
-    assert_equal new_organization.hostgroup_ids.sort, organization.hostgroup_ids.sort
-    assert_equal new_organization.environment_ids.sort, organization.environment_ids.sort
-    assert_equal new_organization.domain_ids.sort, organization.domain_ids.sort
-    assert_equal new_organization.medium_ids.sort, organization.medium_ids.sort
-    assert_equal new_organization.user_ids.sort, organization.user_ids.sort
-    assert_equal new_organization.smart_proxy_ids.sort, organization.smart_proxy_ids.sort
-    assert_equal new_organization.provisioning_template_ids.sort, organization.provisioning_template_ids.sort
-    assert_equal new_organization.compute_resource_ids.sort, organization.compute_resource_ids.sort
-    assert_equal new_organization.location_ids.sort, organization.location_ids.sort
+    assert_equal new_organization.environment_ids.uniq.sort, organization.environment_ids.uniq.sort
+    assert_equal new_organization.hostgroup_ids.uniq.sort, organization.hostgroup_ids.uniq.sort
+    assert_equal new_organization.environment_ids.uniq.sort, organization.environment_ids.uniq.sort
+    assert_equal new_organization.domain_ids.uniq.sort, organization.domain_ids.uniq.sort
+    assert_equal new_organization.medium_ids.uniq.sort, organization.medium_ids.uniq.sort
+    assert_equal new_organization.user_ids.uniq.sort, organization.user_ids.uniq.sort
+    assert_equal new_organization.smart_proxy_ids.uniq.sort, organization.smart_proxy_ids.uniq.sort
+    assert_equal new_organization.provisioning_template_ids.uniq.sort, organization.provisioning_template_ids.uniq.sort
+    assert_equal new_organization.compute_resource_ids.uniq.sort, organization.compute_resource_ids.uniq.sort
+    assert_equal new_organization.location_ids.uniq.sort, organization.location_ids.uniq.sort
   end
 
   test "should clear out Organization.current" do
     @request.env['HTTP_REFERER'] = root_url
     get :clear, {}, set_session_user
diff --git a/test/controllers/provisioning_templates_controller_test.rb b/test/controllers/provisioning_templates_controller_test.rb
index 4422b5fbc5..fcaedceca8 100644
--- a/test/controllers/provisioning_templates_controller_test.rb
+++ b/test/controllers/provisioning_templates_controller_test.rb
@@ -38,18 +38,18 @@ class ProvisioningTemplatesControllerTest < ActionController::TestCase
 
   test "lock" do
     @request.env['HTTP_REFERER'] = provisioning_templates_path
     get :lock, {:id => templates(:pxekickstart).to_param }, set_session_user
     assert_redirected_to provisioning_templates_path
-    assert_equal ProvisioningTemplate.find(templates(:pxekickstart).id).locked, true
+    assert_equal ProvisioningTemplate.unscoped.find(templates(:pxekickstart).id).locked, true
   end
 
   test "unlock" do
     @request.env['HTTP_REFERER'] = provisioning_templates_path
     get :unlock, {:id => templates(:locked).to_param }, set_session_user
     assert_redirected_to provisioning_templates_path
-    assert_equal ProvisioningTemplate.find(templates(:locked).id).locked, false
+    assert_equal ProvisioningTemplate.unscoped.find(templates(:locked).id).locked, false
   end
 
   test "clone" do
     get :clone_template, {:id => templates(:pxekickstart).to_param }, set_session_user
     assert_template 'new'
@@ -77,19 +77,19 @@ class ProvisioningTemplatesControllerTest < ActionController::TestCase
 
   test "destroy should fail with assoicated hosts" do
     config_template = templates(:pxekickstart)
     delete :destroy, {:id => config_template.to_param }, set_session_user
     assert_redirected_to provisioning_templates_url
-    assert ProvisioningTemplate.exists?(config_template.id)
+    assert ProvisioningTemplate.unscoped.exists?(config_template.id)
   end
 
   test "destroy" do
     config_template = templates(:pxekickstart)
     config_template.os_default_templates.clear
     delete :destroy, {:id => config_template.to_param }, set_session_user
     assert_redirected_to provisioning_templates_url
-    assert !ProvisioningTemplate.exists?(config_template.id)
+    assert !ProvisioningTemplate.unscoped.exists?(config_template.id)
   end
 
   test "audit comment" do
     ProvisioningTemplate.auditing_enabled = true
     ProvisioningTemplate.any_instance.stubs(:valid?).returns(true)
@@ -197,12 +197,12 @@ class ProvisioningTemplatesControllerTest < ActionController::TestCase
         :name => 'foo',
         :template => '#nocontent',
         :template_kind_id => TemplateKind.find_by_name('iPXE').id,
         :template_combinations_attributes => { '3923' => template_combination }
       }
-      assert_difference('TemplateCombination.count', 1) do
-        assert_difference('ProvisioningTemplate.count', 1) do
+      assert_difference('TemplateCombination.unscoped.count', 1) do
+        assert_difference('ProvisioningTemplate.unscoped.count', 1) do
           post :create, {
             :provisioning_template => provisioning_template
           }, set_session_user
         end
       end
@@ -228,12 +228,14 @@ class ProvisioningTemplatesControllerTest < ActionController::TestCase
               }
             }
           }
         }, set_session_user
         assert_response :found
-        @template_combination.reload
-        assert_equal new_environment, @template_combination.environment
+        as_admin do
+          @template_combination.reload
+          assert_equal new_environment, @template_combination.environment
+        end
       end
 
       test 'can be destroyed' do
         assert_difference('TemplateCombination.count', -1) do
           put :update, {
diff --git a/test/controllers/puppetclasses_controller_test.rb b/test/controllers/puppetclasses_controller_test.rb
index 00bc6416df..6b92ea0f74 100644
--- a/test/controllers/puppetclasses_controller_test.rb
+++ b/test/controllers/puppetclasses_controller_test.rb
@@ -107,55 +107,63 @@ class PuppetclassesControllerTest < ActionController::TestCase
     existing_host_attributes.merge!('environment_id' => environments(:global_puppetmaster).id)
     puppetclass = puppetclasses(:two)
     post :parameters, {:id => puppetclass.id, :host_id => host.id,
                        :host => existing_host_attributes }, set_session_user
     assert_response :success
-    lookup_keys_added = overridable_lookup_keys(puppetclass, assigns(:obj))
-    assert_equal 1, lookup_keys_added.count
-    assert lookup_keys_added.map(&:key).include?("special_info")
-    refute lookup_keys_added.map(&:key).include?("custom_class_param")
+    as_admin do
+      lookup_keys_added = overridable_lookup_keys(puppetclass, assigns(:obj))
+      assert_equal 1, lookup_keys_added.count
+      assert lookup_keys_added.map(&:key).include?("special_info")
+      refute lookup_keys_added.map(&:key).include?("custom_class_param")
+    end
   end
 
   test 'puppetclass lookup keys are added to partial _class_parameters on EXISTING hostgroup form through ajax POST to parameters' do
     hostgroup = hostgroups(:common)
     puppetclass = puppetclasses(:two)
     existing_hostgroup_attributes = hostgroup_attributes(hostgroup)
     # host_id is posted instead of hostgroup_id per host_edit.js#load_puppet_class_parameters
     post :parameters, {:id => puppetclass.id, :host_id => hostgroup.id,
                        :hostgroup => existing_hostgroup_attributes }, set_session_user
     assert_response :success
-    lookup_keys_added = overridable_lookup_keys(puppetclass, hostgroup)
-    assert_equal 2, lookup_keys_added.count
-    assert lookup_keys_added.map(&:key).include?("special_info")
-    assert lookup_keys_added.map(&:key).include?("custom_class_param")
+    as_admin do
+      lookup_keys_added = overridable_lookup_keys(puppetclass, hostgroup)
+      assert_equal 2, lookup_keys_added.count
+      assert lookup_keys_added.map(&:key).include?("special_info")
+      assert lookup_keys_added.map(&:key).include?("custom_class_param")
+    end
   end
 
   test 'puppetclass lookup keys are added to partial _class_parameters on NEW host form through ajax POST to parameters' do
     host = Host::Managed.new(:name => "new_host", :environment_id => environments(:production).id)
     new_host_attributes = host_attributes(host)
     puppetclass = puppetclasses(:two)
     post :parameters, {:id => puppetclass.id, :host_id => 'null',
                        :host => new_host_attributes }, set_session_user
     assert_response :success
-    lookup_keys_added = overridable_lookup_keys(puppetclass, host)
-    assert_equal 2, lookup_keys_added.count
-    assert lookup_keys_added.map(&:key).include?("special_info")
-    assert lookup_keys_added.map(&:key).include?("custom_class_param")
+    as_admin do
+      lookup_keys_added = overridable_lookup_keys(puppetclass, host)
+      assert_equal 2, lookup_keys_added.count
+      assert lookup_keys_added.map(&:key).include?("special_info")
+      assert lookup_keys_added.map(&:key).include?("custom_class_param")
+    end
   end
 
   test 'puppetclass lookup keys are added to partial _class_parameters on NEW hostgroup form through ajax POST to parameters' do
     hostgroup = Hostgroup.new(:name => "new_hostgroup", :environment_id => environments(:production).id)
     new_hostgroup_attributes = hostgroup_attributes(hostgroup)
     puppetclass = puppetclasses(:two)
     # host_id is posted instead of hostgroup_id per host_edit.js#load_puppet_class_parameters
     post :parameters, {:id => puppetclass.id, :host_id => 'null',
                        :hostgroup => new_hostgroup_attributes }, set_session_user
     assert_response :success
-    lookup_keys_added = overridable_lookup_keys(puppetclass, hostgroup)
-    assert_equal 2, lookup_keys_added.count
-    assert lookup_keys_added.map(&:key).include?("special_info")
-    assert lookup_keys_added.map(&:key).include?("custom_class_param")
+    as_admin do
+      lookup_keys_added = overridable_lookup_keys(puppetclass, hostgroup)
+      assert_equal 2, lookup_keys_added.count
+      assert lookup_keys_added.map(&:key).include?("special_info")
+      assert lookup_keys_added.map(&:key).include?("custom_class_param")
+    end
   end
 
   test "sorting by environment name on the index screen should work" do
     setup_user
     #environment_classes(:nine) which assigned puppetclasses(:three) with environments(:global_puppetmaster) broke test, so remove it
@@ -203,21 +211,25 @@ class PuppetclassesControllerTest < ActionController::TestCase
     assert_redirected_to puppetclasses_url
   end
 
   test 'user with edit_puppetclasses permission should succeed in overriding all parameters' do
     setup_user "edit", "puppetclasses"
-    env = FactoryGirl.create(:environment)
+    env = FactoryGirl.create(:environment,
+                             :organizations => [users(:one).organizations.first],
+                             :locations => [users(:one).locations.first])
     pc = FactoryGirl.create(:puppetclass, :with_parameters, :environments => [env])
     refute pc.class_params.first.override
     post :override, {:id => pc.to_param, :enable => 'true'}, set_session_user.merge(:user => users(:one).id)
     assert_match /overridden all parameters/, flash[:notice]
     assert_redirected_to puppetclasses_url
   end
 
   test 'user without edit_puppetclasses permission should fail in overriding all parameters' do
     setup_user "view", "puppetclasses"
-    env = FactoryGirl.create(:environment)
+    env = FactoryGirl.create(:environment,
+                             :organizations => [users(:one).organizations.first],
+                             :locations => [users(:one).locations.first])
     pc = FactoryGirl.create(:puppetclass, :with_parameters, :environments => [env])
     refute pc.class_params.first.override
     post :override, {:id => pc.to_param, :enable => 'true'}, set_session_user.merge(:user => users(:one).id)
     assert_match /You are not authorized to perform this action/, response.body
   end
diff --git a/test/controllers/realms_controller_test.rb b/test/controllers/realms_controller_test.rb
index 364bbe2c49..886614b98c 100644
--- a/test/controllers/realms_controller_test.rb
+++ b/test/controllers/realms_controller_test.rb
@@ -34,13 +34,15 @@ class RealmsControllerTest < ActionController::TestCase
     assert_template 'edit'
   end
 
   def test_update_valid
     Realm.any_instance.stubs(:valid?).returns(true)
-    put :update, {:id => Realm.first.name,
-                  :realm => { :realm_proxy_id => SmartProxy.first.id } }, set_session_user
-    assert_equal SmartProxy.first.id, Realm.first.realm_proxy_id
+    realm_id = Realm.unscoped.first.id
+    proxy_id = SmartProxy.unscoped.first.id
+    put :update, {:id => realm_id,
+                  :realm => { :realm_proxy_id => proxy_id } }, set_session_user
+    assert_equal proxy_id, Realm.unscoped.find(realm_id).realm_proxy_id
     assert_redirected_to realms_url
   end
 
   def test_destroy
     realm = Realm.first
diff --git a/test/controllers/smart_proxies_controller_test.rb b/test/controllers/smart_proxies_controller_test.rb
index 1e1c4c7421..b6a006464b 100644
--- a/test/controllers/smart_proxies_controller_test.rb
+++ b/test/controllers/smart_proxies_controller_test.rb
@@ -36,12 +36,13 @@ class SmartProxiesControllerTest < ActionController::TestCase
     assert_template 'edit'
   end
 
   def test_update_valid
     SmartProxy.any_instance.stubs(:valid?).returns(true)
-    put :update, {:id => SmartProxy.first,:smart_proxy => {:url => "http://elsewhere.com:8443"}}, set_session_user
-    assert_equal "http://elsewhere.com:8443", SmartProxy.first.url
+    put :update, {:id => SmartProxy.unscoped.first,
+                  :smart_proxy => {:url => "http://elsewhere.com:8443"}}, set_session_user
+    assert_equal "http://elsewhere.com:8443", SmartProxy.unscoped.first.url
     assert_redirected_to smart_proxies_url
   end
 
   def test_destroy
     proxy = SmartProxy.first
diff --git a/test/controllers/subnets_controller_test.rb b/test/controllers/subnets_controller_test.rb
index db4c3070c9..c4735c4a8a 100644
--- a/test/controllers/subnets_controller_test.rb
+++ b/test/controllers/subnets_controller_test.rb
@@ -1,10 +1,10 @@
 require 'test_helper'
 
 class SubnetsControllerTest < ActionController::TestCase
   setup do
-    @model = Subnet.first
+    @model = subnets(:one)
   end
 
   basic_index_test
   basic_new_test
   basic_edit_test
@@ -25,36 +25,36 @@ class SubnetsControllerTest < ActionController::TestCase
     assert_redirected_to subnets_url
   end
 
   def test_update_invalid
     Subnet.any_instance.stubs(:valid?).returns(false)
-    put :update, {:id => Subnet.first, :subnet => {:network => nil}}, set_session_user
+    subnet_id = @model
+    put :update, {:id => subnet_id, :subnet => {:network => nil}}, set_session_user
     assert_template 'edit'
   end
 
   def test_update_valid
     Subnet.any_instance.stubs(:valid?).returns(true)
-    put :update, {:id => Subnet.first, :subnet => {:network => '192.168.100.10'}}, set_session_user
-    assert_equal '192.168.100.10', Subnet.first.network
+    put :update, {:id => @model, :subnet => {:network => '192.168.100.10'}}, set_session_user
+    assert_equal '192.168.100.10', Subnet.unscoped.find(@model).network
     assert_redirected_to subnets_url
   end
 
   def test_should_not_destroy_if_used_by_hosts
     subnet = subnets(:one)
     delete :destroy, {:id => subnet}, set_session_user
     assert_redirected_to subnets_url
-    assert Subnet.exists?(subnet.id)
+    assert Subnet.unscoped.exists?(subnet.id)
   end
 
   def test_destroy
-    subnet = Subnet.first
-    subnet.hosts.clear
-    subnet.interfaces.clear
-    subnet.domains.clear
-    delete :destroy, {:id => subnet}, set_session_user
+    @model.hosts.clear
+    @model.interfaces.clear
+    @model.domains.clear
+    delete :destroy, {:id => @model}, set_session_user
     assert_redirected_to subnets_url
-    assert !Subnet.exists?(subnet.id)
+    refute Subnet.exists?(@model.id)
   end
 
   context 'freeip' do
     test 'fails when subnet is not provided' do
       get :freeip, {}, set_session_user
@@ -151,11 +151,11 @@ class SubnetsControllerTest < ActionController::TestCase
                     :network => sample_subnet.network,
                     :mask => sample_subnet.mask,
                     :cidr => sample_subnet.cidr,
                     :ipam => sample_subnet.ipam,
                     :boot_mode => sample_subnet.boot_mode }
-    assert_difference 'Subnet.count', 1 do
+    assert_difference 'Subnet.unscoped.count', 1 do
       post :create_multiple, { :subnets => [subnet_hash] }, set_session_user
     end
     assert_response :redirect
     assert_redirected_to subnets_url
   end
diff --git a/test/controllers/unattended_controller_test.rb b/test/controllers/unattended_controller_test.rb
index c8bc6a0c1e..2e5b5c498a 100644
--- a/test/controllers/unattended_controller_test.rb
+++ b/test/controllers/unattended_controller_test.rb
@@ -287,10 +287,12 @@ class UnattendedControllerTest < ActionController::TestCase
     setup do
       @host_param = FactoryGirl.create(:host_parameter, :host => @rh_host, :name => 'my_param')
       @secret_param = FactoryGirl.create(:host_parameter, :host => @rh_host, :name => 'secret_param')
       setup_user 'view', 'hosts'
       setup_user 'view', 'params', 'name = my_param'
+      users(:one).organizations << @rh_host.organization
+      users(:one).locations << @rh_host.location
       @rh_host.provisioning_template(:kind => :provision).update_attribute(:template, "params: <%= @host.params['my_param'] %>, <%= @host.params['secret_param'] %>")
     end
 
     test "in preview should only show permitted parameters" do
       get :host_template, {:kind => 'provision', :hostname => @rh_host.name}, set_session_user(:one)
@@ -436,20 +438,25 @@ class UnattendedControllerTest < ActionController::TestCase
     get :host_template, {:kind => 'PXELinux', :spoof => @rh_host.ip, :format => 'text'}, set_session_user(user)
     assert_response :unprocessable_entity
   end
 
   test 'should render a template to user with valid filter' do
-    user = FactoryGirl.create(:user, :with_mail, :admin => false)
-    FactoryGirl.create(:filter, :role => user.roles.first, :permissions => Permission.where(:name => 'view_hosts'), :search => "name = #{@rh_host.name}")
+    user = FactoryGirl.create(:user, :with_mail, :admin => false,
+                              :organizations => [@org], :locations => [@loc])
+    FactoryGirl.create(:filter, :role => user.roles.first,
+                       :permissions => Permission.where(:name => 'view_hosts'),
+                       :search => "name = #{@rh_host.name}")
     get :host_template, {:kind => 'PXELinux', :spoof => @rh_host.ip, :format => 'text'}, set_session_user(user)
     assert_response :success
     assert @response.body.include?("linux")
   end
 
   test 'should not render a template to user with invalid filter' do
     user = FactoryGirl.create(:user, :with_mail, :admin => false)
-    FactoryGirl.create(:filter, :role => user.roles.first, :permissions => Permission.where(:name => 'view_hosts'), :search => "name = does_not_exist")
+    FactoryGirl.create(:filter, :role => user.roles.first,
+                       :permissions => Permission.where(:name => 'view_hosts'),
+                       :search => "name = does_not_exist")
     get :host_template, {:kind => 'PXELinux', :spoof => @rh_host.ip, :format => 'text'}, set_session_user(user)
     assert_response :not_found
     assert_match /unable to find a host/, @response.body
   end
 end
diff --git a/test/controllers/users_controller_test.rb b/test/controllers/users_controller_test.rb
index 45a7aefca9..c70887c3e0 100644
--- a/test/controllers/users_controller_test.rb
+++ b/test/controllers/users_controller_test.rb
@@ -30,11 +30,11 @@ class UsersControllerTest < ActionController::TestCase
         :auth_source_id => auth_sources(:internal).id,
         :password       => 'changeme'
       }
     }, set_session_user
     assert_redirected_to users_path
-    refute User.find_by_login('foo').admin
+    refute User.unscoped.find_by_login('foo').admin
   end
 
   test 'should create admin user' do
     post :create, {
       :user => {
@@ -44,28 +44,28 @@ class UsersControllerTest < ActionController::TestCase
         :auth_source_id => auth_sources(:internal).id,
         :password       => 'changeme'
       }
     }, set_session_user
     assert_redirected_to users_path
-    assert User.find_by_login('foo').admin
+    assert User.unscoped.find_by_login('foo').admin
   end
 
   test "should update user" do
     user = User.create :login => "foo", :mail => "foo@bar.com", :auth_source => auth_sources(:one)
 
     put :update, { :id => user.id, :user => {:login => "johnsmith"} }, set_session_user
-    mod_user = User.find_by_id(user.id)
+    mod_user = User.unscoped.find_by_id(user.id)
 
     assert mod_user.login == "johnsmith"
     assert_redirected_to users_path
   end
 
   test "should assign a mail notification" do
     user = FactoryGirl.create(:user, :with_mail)
     notification = FactoryGirl.create(:mail_notification)
     put :update, { :id => user.id, :user => {:user_mail_notifications_attributes => {'0' => {:mail_notification_id => notification.id, :interval => 'Subscribe'}}}}, set_session_user
-    user = User.find_by_id(user.id)
+    user = User.unscoped.find_by_id(user.id)
     assert user.mail_notifications.include? notification
   end
 
   test "user changes should expire topbar cache" do
     user = FactoryGirl.create(:user, :with_mail)
@@ -84,11 +84,11 @@ class UsersControllerTest < ActionController::TestCase
     user = User.create :login => "foo", :mail => "foo@bar.com", :auth_source => auth_sources(:one)
 
     assert user.roles =([roles(:default_role)])
 
     put :update, { :id => user.id, :user => {:login => "johnsmith"} }, set_session_user
-    mod_user = User.find_by_id(user.id)
+    mod_user = User.unscoped.find_by_id(user.id)
 
     assert mod_user.roles =([roles(:default_role)])
   end
 
   test "should set password" do
@@ -99,11 +99,12 @@ class UsersControllerTest < ActionController::TestCase
     put :update, {:id => user.id,
                   :user => {
                     :login => "johnsmith", :password => "dummy", :password_confirmation => "dummy"
                   }
                  }, set_session_user
-    mod_user = User.find_by_id(user.id)
+
+    mod_user = User.unscoped.find_by_id(user.id)
 
     assert mod_user.matching_password?("dummy")
     assert_redirected_to users_path
   end
 
@@ -115,11 +116,10 @@ class UsersControllerTest < ActionController::TestCase
     put :update, {:id => user.id,
                   :user => {
                     :login => "johnsmith", :password => "dummy", :password_confirmation => "DUMMY"
                   }
                  }, set_session_user
-
     user.reload
     assert user.matching_password?("changeme")
     assert_template :edit
   end
 
@@ -174,11 +174,11 @@ class UsersControllerTest < ActionController::TestCase
     @request.env['HTTP_REFERER'] = users_path
     user = users(:one)
     user.update_attribute :admin, true
     delete :destroy, {:id => user.id}, set_session_user.merge(:user => user.id)
     assert_redirected_to users_url
-    assert User.exists?(user.id)
+    assert User.unscoped.exists?(user.id)
     assert @request.flash[:notice] == "You cannot delete this user while logged in as this user."
   end
 
   test 'user with viewer rights should fail to edit a user' do
     get :edit, {:id => users(:admin).id}
@@ -204,11 +204,11 @@ class UsersControllerTest < ActionController::TestCase
       "login"  => user.login,
       "mail"  => "you@have.mail"},
       "id"     => user.id}
     put :update, update_hash, set_session_user.merge(:user => user.id)
 
-    assert !User.find_by_login(user.login).mail.blank?
+    assert !User.unscoped.find_by_login(user.login).mail.blank?
   end
 
   test "should login external user" do
     Setting['authorize_login_delegation'] = true
     Setting['authorize_login_delegation_auth_source_user_autocreate'] = 'apache'
@@ -241,11 +241,11 @@ class UsersControllerTest < ActionController::TestCase
     Setting['authorize_login_delegation'] = true
     Setting['authorize_login_delegation_auth_source_user_autocreate'] = 'apache_mod'
     @request.session.clear
     @request.env['REMOTE_USER'] = 'ares'
     get :extlogin, {}, {}
-    assert_redirected_to edit_user_path(User.find_by_login('ares'))
+    assert_redirected_to edit_user_path(User.unscoped.find_by_login('ares'))
   end
 
   test "should use intercept if available" do
     SSO::FormIntercept.any_instance.stubs(:available?).returns(true)
     SSO::FormIntercept.any_instance.stubs(:authenticated?).returns(true)
@@ -281,11 +281,11 @@ class UsersControllerTest < ActionController::TestCase
     assert_response :not_found
   end
 
   test 'user with edit permission should be able to edit another user' do
     setup_user 'edit', 'users'
-    get :edit, { :id => users(:two) }
+    get :edit, { :id => users(:two) }, set_session_user
     assert_response :success
   end
 
   test 'user without edit permission should not be able to update another user' do
     User.current = users(:one)
@@ -293,11 +293,12 @@ class UsersControllerTest < ActionController::TestCase
     assert_response :forbidden
   end
 
   test 'user with update permission should be able to update another user' do
     setup_user 'edit', 'users'
-    put :update, { :id => users(:two).id, :user => { :firstname => 'test' } }
+    put :update, { :id => users(:two).id, :user => { :firstname => 'test' } },
+      set_session_user
 
     assert_response :redirect
   end
 
   test "#login sets the session user" do
@@ -349,16 +350,18 @@ class UsersControllerTest < ActionController::TestCase
 
   test "#login shows a warning for any user model errors" do
     attrs = {:firstname=>"foo", :mail=>"foo#bar", :login=>"ldap-user", :auth_source_id=>auth_sources(:one).id}
     AuthSourceLdap.any_instance.stubs(:authenticate).returns(attrs)
     AuthSourceLdap.any_instance.stubs(:update_usergroups).returns(true)
+    AuthSourceLdap.any_instance.stubs(:organizations).returns([taxonomies(:organization1)])
+    AuthSourceLdap.any_instance.stubs(:locations).returns([taxonomies(:location1)])
     post :login, {:login => {'login' => 'ldap-user', 'password' => 'password'}}
     assert_redirected_to hosts_path
     assert_match /mail.*invalid/i, flash[:warning]
 
     # Subsequent redirects to the user edit page should preserve the warning
-    user = User.find_by_login('ldap-user')
+    user = User.unscoped.find_by_login('ldap-user')
     get :index, {}, set_session_user.merge(:user => user.id)
     assert_redirected_to edit_user_path(user)
 
     get :edit, {:id => user.id}, set_session_user.merge(:user => user.id)
     assert_response :success
@@ -427,11 +430,11 @@ class UsersControllerTest < ActionController::TestCase
       put :update, { :id   => users(:one).id,
                      :user => { :default_location_id     => taxonomies(:location1).id,
                                 :default_organization_id => taxonomies(:organization1).id } }
       assert_redirected_to users_path
 
-      updated_user = User.find(users(:one).id)
+      updated_user = User.unscoped.find(users(:one).id)
       assert_equal taxonomies(:location1),     updated_user.default_location
       assert_equal taxonomies(:organization1), updated_user.default_organization
     end
   end
 
diff --git a/test/controllers/variable_lookup_keys_controller_test.rb b/test/controllers/variable_lookup_keys_controller_test.rb
index 3dff350478..dfaefca97e 100644
--- a/test/controllers/variable_lookup_keys_controller_test.rb
+++ b/test/controllers/variable_lookup_keys_controller_test.rb
@@ -31,22 +31,17 @@ class VariableLookupKeysControllerTest < ActionController::TestCase
       post :create, { :variable_lookup_key => { :key => "dummy", :type => "string", :default_value => 'test', :puppetclass_id => puppetclass.id } }, set_session_user
     end
     assert_redirected_to variable_lookup_keys_path
   end
 
-  def setup_user
-    @request.session[:user] = users(:one).id
-    users(:one).roles       = [Role.default, Role.find_by_name('Viewer')]
-  end
-
   test 'user with viewer rights should fail to edit an external variable' do
-    setup_user
+    setup_users
     get :edit, {:id => VariableLookupKey.first.id}, set_session_user.merge(:user => users(:one).id)
     assert_equal response.status, 403
   end
 
   test 'user with viewer rights should succeed in viewing external variables' do
-    setup_user
+    setup_users
     get :index, {}, set_session_user.merge(:user => users(:one).id)
     assert_response :success
   end
 end
diff --git a/test/factories/domain.rb b/test/factories/domain.rb
index e3bd14b018..4885b91f0a 100644
--- a/test/factories/domain.rb
+++ b/test/factories/domain.rb
@@ -4,10 +4,12 @@ FactoryGirl.define do
   end
 
   factory :domain do
     sequence(:name) {|n| "example#{n}.com" }
     fullname { |n| n.name }
+    organizations { [Organization.find_by_name('Organization 1')] } if SETTINGS[:organizations_enabled]
+    locations { [Location.find_by_name('Location 1')] } if SETTINGS[:locations_enabled]
 
     trait :with_parameter do
       after(:create) do |domain,evaluator|
         FactoryGirl.create(:domain_parameter, :domain => domain)
       end
diff --git a/test/factories/host_related.rb b/test/factories/host_related.rb
index 31104059e1..9051c114a8 100644
--- a/test/factories/host_related.rb
+++ b/test/factories/host_related.rb
@@ -15,10 +15,12 @@ end
 FactoryGirl.define do
   factory :ptable do
     sequence(:name) { |n| "ptable#{n}" }
     layout 'zerombr\nclearpart --all    --initlabel\npart /boot --fstype ext3 --size=<%= 10 * 10 %> --asprimary\npart /     --f   stype ext3 --size=1024 --grow\npart swap  --recommended'
     os_family 'Redhat'
+    organizations { [Organization.find_by_name('Organization 1')] } if SETTINGS[:organizations_enabled]
+    locations { [Location.find_by_name('Location 1')] } if SETTINGS[:locations_enabled]
 
     trait :ubuntu do
       sequence(:name) { |n| "ubuntu default#{n}" }
       layout "d-i partman-auto/disk string /dev/sda\nd-i partman-auto/method string regular..."
       os_family 'Debian'
@@ -108,10 +110,12 @@ FactoryGirl.define do
 
   factory :host do
     sequence(:name) { |n| "host#{n}" }
     sequence(:hostname) { |n| "host#{n}" }
     root_pass 'xybxa6JUkz63w'
+    organization { Organization.find_by_name('Organization 1') } if SETTINGS[:organizations_enabled]
+    location { Location.find_by_name('Location 1') } if SETTINGS[:locations_enabled]
 
     # This allows a test to declare build/create(:host, :ip => '1.2.3.4') and
     # have the primary interface correctly updated with the specified attrs
     after(:build) do |host,evaluator|
       unless host.primary_interface.present?
@@ -230,12 +234,10 @@ FactoryGirl.define do
       managed true
       pxe_loader "Grub2 UEFI"
       architecture { operatingsystem.try(:architectures).try(:first) }
       medium { operatingsystem.try(:media).try(:first) }
       ptable { operatingsystem.try(:ptables).try(:first) }
-      location
-      organization
       domain
       interfaces { [ FactoryGirl.build(:nic_primary_and_provision) ] }
       association :operatingsystem, :with_associations
     end
 
@@ -429,10 +431,12 @@ FactoryGirl.define do
     end
   end
 
   factory :hostgroup do
     sequence(:name) { |n| "hostgroup#{n}" }
+    organizations { [Organization.find_by_name('Organization 1')] } if SETTINGS[:organizations_enabled]
+    locations { [Location.find_by_name('Location 1')] } if SETTINGS[:locations_enabled]
 
     trait :with_parent do
       association :parent, :factory => :hostgroup
     end
 
diff --git a/test/factories/smart_proxy.rb b/test/factories/smart_proxy.rb
index 580002d105..3d7fbef625 100644
--- a/test/factories/smart_proxy.rb
+++ b/test/factories/smart_proxy.rb
@@ -1,9 +1,12 @@
 FactoryGirl.define do
   factory :smart_proxy do
     sequence(:name) {|n| "proxy#{n}" }
     sequence(:url) {|n| "https://somewhere#{n}.net:8443" }
+    organizations { [Organization.find_by_name('Organization 1')] } if SETTINGS[:organizations_enabled]
+    locations { [Location.find_by_name('Location 1')] } if SETTINGS[:locations_enabled]
+
     before(:create, :build, :build_stubbed) do
       ProxyAPI::Features.any_instance.stubs(:features => Feature.name_map.keys)
     end
 
     factory :template_smart_proxy do
diff --git a/test/factories/subnet.rb b/test/factories/subnet.rb
index 1897e4d859..be3ce26c7c 100644
--- a/test/factories/subnet.rb
+++ b/test/factories/subnet.rb
@@ -4,10 +4,12 @@ FactoryGirl.define do
   end
 
   factory :subnet do
     sequence(:name) {|n| "subnet#{n}" }
     ipam "None"
+    organizations { [Organization.find_by_name('Organization 1')] } if SETTINGS[:organizations_enabled]
+    locations { [Location.find_by_name('Location 1')] } if SETTINGS[:locations_enabled]
 
     trait :tftp do
       association :tftp, :factory => :template_smart_proxy
     end
 
diff --git a/test/factories/user_related.rb b/test/factories/user_related.rb
index c5ea7ea597..a5004c89b0 100644
--- a/test/factories/user_related.rb
+++ b/test/factories/user_related.rb
@@ -12,10 +12,12 @@ FactoryGirl.define do
 
   factory :user do
     auth_source { AuthSourceInternal.first }
     password 'password'
     sequence(:login) {|n| "user#{n}" }
+    organizations { [ Organization.find_by_name('Organization 1') ] }
+    locations { [ Location.find_by_name('Location 1') ] }
 
     trait :admin do
       admin { true }
     end
 
diff --git a/test/fixtures/taxable_taxonomies.yml b/test/fixtures/taxable_taxonomies.yml
index 7c58182060..ff2e77e96a 100644
--- a/test/fixtures/taxable_taxonomies.yml
+++ b/test/fixtures/taxable_taxonomies.yml
@@ -2,25 +2,15 @@
 
 # This model initially had no columns defined.  If you add columns to the
 # model remove the '{}' from the fixture names and add the columns immediately
 # below each fixture, per the syntax in the comments below
 #
-one:
-  taxonomy: location1
-  taxable: one
-  taxable_type: "Subnet"
-
 two:
   taxonomy: location1
   taxable: one
   taxable_type: "SmartProxy"
 
-three:
-  taxonomy: organization1
-  taxable: one
-  taxable_type: "Subnet"
-
 four:
   taxonomy: organization1
   taxable: one
   taxable_type: "SmartProxy"
 
@@ -52,20 +42,10 @@ eight2:
 nine:
   taxonomy: organization1
   taxable: mydomain
   taxable_type: "Domain"
 
-ten:
-  taxonomy: location1
-  taxable: one
-  taxable_type: "Medium"
-
-ten2:
-  taxonomy: organization1
-  taxable: one
-  taxable_type: "Medium"
-
 eleven:
   taxonomy: location1
   taxable: one
   taxable_type: "ComputeResource"
 
@@ -151,5 +131,65 @@ scoped_user_organization1:
 
 scoped_user_location1:
   taxonomy: location1
   taxable: scoped
   taxable_type: User
+
+user_one_org:
+  taxonomy: organization1
+  taxable: one
+  taxable_type: "User"
+
+user_one_loc:
+  taxonomy: location1
+  taxable: one
+  taxable_type: "User"
+
+subnet_one_org:
+  taxonomy: organization1
+  taxable: one
+  taxable_type: "Subnet"
+
+subnet_one_loc:
+  taxonomy: location1
+  taxable: one
+  taxable_type: "Subnet"
+
+compute_mycompute_org:
+  taxonomy: organization1
+  taxable: mycompute
+  taxable_type: "ComputeResource"
+
+compute_mycompute_loc:
+  taxonomy: location1
+  taxable: mycompute
+  taxable_type: "ComputeResource"
+
+hostgroup_common_org:
+  taxonomy: organization1
+  taxable: common
+  taxable_type: "Hostgroup"
+
+hostgroup_common_loc:
+  taxonomy: location1
+  taxable: common
+  taxable_type: "Hostgroup"
+
+medium_one_org:
+  taxonomy: organization1
+  taxable: one
+  taxable_type: "Medium"
+
+medium_one_loc:
+  taxonomy: location1
+  taxable: one
+  taxable_type: "Medium"
+
+auth_source_ldap_one_org:
+  taxonomy: organization1
+  taxable: one
+  taxable_type: "AuthSource"
+
+auth_source_ldap_one_loc:
+  taxonomy: location1
+  taxable: one
+  taxable_type: "AuthSource"
diff --git a/test/integration/location_test.rb b/test/integration/location_test.rb
index be4a29fb81..960ce5e9cf 100644
--- a/test/integration/location_test.rb
+++ b/test/integration/location_test.rb
@@ -1,10 +1,10 @@
 require 'integration_test_helper'
 
 class LocationIntegrationTest < ActionDispatch::IntegrationTest
   def setup
-    FactoryGirl.create(:host)
+    FactoryGirl.create(:host, :location => nil)
   end
 
   test "index page" do
     assert_index_page(locations_path,"Locations","New Location")
   end
@@ -33,11 +33,11 @@ class LocationIntegrationTest < ActionDispatch::IntegrationTest
     assert page.has_link? 'Primary'
   end
 
   # content - click Assign All
   test "create new page when some hosts are not assigned a location and click Assign All" do
-    assert_new_button(locations_path,"New Location",new_location_path)
+    assert_new_button(locations_path, "New Location", new_location_path)
     fill_in "location_name", :with => "Raleigh"
     click_button "Submit"
     assert_current_path step2_location_path(Location.unscoped.order(:id).last)
     click_link "Assign All"
     assert_current_path locations_path
diff --git a/test/integration/organization_test.rb b/test/integration/organization_test.rb
index 79c3bdab35..3d0831b606 100644
--- a/test/integration/organization_test.rb
+++ b/test/integration/organization_test.rb
@@ -1,10 +1,10 @@
 require 'integration_test_helper'
 
 class OrganizationIntegrationTest < ActionDispatch::IntegrationTest
   def setup
-    FactoryGirl.create(:host)
+    FactoryGirl.create(:host, :organization => nil)
   end
 
   test "index page" do
     assert_index_page(organizations_path,"Organizations","New Organization")
   end
diff --git a/test/models/concerns/api_taxonomy_scope_test.rb b/test/models/concerns/api_taxonomy_scope_test.rb
index 0ff4bb6f16..6795a69052 100644
--- a/test/models/concerns/api_taxonomy_scope_test.rb
+++ b/test/models/concerns/api_taxonomy_scope_test.rb
@@ -40,22 +40,19 @@ class ApiTaxonomyScopeTest < ActiveSupport::TestCase
         @dummy.set_taxonomy_scope
       end
     end
 
     test "set_taxonomy_scope respects user association to orgs and locs, fails on not allowed organization" do
-      users(:one).locations << taxonomies(:location1)
       Location.expects(:my_locations).returns(Location.where(:id => taxonomies(:location1).id))
       Organization.expects(:my_organizations).returns(Organization.where(:id => nil))
       @dummy.expects(:not_found)
       as_user :one do
         @dummy.set_taxonomy_scope
       end
     end
 
     test "set_taxonomy_scope respects user association to orgs and locs, sets both if allowed" do
-      users(:one).locations << taxonomies(:location1)
-      users(:one).organizations << taxonomies(:organization1)
       Location.expects(:my_locations).returns(Location.where(:id => taxonomies(:location1).id))
       Organization.expects(:my_organizations).returns(Organization.where(:id => taxonomies(:organization1).id))
       as_user :one do
         @dummy.set_taxonomy_scope
       end
diff --git a/test/models/fact_value_test.rb b/test/models/fact_value_test.rb
index 80ed5d0161..d438845a24 100644
--- a/test/models/fact_value_test.rb
+++ b/test/models/fact_value_test.rb
@@ -118,11 +118,17 @@ class FactValueTest < ActiveSupport::TestCase
       end
     end
 
     test 'returns visible facts for unlimited user' do
       user_role = FactoryGirl.create(:user_user_role)
-      FactoryGirl.create(:filter, :role => user_role.role, :permissions => Permission.where(:name => 'view_hosts'), :unlimited => true)
+      FactoryGirl.create(:filter, :role => user_role.role,
+                         :permissions => Permission.unscoped.where(:name => 'view_hosts'),
+                         :unlimited => true)
+      target_host.organization = user_role.owner.organizations.first
+      target_host.location = user_role.owner.locations.first
+      other_host.organization = user_role.owner.organizations.first
+      other_host.location = user_role.owner.locations.first
       as_user user_role.owner do
         assert_empty (target_host.fact_values + other_host.fact_values).map(&:id) - FactValue.my_facts.map(&:id)
       end
     end
 
diff --git a/test/models/host_test.rb b/test/models/host_test.rb
index 23d2155bfa..845b4a5725 100644
--- a/test/models/host_test.rb
+++ b/test/models/host_test.rb
@@ -173,14 +173,16 @@ class HostTest < ActiveSupport::TestCase
   end
 
   test "non-admin user should be able to create host with new lookup value" do
     User.current = users(:one)
     User.current.roles << [roles(:manager)]
-    assert_difference('LookupValue.count') do
+    assert_difference('LookupValue.unscoped.count') do
       assert Host.create! :name => "abc.mydomain.net", :mac => "aabbecddeeff", :ip => "3.3.4.3",
       :domain => domains(:mydomain), :operatingsystem => operatingsystems(:redhat),
-      :subnet => subnets(:two), :architecture => architectures(:x86_64), :puppet_proxy => smart_proxies(:puppetmaster), :medium => media(:one),
+      :subnet => subnets(:two), :architecture => architectures(:x86_64),
+      :puppet_proxy => smart_proxies(:puppetmaster), :medium => media(:one),
+      :organization => nil, :location => nil,
       :environment => environments(:production), :disk => "empty partition",
       :lookup_values_attributes => {"new_123456" => {"lookup_key_id" => lookup_keys(:complex).id, "value"=>"some_value", "match" => "fqdn=abc.mydomain.net"}}
     end
   end
 
@@ -653,10 +655,11 @@ class HostTest < ActiveSupport::TestCase
   test 'host can be searched in multiple taxonomies' do
     org1 = FactoryGirl.create(:organization)
     org2 = FactoryGirl.create(:organization)
     org3 = FactoryGirl.create(:organization)
     user = FactoryGirl.create(:user, :organizations => [org1, org2])
+    users(:one).organizations << [org1, org2, org3]
     host1 = FactoryGirl.create(:host, :organization => org1)
     host2 = FactoryGirl.create(:host, :organization => org2)
     host3 = FactoryGirl.create(:host, :organization => org3)
     hosts = nil
 
diff --git a/test/models/nic_test.rb b/test/models/nic_test.rb
index 83ec3d4ad9..25050c5b95 100644
--- a/test/models/nic_test.rb
+++ b/test/models/nic_test.rb
@@ -57,11 +57,17 @@ class NicTest < ActiveSupport::TestCase
   end
 
   test "should delegate subnet attributes" do
     subnet = subnets(:two)
     domain = (subnet.domains.any? ? subnet.domains : subnet.domains << Domain.first).first
-    interface = Nic::Managed.create! :ip => "3.3.4.127", :mac => "cabbccddeeff", :host => FactoryGirl.create(:host), :subnet => subnet, :name => "a" + FactoryGirl.create(:host).name, :domain => domain
+    interface = FactoryGirl.build(:nic_managed,
+                                  :ip => "3.3.4.127",
+                                  :mac => "cabbccddeeff",
+                                  :host => FactoryGirl.create(:host),
+                                  :subnet => subnet,
+                                  :name => "a" + FactoryGirl.create(:host).name,
+                                  :domain => domain)
     assert_equal subnet.network, interface.network
     assert_equal subnet.vlanid, interface.vlanid
   end
 
   test "should reject subnet with mismatched taxonomy in host" do
diff --git a/test/models/report_test.rb b/test/models/report_test.rb
index c0317b1189..52e04a41e1 100644
--- a/test/models/report_test.rb
+++ b/test/models/report_test.rb
@@ -39,15 +39,13 @@ class ReportTest < ActiveSupport::TestCase
       collection = as_user(user_role.owner) { Report.my_reports }
       assert_empty (@target_reports + @other_reports).map(&:id) - collection.map(&:id)
     end
 
     test 'returns visible reports for filtered user' do
-      user_role = FactoryGirl.create(:user_user_role)
-      FactoryGirl.create(:filter, :role => user_role.role, :permissions => Permission.where(:name => 'view_hosts'), :search => "hostgroup_id = #{@target_host.hostgroup_id}")
-      as_user user_role.owner do
-        assert_equal @target_reports.map(&:id).sort, Report.my_reports.map(&:id).sort
-      end
+      setup_user('view', 'hosts',
+                 "hostgroup_id = #{@target_host.hostgroup_id}")
+      assert_equal @target_reports.map(&:id).sort, Report.my_reports.map(&:id).sort
     end
 
     test "only return reports from host in user's taxonomies" do
       user_role = FactoryGirl.create(:user_user_role)
       FactoryGirl.create(:filter, :role => user_role.role, :permissions => Permission.where(:name => 'view_hosts'), :search => "hostgroup_id = #{@target_host.hostgroup_id}")
diff --git a/test/models/shared/taxonomies_base_test.rb b/test/models/shared/taxonomies_base_test.rb
index ce9b63c594..8afbd558b5 100644
--- a/test/models/shared/taxonomies_base_test.rb
+++ b/test/models/shared/taxonomies_base_test.rb
@@ -50,10 +50,11 @@ module TaxonomiesBaseTest
     end
 
     test 'it should return array of used ids by hosts' do
       taxonomy = taxonomies(:"#{taxonomy_name}1")
       subnet = FactoryGirl.create(:subnet_ipv4,
+                                  :"#{opposite_taxonomy}_ids" => [],
                                   :"#{taxonomy_name.pluralize}" => [taxonomy])
       domain = FactoryGirl.create(:domain)
       FactoryGirl.create(:host,
                          :compute_resource => compute_resources(:one),
                          :domain           => domain,
@@ -124,28 +125,28 @@ module TaxonomiesBaseTest
       provisioning_template_ids = taxonomy.provisioning_template_ids
       compute_resource_ids = taxonomy.compute_resource_ids
       # check if they match
       assert_equal selected_ids[:environment_ids].sort, environment_ids.sort
       assert_equal selected_ids[:hostgroup_ids].sort, hostgroup_ids.sort
-      assert_equal selected_ids[:subnet_ids].sort, subnet_ids.sort
+      assert_equal selected_ids[:subnet_ids].sort, subnet_ids.uniq.sort
       assert_equal selected_ids[:domain_ids].sort, domain_ids.sort
       assert_equal selected_ids[:realm_ids].sort, realm_ids.sort
-      assert_equal selected_ids[:medium_ids].sort, medium_ids.sort
+      assert_equal selected_ids[:medium_ids].sort, medium_ids.uniq.sort
       assert_equal selected_ids[:user_ids].sort, user_ids.sort
       assert_equal selected_ids[:smart_proxy_ids].sort, smart_proxy_ids.sort
       assert_equal selected_ids[:provisioning_template_ids].sort, provisioning_template_ids.sort
       assert_equal selected_ids[:compute_resource_ids].sort, compute_resource_ids.sort
       # match to manually generated taxable_taxonomies
       assert_equal selected_ids[:environment_ids], [environments(:production).id]
-      assert_equal selected_ids[:hostgroup_ids], []
+      assert_equal selected_ids[:hostgroup_ids], [hostgroups(:common).id]
       assert_equal selected_ids[:subnet_ids], [subnets(:one).id]
       assert_equal selected_ids[:domain_ids], [domains(:mydomain).id, domains(:yourdomain).id]
       assert_equal selected_ids[:medium_ids], [media(:one).id]
-      assert_equal selected_ids[:user_ids], [users(:scoped).id]
+      assert_equal selected_ids[:user_ids], [users(:one).id, users(:scoped).id]
       assert_equal selected_ids[:smart_proxy_ids].sort, [smart_proxies(:puppetmaster).id, smart_proxies(:one).id, smart_proxies(:two).id, smart_proxies(:three).id, smart_proxies(:realm).id].sort
       assert_equal selected_ids[:provisioning_template_ids], [templates(:mystring2).id]
-      assert_equal selected_ids[:compute_resource_ids], [compute_resources(:one).id]
+      assert_equal selected_ids[:compute_resource_ids], [compute_resources(:one).id, compute_resources(:mycompute).id]
     end
 
     test 'it should return selected_ids array of ALL values (when types are ignored)' do
       taxonomy = taxonomies(:"#{taxonomy_name}1")
       # ignore all types
@@ -166,12 +167,12 @@ module TaxonomiesBaseTest
     end
 
     test "it should clone organization with all associations" do
       taxonomy = taxonomies(:"#{taxonomy_name}1")
       taxonomy_dup = taxonomy.dup
-      taxonomy_dup.name = "taxonomy_dup_name"
-      assert taxonomy_dup.save!
+      taxonomy_dup.name = "taxonomy_dup_name_#{rand}"
+      assert taxonomy_dup.save
       assert_equal taxonomy_dup.environment_ids, taxonomy.environment_ids
       assert_equal taxonomy_dup.hostgroup_ids, taxonomy.hostgroup_ids
       assert_equal taxonomy_dup.subnet_ids, taxonomy.subnet_ids
       assert_equal taxonomy_dup.domain_ids, taxonomy.domain_ids
       assert_equal taxonomy_dup.medium_ids, taxonomy.medium_ids
@@ -211,11 +212,11 @@ module TaxonomiesBaseTest
         :id => users(:one).public_send("#{taxonomy_name}_and_child_ids")
       )
       as_admin do
         assert_equal expected.sort,
           taxonomy_class.public_send(:"my_#{taxonomy_name.pluralize}",
-                                     users(:one)).pluck(:id).sort
+                                     users(:one)).sort
       end
     end
 
     test ".my_taxonomies returns user's associated taxonomies and children" do
       tax1 = FactoryGirl.create(:"#{taxonomy_name}")
@@ -236,11 +237,13 @@ module TaxonomiesBaseTest
 
     test "inherited_ids for inherited taxonomy" do
       parent = taxonomies(:"#{taxonomy_name}1")
       taxonomy = taxonomy_class.create :name => "rack1", :parent_id => parent.id
       # check that inherited_ids of taxonomy matches selected_ids of parent
-      assert_equal parent.selected_ids, taxonomy.inherited_ids
+      as_admin do
+        assert_equal parent.selected_ids, taxonomy.inherited_ids
+      end
     end
 
     test "selected_or_inherited_ids for inherited taxonomy" do
       parent = taxonomies(:"#{taxonomy_name}1")
       taxonomy = taxonomy_class.create :name => "rack1", :parent_id => parent.id
@@ -256,39 +259,39 @@ module TaxonomiesBaseTest
     test "used_and_selected_or_inherited_ids for inherited taxonomy" do
       parent = taxonomies(:"#{taxonomy_name}1")
       subnet = FactoryGirl.create(:subnet_ipv4, :organizations => [taxonomies(:organization1)])
       domain1 = FactoryGirl.create(:domain)
       domain2 = FactoryGirl.create(:domain)
-      parent.update_attribute(:domains,[domain1,domain2])
-      parent.update_attribute(:subnets,[subnet])
+      parent.update_attribute(:domains, [domain1, domain2])
+      parent.update_attribute(:subnets, [subnet])
       # we're no longer using the fixture dhcp/dns/tftp proxy to create the host, so remove them
       parent.update_attribute(:smart_proxies,[smart_proxies(:puppetmaster),smart_proxies(:realm)])
 
       taxonomy = taxonomy_class.create :name => "rack1", :parent_id => parent.id
       FactoryGirl.create(:host,
                          :compute_resource => compute_resources(:one),
                          :domain           => domain1,
                          :environment      => environments(:production),
-                         :"#{taxonomy_name}"         => parent,
+                         :"#{taxonomy_name}" => parent,
                          :organization     => taxonomies(:organization1),
                          :medium           => media(:one),
                          :operatingsystem  => operatingsystems(:centos5_3),
                          :owner            => users(:scoped),
                          :puppet_proxy     => smart_proxies(:puppetmaster),
                          :realm            => realms(:myrealm),
                          :subnet           => subnet)
       FactoryGirl.create(:host,
-                         :"#{taxonomy_name}"         => parent,
+                         :"#{taxonomy_name}" => parent,
                          :domain           => domain2)
       FactoryGirl.create(:os_default_template,
                          :provisioning_template  => templates(:mystring2),
                          :operatingsystem  => operatingsystems(:centos5_3),
                          :template_kind    => TemplateKind.find_by_name('provision'))
 
       # check that inherited_ids of taxonomy matches selected_ids of parent
-      taxonomy.selected_or_inherited_ids.each do |k,v|
-        assert_equal v.sort, parent.used_and_selected_ids[k].sort
+      taxonomy.inherited_ids.each do |k,v|
+        assert_equal v.sort, parent.selected_ids[k].sort
       end
     end
 
     test "need_to_be_selected_ids for inherited taxonomy" do
       parent = taxonomies(:"#{taxonomy_name}1")
@@ -297,11 +300,11 @@ module TaxonomiesBaseTest
       taxonomy.need_to_be_selected_ids.each do |k,v|
         assert v.empty?
       end
     end
 
-    test "multiple inheritence" do
+    test "multiple inheritance" do
       parent1 = taxonomies(:"#{taxonomy_name}1")
       assert_equal [subnets(:one).id], parent1.selected_ids["subnet_ids"]
 
       # inherit from parent 1
       parent2 = taxonomy_class.create :name => "floor1", :parent_id => parent1.id
diff --git a/test/models/subnet/ipv6_test.rb b/test/models/subnet/ipv6_test.rb
index e47818321a..63d08e28ac 100644
--- a/test/models/subnet/ipv6_test.rb
+++ b/test/models/subnet/ipv6_test.rb
@@ -24,11 +24,11 @@ class Subnet::Ipv6Test < ActiveSupport::TestCase
     assert_equal "subnet (2001:db8::/64)", subnet.to_label
   end
 
   test "should find the subnet by ip" do
     subnet = FactoryGirl.create(:subnet_ipv6)
-    assert_equal subnet, Subnet::Ipv6.subnet_for(get_ip(subnet, 10))
+    assert_equal subnet, Subnet::Ipv6.unscoped.subnet_for(get_ip(subnet, 10))
   end
 
   test "from cant be bigger than to range" do
     s = FactoryGirl.build(:subnet_ipv6)
     s.to = get_ip(s, 10)
diff --git a/test/models/subnet_test.rb b/test/models/subnet_test.rb
index 9ab4a035be..8901562f21 100644
--- a/test/models/subnet_test.rb
+++ b/test/models/subnet_test.rb
@@ -94,11 +94,11 @@ class SubnetTest < ActiveSupport::TestCase
 
   test "should not destroy if hostgroup uses it" do
     hostgroup = FactoryGirl.create(:hostgroup, :with_subnet)
     subnet = hostgroup.subnet
     refute subnet.destroy
-    assert_match /is being used by/, subnet.errors.full_messages.join("\n")
+    assert_match /is used by/, subnet.errors.full_messages.join("\n")
   end
 
   test "should not destroy if host uses it" do
     host = FactoryGirl.create(:host, :with_subnet)
     subnet = host.subnet
diff --git a/test/models/taxonomix_test.rb b/test/models/taxonomix_test.rb
index 2d84274829..92b9473809 100644
--- a/test/models/taxonomix_test.rb
+++ b/test/models/taxonomix_test.rb
@@ -68,11 +68,12 @@ class TaxonomixTest < ActiveSupport::TestCase
     end
 
     test 'expands organizations and locations to actual values' do
       org2 = FactoryGirl.create(:organization)
       org3 = FactoryGirl.create(:organization)
-      user = FactoryGirl.create(:user, :organizations => [@org, org2])
+      user = FactoryGirl.create(:user, :organizations => [@org, org2],
+                                :locations => [])
 
       as_user(user) do
         @dummy.class.with_taxonomy_scope(nil, nil)
       end
 
@@ -160,51 +161,71 @@ class TaxonomixTest < ActiveSupport::TestCase
     assert_includes used_organizations, org2.id
     assert_includes used_organizations, org3.id
     assert_includes used_organizations, org4.id
   end
 
-  test ".taxable_ids can work with empty array returning nil" do
-    dummy_class = @dummy.class
-    assert_nil dummy_class.taxable_ids([], [])
-  end
+  describe '#taxable_ids' do
+    test "can work with empty array returning nil" do
+      assert_nil @dummy.class.taxable_ids([], [])
+    end
 
-  test ".taxable_ids (and .inner_select) can work with array of taxonomies" do
-    loc1 = FactoryGirl.create(:location)
-    loc2 = FactoryGirl.create(:location, :parent_id => loc1.id)
-    loc3 = FactoryGirl.create(:location, :parent_id => loc2.id)
-    loc4 = FactoryGirl.create(:location)
-    org = FactoryGirl.create(:organization)
-    env1 = FactoryGirl.create(:environment, :organizations => [org], :locations => [loc2])
-    env2 = FactoryGirl.create(:environment, :organizations => [org])
-    env3 = FactoryGirl.create(:environment, :locations => [loc2])
-    env4 = FactoryGirl.create(:environment, :locations => [loc4])
-    env5 = FactoryGirl.create(:environment, :locations => [loc1])
-    env6 = FactoryGirl.create(:environment, :locations => [loc3])
-
-    taxable_ids = Environment.taxable_ids([loc2, loc4], org, :subtree_ids)
-    visible = [ env1 ]
-    invisible = [ env2, env3, env4, env5, env6 ]
-    visible.each { |env| assert_includes taxable_ids, env.id }
-    invisible.each { |env| refute_includes taxable_ids, env.id }
-
-    taxable_ids = Environment.taxable_ids([], org, :subtree_ids)
-    visible = [ env1, env2 ]
-    invisible = [ env3, env4, env5, env6 ]
-    visible.each { |env| assert_includes taxable_ids, env.id }
-    invisible.each { |env| refute_includes taxable_ids, env.id }
-
-    taxable_ids = Environment.taxable_ids(loc2, [], :subtree_ids)
-    visible = [ env1, env3, env5, env6 ]
-    invisible = [ env2, env4 ]
-    visible.each { |env| assert_includes taxable_ids, env.id }
-    invisible.each { |env| refute_includes taxable_ids, env.id }
-
-    taxable_ids = Environment.taxable_ids([loc2, loc4], [], :subtree_ids)
-    visible = [ env1, env3, env4, env5, env6 ]
-    invisible = [ env2 ]
-    visible.each { |env| assert_includes taxable_ids, env.id }
-    invisible.each { |env| refute_includes taxable_ids, env.id }
+    test 'returns IDs for non-admin user of any context when no org/loc' do
+      assert @dummy.class.all.count > 1
+
+      as_user(:one) do
+        any_org = User.current.organizations
+        any_loc = User.current.locations
+
+        visible_dummies = any_org.map(&:"#{@dummy.class.table_name}").flatten.map(&:id) &
+          any_loc.map(&:"#{@dummy.class.table_name}").flatten.map(&:id)
+
+        # We need to call '.taxable_ids' using the Environment class because
+        # '.taxable_ids' will look for the 'taxable_taxonomies.taxable_type'
+        # table of the caller.
+        # Since TaxonomixDummy is defined in terms of the Environment table,
+        # the table will have Environment, not TaxonomixDummy as taxable_type
+        assert_equal visible_dummies, Environment.taxable_ids(nil, nil)
+        assert_equal visible_dummies, Environment.taxable_ids([], [])
+      end
+    end
+
+    test "can work with array of taxonomies" do
+      loc1 = FactoryGirl.create(:location)
+      loc2 = FactoryGirl.create(:location, :parent_id => loc1.id)
+      loc3 = FactoryGirl.create(:location, :parent_id => loc2.id)
+      loc4 = FactoryGirl.create(:location)
+      org = FactoryGirl.create(:organization)
+      env1 = FactoryGirl.create(:environment, :organizations => [org], :locations => [loc2])
+      env2 = FactoryGirl.create(:environment, :organizations => [org])
+      env3 = FactoryGirl.create(:environment, :locations => [loc2])
+      env4 = FactoryGirl.create(:environment, :locations => [loc4])
+      env5 = FactoryGirl.create(:environment, :locations => [loc1])
+      env6 = FactoryGirl.create(:environment, :locations => [loc3])
+      taxable_ids = Environment.taxable_ids([loc2, loc4], org, :subtree_ids)
+      visible = [ env1 ]
+      invisible = [ env2, env3, env4, env5, env6 ]
+      visible.each { |env| assert_includes taxable_ids, env.id }
+      invisible.each { |env| refute_includes taxable_ids, env.id }
+
+      taxable_ids = Environment.taxable_ids([], org, :subtree_ids)
+      visible = [ env1, env2 ]
+      invisible = [ env3, env4, env5, env6 ]
+      visible.each { |env| assert_includes taxable_ids, env.id }
+      invisible.each { |env| refute_includes taxable_ids, env.id }
+
+      taxable_ids = Environment.taxable_ids(loc2, [], :subtree_ids)
+      visible = [ env1, env3, env5, env6 ]
+      invisible = [ env2, env4 ]
+      visible.each { |env| assert_includes taxable_ids, env.id }
+      invisible.each { |env| refute_includes taxable_ids, env.id }
+
+      taxable_ids = Environment.taxable_ids([loc2, loc4], [], :subtree_ids)
+      visible = [ env1, env3, env4, env5, env6 ]
+      invisible = [ env2 ]
+      visible.each { |env| assert_includes taxable_ids, env.id }
+      invisible.each { |env| refute_includes taxable_ids, env.id }
+    end
   end
 
   test "validation does not prevent taxonomy association if user does not have permissions of already assigned taxonomies" do
     filter = FactoryGirl.create(:filter, :search => 'name ~ visible*')
     filter.permissions = Permission.where(:name => [ 'view_organizations', 'assign_organizations' ])
@@ -277,10 +298,49 @@ class TaxonomixTest < ActiveSupport::TestCase
   test "#used_organization_ids should not return organization for user with same id as of user_group which is assigned to host as owner." do
     org = FactoryGirl.create(:organization)
     user = FactoryGirl.create(:user, :id => 25, :organizations => [org])
     ugroup = FactoryGirl.create(:usergroup, :id=> 25)
     FactoryGirl.create(:host, :owner => ugroup, :organization => org)
-    used_organizations = user.used_organization_ids
-    assert_empty used_organizations
-    assert_equal used_organizations.count, 0
+    as_admin do
+      used_organizations = user.used_organization_ids
+      assert_empty used_organizations
+      assert_equal used_organizations.count, 0
+    end
+  end
+
+  context 'admin permissions' do
+    test "returns only visible objects when org/loc are selected" do
+      scoped_environments = Environment.
+        with_taxonomy_scope([taxonomies(:organization1)])
+      assert scoped_environments.include?(*taxonomies(:organization1).environments)
+      assert_not_equal Environment.unscoped.all, scoped_environments
+      assert_equal taxonomies(:organization1).environments, scoped_environments
+    end
+
+    test "returns nil (all objects) when there are no org/loc" do
+      assert_equal User.with_taxonomy_scope([],[]).sort, User.unscoped.all.sort
+    end
+  end
+
+  test 'current user ID and admin IDs are always visible' do
+    as_user(:one) do
+      scoped_users = User.with_taxonomy_scope([],[])
+      assert_include scoped_users, User.current
+      assert_include scoped_users, users(:admin)
+    end
+  end
+
+  test 'users can only see objects scoped to its current taxonomies' do
+    # Environment in organization 1 and location 1 cannot be seen by an user
+    # who is scoped to organization 1 and location 2
+    users(:one).organizations = [taxonomies(:organization1)]
+    users(:one).locations = [taxonomies(:location2)]
+    unreachable_env = FactoryGirl.create(
+      :environment,
+      :organizations => [taxonomies(:organization1)],
+      :locations => [taxonomies(:location1)])
+
+    as_user(:one) do
+      assert_not_include Environment.all, unreachable_env
+    end
   end
 end
diff --git a/test/models/taxonomy_test.rb b/test/models/taxonomy_test.rb
index 0be646f466..3335786ea1 100644
--- a/test/models/taxonomy_test.rb
+++ b/test/models/taxonomy_test.rb
@@ -62,11 +62,11 @@ class TaxonomyTest < ActiveSupport::TestCase
     end
   end
 
   test 'for non admin user, nil is expanded to [] if user is not assigned to any org' do
     # we have to run on specific taxonomy because my_* is defined only in Organization and Location
-    user = FactoryGirl.create(:user)
+    user = FactoryGirl.create(:user, :organizations => [])
     as_user(user) do
       assert_equal [], Organization.expand(nil)
       assert_equal [], Organization.expand([])
     end
   end
diff --git a/test/models/user_test.rb b/test/models/user_test.rb
index 1e3a5c21bc..df3f13a17d 100644
--- a/test/models/user_test.rb
+++ b/test/models/user_test.rb
@@ -111,19 +111,19 @@ class UserTest < ActiveSupport::TestCase
 
     test "when a user logs in, last login time should be updated" do
       user = users(:internal)
       last_login = user.last_login_on
       assert_not_nil User.try_to_login(user.login, "changeme")
-      assert_not_equal last_login, User.find(user.id).last_login_on
+      assert_not_equal last_login, User.unscoped.find(user.id).last_login_on
     end
 
     test "updating the last login time must not persist invalid attributes" do
       user = FactoryGirl.create(:user, :with_mail, :auth_source => FactoryGirl.create(:auth_source_ldap))
       AuthSourceLdap.any_instance.expects(:authenticate).returns(:mail => 'foo#bar')
       AuthSourceLdap.any_instance.stubs(:update_usergroups).returns(true)
       assert_not_nil User.try_to_login(user.login, "changeme")
-      reloaded_user = User.find(user.id)
+      reloaded_user = User.unscoped.find(user.id)
       assert_not_equal user.last_login_on, reloaded_user.last_login_on
       assert_equal user.mail, reloaded_user.mail
     end
 
     test ".try_to_login on unknown user should return nil" do
@@ -207,11 +207,14 @@ class UserTest < ActiveSupport::TestCase
     super operation, "users"
   end
 
   test "user with create permissions should be able to create" do
     setup_user "create"
-    record = User.new :login => "dummy", :mail => "j@j.com", :auth_source_id => AuthSourceInternal.first.id
+    record = User.new :login => "dummy", :mail => "j@j.com",
+      :auth_source_id => AuthSourceInternal.first.id,
+      :organizations => User.current.organizations,
+      :locations => User.current.locations
     record.password_hash = "asd"
     assert record.save
     assert record.valid?
     refute record.new_record?
   end
@@ -241,23 +244,29 @@ class UserTest < ActiveSupport::TestCase
   end
 
   test "non-admin user can delegate roles he has assigned already" do
     setup_user "create"
     create_role          = Role.find_by_name 'create_users'
-    record               = User.new :login    => "dummy", :mail => "j@j.com", :auth_source_id => AuthSourceInternal.first.id,
-                                    :role_ids => [create_role.id.to_s]
+    record               = User.new(:login => "dummy", :mail => "j@j.com",
+      :auth_source_id => AuthSourceInternal.first.id,
+      :role_ids => [create_role.id.to_s],
+      :organizations => User.current.organizations,
+      :locations => User.current.locations)
     record.password_hash = "asd"
     assert record.valid?
     assert record.save
     assert_not record.new_record?
   end
 
   test "admin can set admin flag and set any role" do
     as_admin do
       extra_role           = Role.where(:name => "foobar").first_or_create
-      record               = User.new :login    => "dummy", :mail => "j@j.com", :auth_source_id => AuthSourceInternal.first.id,
-                                      :role_ids => [extra_role.id].map(&:to_s)
+      record               = User.new(:login => "dummy", :mail => "j@j.com",
+                                      :auth_source_id => AuthSourceInternal.first.id,
+                                      :role_ids => [extra_role.id.to_s],
+                                      :organizations => User.current.organizations,
+                                      :locations => User.current.locations)
       record.password_hash = "asd"
       record.admin         = true
       assert record.save
       assert record.valid?
       assert_not record.new_record?
@@ -386,10 +395,12 @@ class UserTest < ActiveSupport::TestCase
   end
 
   test "user can save user if he does not change roles" do
     setup_user "edit"
     record = users(:two)
+    record.organizations = User.current.organizations
+    record.locations = User.current.locations
     assert record.save
   end
 
   test "user cannot set admin password" do
     setup_user "edit"
@@ -594,18 +605,17 @@ class UserTest < ActiveSupport::TestCase
       assert_not_empty new_user.errors[:organization_ids]
     end
   end
 
   test "user can't set empty taxonomies set if he's assigned to some" do
-    user = FactoryGirl.create(:user)
     org1 = FactoryGirl.create(:organization)
-    user.organizations << org1
+    user = FactoryGirl.create(:user, :organizations => [org1], :locations => [])
 
-    as_user user do
+    as_user(user) do
       # empty set
-      new_user = FactoryGirl.build(:user)
-      refute new_user.save
+      new_user = FactoryGirl.build(:user, :organizations => [], :locations => [])
+      refute new_user.valid?
       assert_not_empty new_user.errors[:organization_ids]
       assert_empty new_user.errors[:location_ids]
     end
   end
 
@@ -771,12 +781,12 @@ class UserTest < ActiveSupport::TestCase
     u = FactoryGirl.build(:user)
     assert_equal 'authorizer was asked', u.can?(:view_hosts_or_whatever_you_ask)
   end
 
   test 'default taxonomy inclusion validator' do
-    users(:one).default_location = Location.first
-    users(:one).default_organization = Organization.first
+    users(:one).default_location = taxonomies(:location2)
+    users(:one).default_organization = taxonomies(:organization2)
 
     refute users(:one).valid?
     assert users(:one).errors.messages.has_key? :default_location
     assert users(:one).errors.messages.has_key? :default_organization
   end
@@ -788,22 +798,22 @@ class UserTest < ActiveSupport::TestCase
     assert users(:one).valid?
   end
 
   test "return location and child ids for non-admin user" do
     as_user :one do
+      # User 'one' contains location1 already
       in_taxonomy :location1 do
-        assert User.current.locations << Location.current
         assert child = Location.create!(:name => 'child location', :parent_id => Location.current.id)
         assert_equal [Location.current.id, child.id].sort, User.current.location_and_child_ids
       end
     end
   end
 
   test "return organization and child ids for non-admin user" do
     as_user :one do
+      # User 'one' contains organization1 already
       in_taxonomy :organization1 do
-        assert User.current.organizations << Organization.current
         assert child = Organization.create!(:name => 'child organization', :parent_id => Organization.current.id)
         assert_equal [Organization.current.id, child.id].sort, User.current.organization_and_child_ids
       end
     end
   end
diff --git a/test/test_helper.rb b/test/test_helper.rb
index 94b0f2ebc9..2231dd9503 100644
--- a/test/test_helper.rb
+++ b/test/test_helper.rb
@@ -38,11 +38,16 @@ end
   require support_file if File.exist?(support_file)
 end
 
 class ActionController::TestCase
   include ::BasicRestResponseTest
-  setup :setup_set_script_name, :set_api_user, :turn_off_login, :disable_webpack
+  setup :setup_set_script_name, :set_api_user, :turn_off_login,
+    :disable_webpack, :set_admin
+
+  def set_admin
+    User.current = users(:admin)
+  end
 
   def turn_off_login
     SETTINGS[:require_ssl] = false
   end
 
diff --git a/test/unit/has_many_common_test.rb b/test/unit/has_many_common_test.rb
index 421779f5ae..fd885c9aa7 100644
--- a/test/unit/has_many_common_test.rb
+++ b/test/unit/has_many_common_test.rb
@@ -72,10 +72,14 @@ class HasManyCommonTest < ActiveSupport::TestCase
 
   test "should update hostgroup_id by passing existing hostgroup label" do
     host = FactoryGirl.build(:host)
     orig_id = host.hostgroup_id
     host.hostgroup_name = "Parent/inherited"
+    host.hostgroup.subnet.locations = [host.location]
+    host.hostgroup.subnet.organizations = [host.organization]
+    host.hostgroup.subnet6.locations = [host.location]
+    host.hostgroup.subnet6.organizations = [host.organization]
     host.save!
     new_id = host.hostgroup_id
     refute_equal orig_id, new_id
   end
 
diff --git a/test/unit/puppet_class_importer_test.rb b/test/unit/puppet_class_importer_test.rb
index b56a1134e5..a6ffd4e26d 100644
--- a/test/unit/puppet_class_importer_test.rb
+++ b/test/unit/puppet_class_importer_test.rb
@@ -210,19 +210,19 @@ class PuppetClassImporterTest < ActiveSupport::TestCase
     test 'from one environment' do
       lks = FactoryGirl.create_list(:puppetclass_lookup_key, 2, :as_smart_class_param, :puppetclass => @pc)
       get_an_instance.send(:update_classes_in_foreman, @envs.first.name,
                            {@pc.name => {'obsolete' => [lks.first.key]}})
       assert_equal [@envs.last], lks.first.environments
-      assert_equal @envs, lks.last.environments
+      assert_equal @envs.to_a.sort, lks.last.environments.to_a.sort
     end
 
     test 'when overridden' do
       lks = FactoryGirl.create_list(:puppetclass_lookup_key, 2, :as_smart_class_param, :with_override, :puppetclass => @pc)
       get_an_instance.send(:update_classes_in_foreman, @envs.first.name,
                            {@pc.name => {'obsolete' => [lks.first.key]}})
       assert_equal [@envs.last], lks.first.environments
-      assert_equal @envs, lks.last.environments
+      assert_equal @envs.to_a.sort, lks.last.environments.sort
     end
 
     test 'deletes the key from all environments' do
       lks = FactoryGirl.create_list(:puppetclass_lookup_key, 2, :as_smart_class_param, :with_override, :puppetclass => @pc)
       lval = lks.first.lookup_values.first
@@ -230,11 +230,11 @@ class PuppetClassImporterTest < ActiveSupport::TestCase
                            {@pc.name => {'obsolete' => [lks.first.key]}})
       get_an_instance.send(:update_classes_in_foreman, @envs.last.name,
                            {@pc.name => {'obsolete' => [lks.first.key]}})
       refute PuppetclassLookupKey.find_by_id(lks.first.id)
       refute LookupValue.find_by_id(lval.id)
-      assert_equal @envs, lks.last.environments
+      assert_equal @envs.to_a.sort, lks.last.environments.to_a.sort
     end
   end
 
   private
 
diff --git a/test/unit/sso/basic_test.rb b/test/unit/sso/basic_test.rb
index 3c7ebcdf27..c156bfc1d8 100644
--- a/test/unit/sso/basic_test.rb
+++ b/test/unit/sso/basic_test.rb
@@ -10,10 +10,11 @@ class BasicTest < ActiveSupport::TestCase
     basic = SSO::Basic.new(get_basic_controller(false))
     assert !basic.available?
   end
 
   test 'authenticates if user.current is not set' do
+    User.current = nil
     basic = SSO::Basic.new(get_basic_controller(true))
     assert_equal 'testuser', basic.authenticated?
   end
 
   test 'does not reauthenticate if user.current is set' do
diff --git a/test/unit/tasks/seeds_test.rb b/test/unit/tasks/seeds_test.rb
index c2ae08f809..45c09ae6b7 100644
--- a/test/unit/tasks/seeds_test.rb
+++ b/test/unit/tasks/seeds_test.rb
@@ -13,11 +13,12 @@ class SeedsTest < ActiveSupport::TestCase
     Foreman.stubs(:in_rake?).returns(true)
   end
 
   def seed
     # Authorisation is disabled usually when run from a rake db:* task
-    User.current = FactoryGirl.build(:user, :admin => true)
+    User.current = FactoryGirl.build(:user, :admin => true,
+                                     :organizations => [], :locations => [])
     load File.expand_path('../../../../db/seeds.rb', __FILE__)
   end
 
   teardown do
     User.current = nil
@@ -44,99 +45,100 @@ class SeedsTest < ActiveSupport::TestCase
     end
   end
 
   context 'populating an initial admin user' do
     test 'with defaults' do
-      assert_difference 'User.where(:login => "admin").count', 1 do
+      assert_difference 'User.unscoped.where(:login => "admin").count', 1 do
         seed
       end
-      user = User.find_by_login('admin')
+      user = User.unscoped.find_by_login('admin')
       assert user.password_hash.present?
       assert user.password_salt.present?
       assert user.admin?
       assert_valid user
     end
 
     test 'with environment overrides' do
-      assert_difference 'User.where(:login => "seed_test").count', 1 do
+      assert_difference 'User.unscoped.where(:login => "seed_test").count', 1 do
         with_env('SEED_ADMIN_USER'       => 'seed_test',
                  'SEED_ADMIN_PASSWORD'   => 'seed_secret',
                  'SEED_ADMIN_FIRST_NAME' => 'Seed',
                  'SEED_ADMIN_LAST_NAME'  => 'Test',
                  'SEED_ADMIN_EMAIL'      => 'seed@example.net') do
           seed
         end
       end
-      user = User.find_by_login('seed_test')
+      user = User.unscoped.find_by_login('seed_test')
       assert user.matching_password? 'seed_secret'
       assert user.admin?
       refute user.hidden?
       assert_valid user
     end
   end
 
   test 'populates partition tables' do
-    count = Ptable.count
+    count = Ptable.unscoped.count
     seed
-    assert_not_equal count, Ptable.count
-    refute Ptable.where(:os_family => nil).any?
+    assert_not_equal count, Ptable.unscoped.count
+    refute Ptable.unscoped.where(:os_family => nil).any?
   end
 
   test 'populates installation media' do
-    count = Medium.count
+    count = Medium.unscoped.count
     seed
-    assert_not_equal count, Medium.count
-    refute Medium.where(:os_family => nil).any?
+    assert_not_equal count, Medium.unscoped.count
+    refute Medium.unscoped.where(:os_family => nil).any?
   end
 
   test 'populates config templates' do
-    count = ProvisioningTemplate.count
+    count = ProvisioningTemplate.unscoped.count
     seed
-    assert_not_equal count, ProvisioningTemplate.count
+    assert_not_equal count, ProvisioningTemplate.unscoped.count
 
     Dir["#{Rails.root}/app/views/unattended/**/*.erb"].each do |tmpl|
       if tmpl =~ /disklayout/
-        assert Ptable.where(:template => File.read(tmpl)).any?, "No partition table containing #{tmpl}"
+        assert Ptable.unscoped.where(:template => File.read(tmpl)).any?, "No partition table containing #{tmpl}"
       else
-        assert ProvisioningTemplate.where(:template => File.read(tmpl)).any?, "No template containing #{tmpl}"
+        assert ProvisioningTemplate.unscoped.where(:template => File.read(tmpl)).any?, "No template containing #{tmpl}"
       end
     end
   end
 
   test 'populates bookmarks' do
-    count = Bookmark.where(:public => true).count
+    count = Bookmark.unscoped.where(:public => true).count
     seed
-    assert_not_equal count, Bookmark.where(:public => true).count
+    assert_not_equal count, Bookmark.unscoped.where(:public => true).count
   end
 
   test 'is idempotent' do
     seed
     ActiveRecord::Base.any_instance.expects(:save).never
     seed
   end
 
   test "does update template that was not modified by user" do
     seed
-    ProvisioningTemplate.without_auditing { ProvisioningTemplate.find_by_name('Kickstart default').update_attributes(:template => 'test') }
+    ProvisioningTemplate.without_auditing { ProvisioningTemplate.unscoped.find_by_name('Kickstart default').update_attributes(:template => 'test') }
     seed
-    refute_equal ProvisioningTemplate.find_by_name('Kickstart default').template, 'test'
+    refute_equal ProvisioningTemplate.unscoped.find_by_name('Kickstart default').template, 'test'
   end
 
   test "doesn't add a template back that was deleted" do
     seed
-    assert_equal 1, ProvisioningTemplate.destroy_all(:name => 'Kickstart default').size
+    assert_equal 1, ProvisioningTemplate.unscoped.
+      destroy_all(:name => 'Kickstart default').size
     seed
-    refute ProvisioningTemplate.find_by_name('Kickstart default')
+    refute ProvisioningTemplate.unscoped.find_by_name('Kickstart default')
   end
 
   test "doesn't add a template back that was renamed" do
     seed
-    tmpl = ProvisioningTemplate.find_by_name('Kickstart default')
+    tmpl = ProvisioningTemplate.unscoped.find_by_name('Kickstart default')
     tmpl.name = 'test'
     tmpl.save!
     seed
-    refute ProvisioningTemplate.find_by_name('Kickstart default')
+    refute ProvisioningTemplate.unscoped.find_by_name('Kickstart default')
   end
 
   test "no audits are recorded" do
     seed
     assert_equal [], Audit.all
@@ -145,35 +147,35 @@ class SeedsTest < ActiveSupport::TestCase
   test "seed organization when environment SEED_ORGANIZATION specified" do
     Organization.stubs(:any?).returns(false)
     with_env('SEED_ORGANIZATION' => 'seed_test') do
       seed
     end
-    assert Organization.find_by_name('seed_test')
+    assert Organization.unscoped.find_by_name('seed_test')
   end
 
   test "don't seed organization when an org already exists" do
     Organization.stubs(:any?).returns(true)
     with_env('SEED_ORGANIZATION' => 'seed_test') do
       seed
     end
-    refute Organization.find_by_name('seed_test')
+    refute Organization.unscoped.find_by_name('seed_test')
   end
 
   test "seed location when environment SEED_LOCATION specified" do
     Location.stubs(:any?).returns(false)
     with_env('SEED_LOCATION' => 'seed_test') do
       seed
     end
-    assert Location.find_by_name('seed_test')
+    assert Location.unscoped.find_by_name('seed_test')
   end
 
   test "don't seed location when a location already exists" do
     Location.stubs(:any?).returns(true)
     with_env('SEED_LOCATION' => 'seed_test') do
       seed
     end
-    refute Location.find_by_name('seed_test')
+    refute Location.unscoped.find_by_name('seed_test')
   end
 
   test "all access permissions are created by permissions seed" do
     seed
     access_permissions = Foreman::AccessControl.permissions.reject(&:public?).reject(&:plugin?).map(&:name).map(&:to_s)
@@ -185,8 +187,8 @@ class SeedsTest < ActiveSupport::TestCase
   end
 
   test "viewer role contains all view permissions" do
     seed
     view_permissions = Permission.all.select { |permission| permission.name.match(/view/) }
-    assert_equal [], view_permissions - Role.find_by_name('Viewer').permissions
+    assert_equal [], view_permissions - Role.unscoped.find_by_name('Viewer').permissions
   end
 end

Vulnerable code:     allowed_smart_proxies = features.blank? ? SmartProxy.all : SmartProxy.with_features(*features)
  def auth_smart_proxy(proxies = SmartProxy.all, require_cert = true)
    if !request.post? && params[:status].blank? && User.exists?(session[:user].presence)
    taxonomy_join_table = :taxable_taxonomies
    has_many taxonomy_join_table.to_sym, :dependent => :destroy, :as => :taxable
             :through => taxonomy_join_table, :source => :taxonomy,
             :through => taxonomy_join_table, :source => :taxonomy,
      scope = block_given? ? yield : where('1=1')
      if SETTINGS[:locations_enabled] && loc.present?
        inner_ids_loc = if Location.ignore?(self.to_s)
                          self.unscoped.pluck("#{table_name}.id")
                        else
                          inner_select(loc, inner_method)
                        end
      if SETTINGS[:organizations_enabled] && org.present?
        inner_ids_org = if Organization.ignore?(self.to_s)
                          self.unscoped.pluck("#{table_name}.id")
                        else
                          inner_select(org, inner_method)
                        end
      end
      inner_ids   = inner_ids_loc & inner_ids_org if (inner_ids_loc && inner_ids_org)
      inner_ids ||= inner_ids_loc if inner_ids_loc
      inner_ids ||= inner_ids_org if inner_ids_org
      # In the case of users we want the taxonomy scope to get both the users of the taxonomy and admins.
      inner_ids.concat(admin_ids) if inner_ids && self == User
      inner_ids
      conditions[:organization_id] = Array(org).map { |o| o.subtree_ids }.flatten.uniq if org.present?
      conditions[:location_id] = Array(loc).map { |l| l.subtree_ids }.flatten.uniq if loc.present?
      User.except_hidden.find_by_login(self.user)
          User.find_by_login(user_name).tap do |obj|
      ids[col] = Array(taxonomy.send(col))
      ids["#{taxonomy_type.tableize.singularize}_ids"] = taxonomy_type.constantize.pluck(:id)
      ids[col] = populate_values ? Array(self.send(col)) : []
    Audit.unscoped.where("user_id NOT IN (?)", User.pluck(:id)).update_all(:user_id => nil)
    Domain.where("dns_id NOT IN (?)", SmartProxy.pluck(:id)).update_all(:dns_id => nil)
    Subnet.where("dhcp_id NOT IN (?)", SmartProxy.pluck(:id)).update_all(:dhcp_id => nil)
    Subnet.where("dns_id NOT IN (?)", SmartProxy.pluck(:id)).update_all(:dns_id => nil)
    Subnet.where("tftp_id NOT IN (?)", SmartProxy.pluck(:id)).update_all(:tftp_id => nil)
    Image.where("architecture_id NOT IN (?)", Architecture.pluck(:id)).update_all(:architecture_id => nil)
    Image.where("compute_resource_id NOT IN (?)", ComputeResource.pluck(:id)).update_all(:compute_resource_id => nil)
    Nic::Base.where("domain_id NOT IN (?)", Domain.pluck(:id)).update_all(:domain_id => nil)
    Nic::Base.where("host_id NOT IN (?)", Host::Base.pluck(:id)).update_all(:host_id => nil)
    Nic::Base.where("subnet_id NOT IN (?)", Subnet.pluck(:id)).update_all(:subnet_id => nil)
    OsDefaultTemplate.where("config_template_id NOT IN (?)", FakeConfigTemplate.pluck(:id)).update_all(:config_template_id => nil)
    OsDefaultTemplate.where("template_kind_id NOT IN (?)", TemplateKind.pluck(:id)).update_all(:template_kind_id => nil)
    TemplateCombination.where("config_template_id NOT IN (?)", FakeConfigTemplate.pluck(:id)).update_all(:config_template_id => nil)
    TemplateCombination.where("environment_id NOT IN (?)", Environment.pluck(:id)).update_all(:environment_id => nil)
  kinds[type] = TemplateKind.find_by_name(type)
  kinds[type] ||= TemplateKind.create(:name => type)
organizations = Organization.all
locations = Location.all
    { :name => 'pxelinux_discovery', :source => 'snippets/_pxelinux_discovery.erb', :snippet => true },
    if (t = ProvisioningTemplate.find_by_name(input[:name])) && !audit_modified?(ProvisioningTemplate, input[:name])
organizations = Organization.all
locations = Location.all
    if (p = Ptable.find_by_name(input[:name])) && !audit_modified?(Ptable, input[:name])
os_suse = Operatingsystem.where(:type => "Suse") || Operatingsystem.where("name LIKE ?", "suse")
    next if Medium.where(['name = ? OR path = ?', input[:name], input[:path]]).any?
      permission = Permission.find_by_name("#{operation}_#{type}") || FactoryGirl.create(:permission, :name => "#{operation}_#{type}")
    assert_difference('AuthSourceLdap.count', 1) do
    assert_difference('AuthSourceLdap.count', -1) do
    assert_equal "new_description", ComputeResource.find_by_name('mycompute').description
    assert_difference('ComputeResource.count', -1) do
    assert_equal "new_description", ComputeResource.find_by_name('mycompute').description
    assert_difference('ComputeResource.count', -1) do
    assert ProvisioningTemplate.exists?(config_template.id)
    refute ProvisioningTemplate.exists?(config_template.id)
    put :update, { :id => Domain.first.to_param, :domain => { :name => "domain.new" } }
    assert_equal "domain.new", Domain.first.name
    assert_difference('Environment.count') do
    assert_difference('Environment.count', -1) do
    assert_difference('Hostgroup.count') do
    assert_difference('Hostgroup.count', -1) do
    assert_no_difference('Hostgroup.count') do
    assert_difference('Hostgroup.count') do
    assert_equal hostgroups(:common).id.to_s, Hostgroup.find_by_name("db").ancestry
    assert_difference('Medium.count', +1) do
    assert_difference('Medium.count', -1) do
    assert_difference('Ptable.count') do
    assert_difference('Ptable.count', -0) do
    assert_difference('Ptable.count', -1) do
    assert_difference('SmartProxy.count') do
    assert_difference('SmartProxy.count', -1) do
    assert_difference('Environment.count', 2) do
        assert_difference('Puppetclass.count', 1) do
      assert_difference('Puppetclass.count', 0) do
    assert_difference('Environment.count', -1) do
      assert_difference('Environment.find_by_name("env1").puppetclasses.count', -2) do
    assert_difference('LookupKey.count', 1) do
    assert_difference('Environment.count', 0) do
      assert_difference('Environment.count', 1) do
    assert_difference('Subnet::Ipv4.count') do
    assert_equal 'Subnet::Ipv4', Subnet.find_by_name('QA2').type
    assert_difference('Subnet::Ipv6.count') do
    assert_equal 'Subnet::Ipv6', Subnet.find_by_name('QA2').type
    assert_difference('Subnet.count', -1) do
    assert_difference('Subnet.count', 0) do
    mod_user = User.find_by_id(user.id)
    assert User.find_by_id(user.id).admin?
    mod_user = User.find_by_id(user.id)
    mod_user = User.find_by_id(user.id)
    mod_user = User.find_by_id(user.id)
    assert !User.exists?(user.id)
      assert User.exists?(user.id)
      assert User.find_by_login('new_admin').admin?
  test "#update should allow updating mysel without any special permissions" do
    assert_difference('AuthSourceLdap.count', 1) do
    assert_difference('AuthSourceLdap.count', -1) do
    assert_equal "new_description", ComputeResource.find_by_name('mycompute').description
    assert_difference('ComputeResource.count', -1) do
    assert_equal "new_description", ComputeResource.find_by_name('mycompute').description
    assert_difference('ComputeResource.count', -1) do
      post :create, {:config_report => create_a_puppet_transaction_report }
      assert_equal 403, @response.status
      assert_equal 403, @response.status
      assert_equal 403, @response.status
      assert_equal 403, @response.status
    refute Report.find_by_id(report.id)
    assert ProvisioningTemplate.exists?(config_template.id)
    refute ProvisioningTemplate.exists?(config_template.id)
    assert_equal "domain.new", Domain.first.name
    assert_equal 2, assigns(:domains).length
    assert_equal assigns(:domains), [domains(:mydomain), domains(:yourdomain)]
    assert_equal 1, assigns(:domains).length
    assert_equal assigns(:domains), [domains(:mydomain)]
    assert_difference('Environment.count') do
    assert_difference('Environment.count', -1) do
    assert_difference('Hostgroup.count') do
    assert_difference('Hostgroup.count', -1) do
    assert_difference('Hostgroup.count') do
    assert_no_difference('Hostgroup.count') do
    assert_difference('Hostgroup.count') do
    assert_equal hostgroups(:common).id.to_s, Hostgroup.find_by_name("db").ancestry
    assert_equal compute_attrs.vm_interfaces.count, last_record.interfaces.count
    assert_equal expected_compute_attributes(compute_attrs, 0), last_record.interfaces.find_by_mac('00:11:22:33:44:00').compute_attributes
    assert_equal expected_compute_attributes(compute_attrs, 1), last_record.interfaces.find_by_mac('00:11:22:33:44:01').compute_attributes
    @host.interfaces.reload
    assert_equal compute_attrs.vm_interfaces.count, @host.interfaces.count
    assert_equal expected_compute_attributes(compute_attrs, 0), @host.interfaces.find_by_primary(true).compute_attributes
    assert_equal expected_compute_attributes(compute_attrs, 1), @host.interfaces.find_by_primary(false).compute_attributes
    assert_equal hostgroup, Host.find_by(:name => hostname).hostgroup
    assert_difference('Location.count', -1) do
    assert_difference('Location.count', -1) do
    @location.ignore_types = ["Hostgroup", "Environment", "User", "Medium", "Subnet", "SmartProxy", "ProvisioningTemplate", "ComputeResource", "Realm"]
        put :update, { :id => @location.to_param, :location => { :domain_ids => Domain.pluck(:id) } }
    assert_difference('Medium.count', +1) do
    assert_difference('Medium.count', -1) do
    assert_equal '123', Host.find_by_name(@host.name).parameters.order("parameters.updated_at").last.value
    assert_equal Domain.find_by_name("mydomain.net").parameters.order("parameters.updated_at").last.value, "123"
    assert_equal Subnet.find_by_name("five").parameters.order("parameters.updated_at").last.value, "123"
    assert_equal Hostgroup.find_by_name("Common").group_parameters.order("parameters.updated_at").last.value, "123"
    assert_equal Operatingsystem.find_by_name("Redhat").parameters.order("parameters.updated_at").last.value, "123"
    assert ProvisioningTemplate.exists?(provisioning_template.id)
    refute ProvisioningTemplate.exists?(provisioning_template.id)
    assert_difference('Ptable.count') do
    assert_difference('Ptable.count') do
    assert_difference('Ptable.count', -0) do
    assert_difference('Ptable.count', -1) do
    put :update, { :id => Realm.first.to_param, :realm => { :name => "realm.new" } }
    assert_equal "realm.new", Realm.first.name
    refute Realm.find_by_id(realm['id'])
    assert_equal 2, assigns(:realms).length
    assert_equal assigns(:realms), [realms(:myrealm), realms(:yourrealm)]
    assert_equal 1, assigns(:realms).length
    assert_equal assigns(:realms), [realms(:myrealm)]
    expected_proxy_ids = SmartProxy.with_features("TFTP").map { |p| p.id }
    expected_proxy_ids = SmartProxy.with_features("TFTP").map { |p| p.id }
    assert_difference('SmartProxy.count') do
    assert_difference('SmartProxy.count', -1) do
    assert_difference('Environment.count', 2) do
        assert_difference('Puppetclass.count', 1) do
      assert_difference('Puppetclass.count', 0) do
    assert_difference('Environment.count', -1) do
      assert_difference('Environment.find_by_name("env1").puppetclasses.count', -2) do
    assert_difference('LookupKey.count', 1) do
    assert_difference('Environment.count', 0) do
      assert_difference('Environment.count', 1) do
    assert_difference('Environment.count', 0) do
    assert_difference('LookupKey.count', 0) do
     post :import_puppetclasses, {:id => smart_proxies(:puppetmaster).id, :except => 'new,updated'}, set_session_user
      assert_difference('Puppetclass.count', 1) do
      assert_difference('Puppetclass.count', 2) do
    assert_difference('Subnet.count') do
    assert_difference('Subnet.count') do
    subnet = Subnet.find_by_name(valid_v4_attrs[:name])
    assert_difference('Subnet.count') do
    assert_difference('Subnet.count', -1) do
    assert_difference('Subnet.count', 0) do
    mod_user = User.find_by_id(user.id)
    assert User.find_by_id(user.id).admin?
    mod_user = User.find_by_id(user.id)
    mod_user = User.find_by_id(user.id)
    mod_user = User.find_by_id(user.id)
    assert !User.exists?(user.id)
      assert User.exists?(user.id)
      user = FactoryGirl.create(:user)
      get :index, {}, set_session_user.merge(:user => user.id)
      assert_redirected_to edit_user_path(user)
    @model = AuthSourceLdap.first
    post :create, {:auth_source_ldap => {:name => AuthSourceLdap.first.name}}, set_session_user
    put :update, {:id => AuthSourceLdap.first, :auth_source_ldap => {:name => AuthSourceLdap.first.name} }, set_session_user
    put :update, {:id => AuthSourceLdap.first.id, :format => "weird", :auth_source_ldap => {:name => AuthSourceLdap.first.name} }, set_session_user
    wierd_id = "#{AuthSourceLdap.first.id}.weird"
    put :update, {:id => wierd_id, :auth_source_ldap => {:name => AuthSourceLdap.first.name} }, set_session_user
    parameterized_id = "#{AuthSourceLdap.first.id}-#{AuthSourceLdap.first.name.parameterize}"
    put :update, {:id => parameterized_id, :auth_source_ldap => {:name => AuthSourceLdap.first.name} }, set_session_user
    put :update, {:id => AuthSourceLdap.first, :auth_source_ldap => {:name => AuthSourceLdap.first.name} }, set_session_user
    auth_source_ldap = AuthSourceLdap.first
    User.where(:auth_source_id => auth_source_ldap.id).update_all(:auth_source_id => nil)
    assert !AuthSourceLdap.exists?(auth_source_ldap.id)
      get :edit, { :id => AuthSourceLdap.first.id },
    auth_source_ldap = AuthSourceLdap.find(auth_source_ldap.id)
    put :test_connection, {:id => AuthSourceLdap.first, :auth_source_ldap => {:name => AuthSourceLdap.first.name} }, set_session_user
    put :test_connection, {:id => AuthSourceLdap.first, :auth_source_ldap => {:name => AuthSourceLdap.first.name} }, set_session_user
    auth_source_ldap_params = { :name => AuthSourceLdap.first.name,
    put :update, { :id => AuthSourceLdap.first,
      AuthSourceLdap.first.organizations.to_a
      AuthSourceLdap.first.locations.to_a
    assert_difference('ComputeResource.count', 0) do
    assert_difference('ComputeResource.count', +1) do
    @compute_resource = ComputeResource.find(@compute_resource.id)
    @compute_resource = ComputeResource.find(@compute_resource.id)
    assert_difference('ComputeResource.count', 0) do
    assert_difference('ComputeResource.count', 0) do
    assert_difference('ComputeResource.count', -1) do
    @model = Domain.first
    put :update, {:id => Domain.first.to_param, :domain => {:name => Domain.first.name }}, set_session_user
    put :update, {:id => Domain.first.to_param, :domain => {:name => Domain.first.name }}, set_session_user
    domain = Domain.first
    get :edit, {:id => Domain.first.id}
    assert_difference 'Environment.count' do
    env = Environment.find(environment.id)
    assert_difference('Environment.count', -1) do
    assert Environment.find_by_name("env1").puppetclasses.map(&:name).sort == ["a", "b", "c"]
    envs = Environment.find_by_name("env1").puppetclasses.map(&:name).sort
    assert envs == ["a", "b", "c"]
    assert Environment.find_by_name("env3").puppetclasses.map(&:name).sort == []
        {"obsolete" =>
          {"env1"  => '["a","b","c","_destroy_"]'}
        }
      }, set_session_user
    assert Environment.find_by_name("env1").hosts.count > 0
    assert Environment.find_by_name("env1")
         {"changed" =>
              {"new" =>
                   {"new" => '{"a":{"new":{}}}'}
              }
         }, set_session_user
    assert(Environment.all.map(&:name).include?('new'), 'Should include environment with name "new"')
    users(:one).roles = [Role.default, Role.find_by_name('Viewer')]
    get :nest, {:id => Hostgroup.first.id}, set_session_user
    get :clone, {:id => Hostgroup.first}, set_session_user
    get :edit, {:id => Hostgroup.first}, set_session_user
    put :update, {:id => Hostgroup.first, :hostgroup => { :name => '' }}, set_session_user
    put :update, {:id => Hostgroup.first, :hostgroup => { :name => Hostgroup.first.name }}, set_session_user
    get :edit, {:id => Hostgroup.first.id}, set_session_user.merge(:user => users(:one).id)
    assert_equal @response.status, 403
    xhr :post, :domain_selected, {:id => Hostgroup.first, :hostgroup => {}, :domain_id => domain.id, :format => :json}, set_session_user
    xhr :post, :domain_selected, {:id => Hostgroup.first, :hostgroup => {}, :format => :json, :domain_id => nil}, set_session_user
    post :architecture_selected, {:id => Hostgroup.first, :hostgroup => {}, :architecture_id => nil}, set_session_user
      hostgroup = Hostgroup.where(:name => "test_it").last
      assert_equal "overridden", hostgroup.parameters["x"]
      child.reload
      assert_equal "overridden", child.parameters["x"]
      child.reload
      assert_equal "overridden", child.parameters["y"]
      assert_equal "", child.parameters["x"]
    assert_difference 'Host.count' do
    assert_difference 'Host.count' do
    assert_difference('Host.count', -1) do
    hosts.map! {|h| Host.find(h.id)}
    hosts.each { |host| assert_equal hostgroup, host.hostgroup }
      host = Host.find_by_name name
      assert_not_nil host
      assert_equal host.hostgroup, hostgroup
    assert_equal environments(:global_puppetmaster), Host.find(@host1.id).environment
    assert_equal environments(:global_puppetmaster), Host.find(@host2.id).environment
    assert Host.find(@host1.id).environment == hostgroup.environment
    assert Host.find(@host2.id).environment == hostgroup.environment
    assert_equal users(:one).id_and_type, Host.find(@host1.id).is_owned_by
    assert_equal users(:one).id_and_type, Host.find(@host2.id).is_owned_by
        assert_equal proxy, host.reload.puppet_ca_proxy
    host = Host.first
    assert_difference "location.hosts.count", (Host.count - cnt_hosts_location) do
    assert_difference "organization.hosts.count", (Host.count - cnt_hosts_organization) do
    assert_difference('Image.count') do
    assert_redirected_to compute_resource_path(@image.compute_resource)
    assert_redirected_to compute_resource_path(@image.compute_resource)
    assert_redirected_to compute_resource_path(@image.compute_resource)
  test "should clone location with assocations" do
    assert_difference "Location.count", 1 do
      post :create, {:location => {:name => "location_dup_name",
                                 :environment_ids => location_dup.environment_ids,
                                 :hostgroup_ids => location_dup.hostgroup_ids,
                                 :subnet_ids => location_dup.hostgroup_ids,
                                 :domain_ids => location_dup.domain_ids,
                                 :medium_ids => location_dup.medium_ids,
                                 :user_ids => location_dup.user_ids,
                                 :smart_proxy_ids => location_dup.smart_proxy_ids,
                                 :provisioning_template_ids => location_dup.provisioning_template_ids,
                                 :compute_resource_ids => location_dup.compute_resource_ids,
                                 :organization_ids => location_dup.organization_ids
                               }
                   }, set_session_user
    assert_equal new_location.environment_ids.sort, location.environment_ids.sort
    assert_equal new_location.hostgroup_ids.sort, location.hostgroup_ids.sort
    assert_equal new_location.environment_ids.sort, location.environment_ids.sort
    assert_equal new_location.domain_ids.sort, location.domain_ids.sort
    assert_equal new_location.medium_ids.sort, location.medium_ids.sort
    assert_equal new_location.user_ids.sort, location.user_ids.sort
    assert_equal new_location.smart_proxy_ids.sort, location.smart_proxy_ids.sort
    assert_equal new_location.provisioning_template_ids.sort, location.provisioning_template_ids.sort
    assert_equal new_location.compute_resource_ids.sort, location.compute_resource_ids.sort
    assert_equal new_location.organization_ids.sort, location.organization_ids.sort
    put :update, {:id => Medium.first, :medium => {:name => nil}}, set_session_user
    put :update, {:id => Medium.first, :medium => {:name => "MyUpdatedMedia"}}, set_session_user
    get :edit, {:id => Medium.first.id}, set_session_user.merge(:user => users(:one).id)
  test "should clone organization with assocations" do
    assert_difference "Organization.count", 1 do
      post :create, {:organization => {:name => "organization_dup_name",
                                       :environment_ids => organization_dup.environment_ids,
                                       :hostgroup_ids => organization_dup.hostgroup_ids,
                                       :subnet_ids => organization_dup.hostgroup_ids,
                                       :domain_ids => organization_dup.domain_ids,
                                       :medium_ids => organization_dup.medium_ids,
                                       :user_ids => organization_dup.user_ids,
                                       :smart_proxy_ids => organization_dup.smart_proxy_ids,
                                       :provisioning_template_ids => organization_dup.provisioning_template_ids,
                                       :compute_resource_ids => organization_dup.compute_resource_ids,
                                       :location_ids => organization_dup.location_ids
      }
    assert_equal new_organization.environment_ids.sort, organization.environment_ids.sort
    assert_equal new_organization.hostgroup_ids.sort, organization.hostgroup_ids.sort
    assert_equal new_organization.environment_ids.sort, organization.environment_ids.sort
    assert_equal new_organization.domain_ids.sort, organization.domain_ids.sort
    assert_equal new_organization.medium_ids.sort, organization.medium_ids.sort
    assert_equal new_organization.user_ids.sort, organization.user_ids.sort
    assert_equal new_organization.smart_proxy_ids.sort, organization.smart_proxy_ids.sort
    assert_equal new_organization.provisioning_template_ids.sort, organization.provisioning_template_ids.sort
    assert_equal new_organization.compute_resource_ids.sort, organization.compute_resource_ids.sort
    assert_equal new_organization.location_ids.sort, organization.location_ids.sort
    assert_equal ProvisioningTemplate.find(templates(:pxekickstart).id).locked, true
    assert_equal ProvisioningTemplate.find(templates(:locked).id).locked, false
    assert ProvisioningTemplate.exists?(config_template.id)
    assert !ProvisioningTemplate.exists?(config_template.id)
      assert_difference('TemplateCombination.count', 1) do
        assert_difference('ProvisioningTemplate.count', 1) do
        @template_combination.reload
        assert_equal new_environment, @template_combination.environment
    lookup_keys_added = overridable_lookup_keys(puppetclass, assigns(:obj))
    assert_equal 1, lookup_keys_added.count
    assert lookup_keys_added.map(&:key).include?("special_info")
    refute lookup_keys_added.map(&:key).include?("custom_class_param")
    lookup_keys_added = overridable_lookup_keys(puppetclass, hostgroup)
    assert_equal 2, lookup_keys_added.count
    assert lookup_keys_added.map(&:key).include?("special_info")
    assert lookup_keys_added.map(&:key).include?("custom_class_param")
    lookup_keys_added = overridable_lookup_keys(puppetclass, host)
    assert_equal 2, lookup_keys_added.count
    assert lookup_keys_added.map(&:key).include?("special_info")
    assert lookup_keys_added.map(&:key).include?("custom_class_param")
    lookup_keys_added = overridable_lookup_keys(puppetclass, hostgroup)
    assert_equal 2, lookup_keys_added.count
    assert lookup_keys_added.map(&:key).include?("special_info")
    assert lookup_keys_added.map(&:key).include?("custom_class_param")
    env = FactoryGirl.create(:environment)
    env = FactoryGirl.create(:environment)
    put :update, {:id => Realm.first.name,
                  :realm => { :realm_proxy_id => SmartProxy.first.id } }, set_session_user
    assert_equal SmartProxy.first.id, Realm.first.realm_proxy_id
    put :update, {:id => SmartProxy.first,:smart_proxy => {:url => "http://elsewhere.com:8443"}}, set_session_user
    assert_equal "http://elsewhere.com:8443", SmartProxy.first.url
    @model = Subnet.first
    put :update, {:id => Subnet.first, :subnet => {:network => nil}}, set_session_user
    put :update, {:id => Subnet.first, :subnet => {:network => '192.168.100.10'}}, set_session_user
    assert_equal '192.168.100.10', Subnet.first.network
    assert Subnet.exists?(subnet.id)
    subnet = Subnet.first
    subnet.hosts.clear
    subnet.interfaces.clear
    subnet.domains.clear
    delete :destroy, {:id => subnet}, set_session_user
    assert !Subnet.exists?(subnet.id)
    assert_difference 'Subnet.count', 1 do
    user = FactoryGirl.create(:user, :with_mail, :admin => false)
    FactoryGirl.create(:filter, :role => user.roles.first, :permissions => Permission.where(:name => 'view_hosts'), :search => "name = #{@rh_host.name}")
    FactoryGirl.create(:filter, :role => user.roles.first, :permissions => Permission.where(:name => 'view_hosts'), :search => "name = does_not_exist")
    refute User.find_by_login('foo').admin
    assert User.find_by_login('foo').admin
    mod_user = User.find_by_id(user.id)
    user = User.find_by_id(user.id)
    mod_user = User.find_by_id(user.id)
    mod_user = User.find_by_id(user.id)

    assert User.exists?(user.id)
    assert !User.find_by_login(user.login).mail.blank?
    assert_redirected_to edit_user_path(User.find_by_login('ares'))
    get :edit, { :id => users(:two) }
    put :update, { :id => users(:two).id, :user => { :firstname => 'test' } }
    user = User.find_by_login('ldap-user')
      updated_user = User.find(users(:one).id)
  def setup_user
    @request.session[:user] = users(:one).id
    users(:one).roles       = [Role.default, Role.find_by_name('Viewer')]
  end

    setup_user
    setup_user
      location
      organization
one:
  taxonomy: location1
  taxable: one
  taxable_type: "Subnet"

three:
  taxonomy: organization1
  taxable: one
  taxable_type: "Subnet"

ten:
  taxonomy: location1
  taxable: one
  taxable_type: "Medium"

ten2:
  taxonomy: organization1
  taxable: one
  taxable_type: "Medium"

    FactoryGirl.create(:host)
    assert_new_button(locations_path,"New Location",new_location_path)
    FactoryGirl.create(:host)
      users(:one).locations << taxonomies(:location1)
      users(:one).locations << taxonomies(:location1)
      users(:one).organizations << taxonomies(:organization1)
      FactoryGirl.create(:filter, :role => user_role.role, :permissions => Permission.where(:name => 'view_hosts'), :unlimited => true)
    assert_difference('LookupValue.count') do
      :subnet => subnets(:two), :architecture => architectures(:x86_64), :puppet_proxy => smart_proxies(:puppetmaster), :medium => media(:one),
    interface = Nic::Managed.create! :ip => "3.3.4.127", :mac => "cabbccddeeff", :host => FactoryGirl.create(:host), :subnet => subnet, :name => "a" + FactoryGirl.create(:host).name, :domain => domain
      user_role = FactoryGirl.create(:user_user_role)
      FactoryGirl.create(:filter, :role => user_role.role, :permissions => Permission.where(:name => 'view_hosts'), :search => "hostgroup_id = #{@target_host.hostgroup_id}")
      as_user user_role.owner do
        assert_equal @target_reports.map(&:id).sort, Report.my_reports.map(&:id).sort
      end
      assert_equal selected_ids[:subnet_ids].sort, subnet_ids.sort
      assert_equal selected_ids[:medium_ids].sort, medium_ids.sort
      assert_equal selected_ids[:hostgroup_ids], []
      assert_equal selected_ids[:user_ids], [users(:scoped).id]
      assert_equal selected_ids[:compute_resource_ids], [compute_resources(:one).id]
      taxonomy_dup.name = "taxonomy_dup_name"
      assert taxonomy_dup.save!
                                     users(:one)).pluck(:id).sort
      assert_equal parent.selected_ids, taxonomy.inherited_ids
      parent.update_attribute(:domains,[domain1,domain2])
      parent.update_attribute(:subnets,[subnet])
                         :"#{taxonomy_name}"         => parent,
                         :"#{taxonomy_name}"         => parent,
      taxonomy.selected_or_inherited_ids.each do |k,v|
        assert_equal v.sort, parent.used_and_selected_ids[k].sort
    test "multiple inheritence" do
    assert_equal subnet, Subnet::Ipv6.subnet_for(get_ip(subnet, 10))
    assert_match /is being used by/, subnet.errors.full_messages.join("\n")
      user = FactoryGirl.create(:user, :organizations => [@org, org2])
  test ".taxable_ids can work with empty array returning nil" do
    dummy_class = @dummy.class
    assert_nil dummy_class.taxable_ids([], [])
  end
  test ".taxable_ids (and .inner_select) can work with array of taxonomies" do
    loc1 = FactoryGirl.create(:location)
    loc2 = FactoryGirl.create(:location, :parent_id => loc1.id)
    loc3 = FactoryGirl.create(:location, :parent_id => loc2.id)
    loc4 = FactoryGirl.create(:location)
    org = FactoryGirl.create(:organization)
    env1 = FactoryGirl.create(:environment, :organizations => [org], :locations => [loc2])
    env2 = FactoryGirl.create(:environment, :organizations => [org])
    env3 = FactoryGirl.create(:environment, :locations => [loc2])
    env4 = FactoryGirl.create(:environment, :locations => [loc4])
    env5 = FactoryGirl.create(:environment, :locations => [loc1])
    env6 = FactoryGirl.create(:environment, :locations => [loc3])

    taxable_ids = Environment.taxable_ids([loc2, loc4], org, :subtree_ids)
    visible = [ env1 ]
    invisible = [ env2, env3, env4, env5, env6 ]
    visible.each { |env| assert_includes taxable_ids, env.id }
    invisible.each { |env| refute_includes taxable_ids, env.id }

    taxable_ids = Environment.taxable_ids([], org, :subtree_ids)
    visible = [ env1, env2 ]
    invisible = [ env3, env4, env5, env6 ]
    visible.each { |env| assert_includes taxable_ids, env.id }
    invisible.each { |env| refute_includes taxable_ids, env.id }

    taxable_ids = Environment.taxable_ids(loc2, [], :subtree_ids)
    visible = [ env1, env3, env5, env6 ]
    invisible = [ env2, env4 ]
    visible.each { |env| assert_includes taxable_ids, env.id }
    invisible.each { |env| refute_includes taxable_ids, env.id }

    taxable_ids = Environment.taxable_ids([loc2, loc4], [], :subtree_ids)
    visible = [ env1, env3, env4, env5, env6 ]
    invisible = [ env2 ]
    visible.each { |env| assert_includes taxable_ids, env.id }
    invisible.each { |env| refute_includes taxable_ids, env.id }
    used_organizations = user.used_organization_ids
    assert_empty used_organizations
    assert_equal used_organizations.count, 0
    user = FactoryGirl.create(:user)
      assert_not_equal last_login, User.find(user.id).last_login_on
      reloaded_user = User.find(user.id)
    record = User.new :login => "dummy", :mail => "j@j.com", :auth_source_id => AuthSourceInternal.first.id
    record               = User.new :login    => "dummy", :mail => "j@j.com", :auth_source_id => AuthSourceInternal.first.id,
                                    :role_ids => [create_role.id.to_s]
      record               = User.new :login    => "dummy", :mail => "j@j.com", :auth_source_id => AuthSourceInternal.first.id,
                                      :role_ids => [extra_role.id].map(&:to_s)
    user = FactoryGirl.create(:user)
    user.organizations << org1
    as_user user do
      new_user = FactoryGirl.build(:user)
      refute new_user.save
    users(:one).default_location = Location.first
    users(:one).default_organization = Organization.first
        assert User.current.locations << Location.current
        assert User.current.organizations << Organization.current
  setup :setup_set_script_name, :set_api_user, :turn_off_login, :disable_webpack
      assert_equal @envs, lks.last.environments
      assert_equal @envs, lks.last.environments
      assert_equal @envs, lks.last.environments
    User.current = FactoryGirl.build(:user, :admin => true)
      assert_difference 'User.where(:login => "admin").count', 1 do
      user = User.find_by_login('admin')
      assert_difference 'User.where(:login => "seed_test").count', 1 do
      user = User.find_by_login('seed_test')
    count = Ptable.count
    assert_not_equal count, Ptable.count
    refute Ptable.where(:os_family => nil).any?
    count = Medium.count
    assert_not_equal count, Medium.count
    refute Medium.where(:os_family => nil).any?
    count = ProvisioningTemplate.count
    assert_not_equal count, ProvisioningTemplate.count
        assert Ptable.where(:template => File.read(tmpl)).any?, "No partition table containing #{tmpl}"
        assert ProvisioningTemplate.where(:template => File.read(tmpl)).any?, "No template containing #{tmpl}"
    count = Bookmark.where(:public => true).count
    assert_not_equal count, Bookmark.where(:public => true).count
    ProvisioningTemplate.without_auditing { ProvisioningTemplate.find_by_name('Kickstart default').update_attributes(:template => 'test') }
    refute_equal ProvisioningTemplate.find_by_name('Kickstart default').template, 'test'
    assert_equal 1, ProvisioningTemplate.destroy_all(:name => 'Kickstart default').size
    refute ProvisioningTemplate.find_by_name('Kickstart default')
    tmpl = ProvisioningTemplate.find_by_name('Kickstart default')
    refute ProvisioningTemplate.find_by_name('Kickstart default')
    assert Organization.find_by_name('seed_test')
    refute Organization.find_by_name('seed_test')
    assert Location.find_by_name('seed_test')
    refute Location.find_by_name('seed_test')
    assert_equal [], view_permissions - Role.find_by_name('Viewer').permissions
Fixed code:     allowed_smart_proxies = if features.blank?
                              SmartProxy.unscoped.all
                            else
                              SmartProxy.unscoped.with_features(*features)
                            end
  def auth_smart_proxy(proxies = SmartProxy.unscoped.all, require_cert = true)
    if !request.post? && params[:status].blank? && User.unscoped.exists?(session[:user].presence)
  TAXONOMY_JOIN_TABLE = :taxable_taxonomies
    has_many TAXONOMY_JOIN_TABLE, :dependent => :destroy, :as => :taxable
             :through => TAXONOMY_JOIN_TABLE, :source => :taxonomy,
             :through => TAXONOMY_JOIN_TABLE, :source => :taxonomy,
      scope = block_given? ? yield : where(nil)
      return scope unless Taxonomy.enabled_taxonomies.present?
      # Return everything (represented by nil), including objects without
      # taxonomies. This value should only be returned for admin users.
      return nil if any_context?(loc) && any_context?(org) &&
        User.current.try(:admin?)

      ids = unscoped.pluck(:id)
      ids &= inner_ids(loc, Location, inner_method) if SETTINGS[:locations_enabled]
      ids &= inner_ids(org, Organization, inner_method) if SETTINGS[:organizations_enabled]

      if self == User
        # In the case of users we want the taxonomy scope to get both the users
        # of the taxonomy, admins, and the current user.
        ids.concat(admin_ids)
        ids << User.current.id if User.current.present?

      ids
    end

    # Returns the IDs available for the passed context.
    # Passing a nil or [] value as taxonomy equates to "Any context".
    # Any other value will be understood as 'IDs available in this taxonomy'.
    def inner_ids(taxonomy, taxonomy_class, inner_method)
      return unscoped.pluck("#{table_name}.id") if taxonomy_class.ignore?(to_s)
      return inner_select(taxonomy, inner_method) if taxonomy.present?
      return [] unless User.current.present?
      # Any available taxonomy to the current user
      return unscoped.pluck("#{table_name}.id") if User.current.admin?

      taxonomy_relation = taxonomy_class.to_s.underscore.pluralize
      any_context_taxonomies = User.current.
        taxonomy_and_child_ids(:"#{taxonomy_relation}")
      unscoped.joins(TAXONOMY_JOIN_TABLE).
        where("#{TAXONOMY_JOIN_TABLE}.taxonomy_id" => any_context_taxonomies).
        pluck(:id)
    end

    def any_context?(taxonomy)
      taxonomy.blank?
      conditions[:organization_id] = Array(org).map { |o| o.subtree_ids }.flatten.uniq unless org.nil?
      conditions[:location_id] = Array(loc).map { |l| l.subtree_ids }.flatten.uniq unless loc.nil?
      User.unscoped.except_hidden.find_by_login(self.user)
          User.unscoped.find_by_login(user_name).tap do |obj|
      ids[col] = Array(taxonomy.send(col)).uniq
      ids["#{taxonomy_type.tableize.singularize}_ids"] = taxonomy_type.constantize.pluck(:id).uniq
      ids[col] = populate_values ? Array(self.send(col)).uniq : []
    Audit.unscoped.where("user_id NOT IN (?)", User.unscoped.pluck(:id)).update_all(:user_id => nil)
    Domain.where("dns_id NOT IN (?)", SmartProxy.unscoped.pluck(:id)).update_all(:dns_id => nil)
    Subnet.where("dhcp_id NOT IN (?)", SmartProxy.unscoped.pluck(:id)).update_all(:dhcp_id => nil)
    Subnet.where("dns_id NOT IN (?)", SmartProxy.unscoped.pluck(:id)).update_all(:dns_id => nil)
    Subnet.where("tftp_id NOT IN (?)", SmartProxy.unscoped.pluck(:id)).update_all(:tftp_id => nil)
    Image.where("architecture_id NOT IN (?)", Architecture.unscoped.pluck(:id)).update_all(:architecture_id => nil)
    Image.where("compute_resource_id NOT IN (?)", ComputeResource.unscoped.pluck(:id)).update_all(:compute_resource_id => nil)
    Nic::Base.where("domain_id NOT IN (?)", Domain.unscoped.pluck(:id)).update_all(:domain_id => nil)
    Nic::Base.where("host_id NOT IN (?)", Host::Base.unscoped.pluck(:id)).update_all(:host_id => nil)
    Nic::Base.where("subnet_id NOT IN (?)", Subnet.unscoped.pluck(:id)).update_all(:subnet_id => nil)
    OsDefaultTemplate.where("config_template_id NOT IN (?)", FakeConfigTemplate.unscoped.pluck(:id)).update_all(:config_template_id => nil)
    OsDefaultTemplate.where("template_kind_id NOT IN (?)", TemplateKind.unscoped.pluck(:id)).update_all(:template_kind_id => nil)
    TemplateCombination.where("config_template_id NOT IN (?)", FakeConfigTemplate.unscoped.pluck(:id)).update_all(:config_template_id => nil)
    TemplateCombination.where("environment_id NOT IN (?)", Environment.unscoped.pluck(:id)).update_all(:environment_id => nil)
  kinds[type] = TemplateKind.unscoped.find_by_name(type)
  kinds[type] ||= TemplateKind.unscoped.create(:name => type)
organizations = Organization.unscoped.all
locations = Location.unscoped.all
    if (t = ProvisioningTemplate.unscoped.find_by_name(input[:name])) && !audit_modified?(ProvisioningTemplate, input[:name])
organizations = Organization.unscoped.all
locations = Location.unscoped.all
    if (p = Ptable.unscoped.find_by_name(input[:name])) && !audit_modified?(Ptable, input[:name])
os_suse = Operatingsystem.unscoped.where(:type => "Suse") || Operatingsystem.unscoped.where("name LIKE ?", "suse")
    next if Medium.unscoped.where(['name = ? OR path = ?', input[:name], input[:path]]).any?
  setup :set_admin
  def set_admin
    User.current = users(:admin)
  end

      permission = Permission.find_by_name("#{operation}_#{type}") ||
        FactoryGirl.create(:permission, :name => "#{operation}_#{type}")
    assert_difference('AuthSourceLdap.unscoped.count', 1) do
    assert_difference('AuthSourceLdap.unscoped.count', -1) do
    assert_equal "new_description",
      ComputeResource.unscoped.find_by_name('mycompute').description
    assert_difference('ComputeResource.unscoped.count', -1) do
    assert_equal "new_description",
      ComputeResource.unscoped.find_by_name('mycompute').description
    assert_difference('ComputeResource.unscoped.count', -1) do
    assert ProvisioningTemplate.unscoped.exists?(config_template.id)
    refute ProvisioningTemplate.unscoped.exists?(config_template.id)
    put :update, { :id => Domain.unscoped.first.to_param, :domain => { :name => "domain.new" } }
    assert_equal "domain.new", Domain.unscoped.first.name
    assert_difference('Environment.unscoped.count') do
    assert_difference('Environment.unscoped.count', -1) do
    assert_difference('Hostgroup.unscoped.count') do
    assert_difference('Hostgroup.unscoped.count', -1) do
    assert_no_difference('Hostgroup.unscoped.count') do
    assert_difference('Hostgroup.unscoped.count') do
    assert_equal hostgroups(:common).id.to_s, Hostgroup.unscoped.find_by_name("db").ancestry
    assert_difference('Medium.unscoped.count', +1) do
    assert_difference('Medium.unscoped.count', -1) do
    assert_difference('Ptable.unscoped.count') do
    assert_difference('Ptable.unscoped.count', -0) do
    assert_difference('Ptable.unscoped.count', -1) do
    assert_difference('SmartProxy.unscoped.count') do
    assert_difference('SmartProxy.unscoped.count', -1) do
    assert_difference('Environment.unscoped.count', 2) do
        assert_difference('Puppetclass.unscoped.count', 1) do
      assert_difference('Puppetclass.unscoped.count', 0) do
    assert_difference('Environment.unscoped.count', -1) do
      assert_difference('Environment.unscoped.find_by_name("env1").puppetclasses.count', -2) do
    assert_difference('LookupKey.unscoped.count', 1) do
    assert_difference('Environment.unscoped.count', 0) do
      assert_difference('Environment.unscoped.count', 1) do
    assert_difference('Subnet::Ipv4.unscoped.count') do
    assert_equal 'Subnet::Ipv4', Subnet.unscoped.find_by_name('QA2').type
    assert_difference('Subnet::Ipv6.unscoped.count') do
    assert_equal 'Subnet::Ipv6', Subnet.unscoped.find_by_name('QA2').type
    assert_difference('Subnet.unscoped.count', -1) do
    assert_difference('Subnet.unscoped.count', 0) do
    mod_user = User.unscoped.find_by_id(user.id)
    assert User.unscoped.find_by_id(user.id).admin?
    mod_user = User.unscoped.find_by_id(user.id)
    mod_user = User.unscoped.find_by_id(user.id)
    mod_user = User.unscoped.find_by_id(user.id)
    refute User.unscoped.exists?(user.id)
      assert User.unscoped.exists?(user.id)
      assert User.unscoped.find_by_login('new_admin').admin?
  test "#update should allow updating myself without any special permissions" do
    assert_difference('AuthSourceLdap.unscoped.count', 1) do
    assert_difference('AuthSourceLdap.unscoped.count', -1) do
    assert_equal "new_description",
      ComputeResource.unscoped.find_by_name('mycompute').description
    assert_difference('ComputeResource.unscoped.count', -1) do
    assert_equal "new_description",
      ComputeResource.unscoped.find_by_name('mycompute').description
    assert_difference('ComputeResource.unscoped.count', -1) do
      proxy.update_attribute(:url, 'http://configreports.foreman')
      post :create, { :config_report => create_a_puppet_transaction_report }
      assert_response :forbidden
      assert_response :forbidden
      assert_response :forbidden
      assert_response :forbidden
    refute Report.unscoped.find_by_id(report.id)
    assert ProvisioningTemplate.unscoped.exists?(config_template.id)
    refute ProvisioningTemplate.unscoped.exists?(config_template.id)
    templates(:pxekickstart).organizations = User.current.organizations
    templates(:pxekickstart).locations = User.current.locations
    assert_equal "domain.new", Domain.unscoped.first.name
    assert_equal taxonomies(:location1).domains.length, assigns(:domains).length
    assert_equal assigns(:domains), taxonomies(:location1).domains
    assert_equal taxonomies(:organization1).domains.length, assigns(:domains).length
    assert_equal taxonomies(:organization1).domains, assigns(:domains)
    assert_difference('Environment.unscoped.count') do
    assert_difference('Environment.unscoped.count', -1) do
    assert_difference('Hostgroup.unscoped.count') do
    assert_difference('Hostgroup.unscoped.count', -1) do
    assert_difference('Hostgroup.unscoped.count') do
    assert_no_difference('Hostgroup.unscoped.count') do
    assert_difference('Hostgroup.unscoped.count') do
    assert_equal hostgroups(:common).id.to_s,
      Hostgroup.unscoped.find_by_name("db").ancestry
    as_admin do
      assert_equal compute_attrs.vm_interfaces.count,
        last_record.interfaces.count
      assert_equal expected_compute_attributes(compute_attrs, 0),
        last_record.interfaces.find_by_mac('00:11:22:33:44:00').compute_attributes
      assert_equal expected_compute_attributes(compute_attrs, 1),
        last_record.interfaces.find_by_mac('00:11:22:33:44:01').compute_attributes
    end
    as_admin do
      @host.interfaces.reload
      assert_equal compute_attrs.vm_interfaces.count, @host.interfaces.count
      assert_equal expected_compute_attributes(compute_attrs, 0), @host.interfaces.find_by_primary(true).compute_attributes
      assert_equal expected_compute_attributes(compute_attrs, 1), @host.interfaces.find_by_primary(false).compute_attributes
    end
    assert_equal hostgroup.id, Host.find_by(:name => hostname).hostgroup_id
    proxy.update_attribute(:url, 'https://factsimporter.foreman')
    assert_difference('Location.unscoped.count', -1) do
    assert_difference('Location.unscoped.count', -1) do
    @location.ignore_types = ["Hostgroup", "Environment", "User", "Medium",
                              "Subnet", "SmartProxy", "ProvisioningTemplate",
                              "ComputeResource", "Realm"]
        put :update, {
          :id => @location.to_param,
          :location => { :domain_ids => Domain.unscoped.pluck(:id) }
        }
        User.current = users(:admin)
        # as_admin gets invalidated after the call, so we need to restore it
        # in order to make the call to @location.domains.count  in the right
        # context
    assert_difference('Medium.unscoped.count', +1) do
    assert_difference('Medium.unscoped.count', -1) do
    assert_equal '123', Host.unscoped.find_by_name(@host.name).parameters.
      order("parameters.updated_at").last.value
    assert_equal Domain.unscoped.find_by_name("mydomain.net").parameters.
      order("parameters.updated_at").last.value, "123"
    assert_equal Subnet.unscoped.find_by_name("five").parameters.
      order("parameters.updated_at").last.value, "123"
    assert_equal Hostgroup.unscoped.find_by_name("Common").group_parameters.
      order("parameters.updated_at").last.value, "123"
    assert_equal Operatingsystem.unscoped.find_by_name("Redhat").parameters.
      order("parameters.updated_at").last.value, "123"
    assert ProvisioningTemplate.unscoped.exists?(provisioning_template.id)
    refute ProvisioningTemplate.unscoped.exists?(provisioning_template.id)
    assert_difference('Ptable.unscoped.count') do
    assert_difference('Ptable.unscoped.count') do
    assert_difference('Ptable.unscoped.count', 0) do
    assert_difference('Ptable.unscoped.count', -1) do
    realm_id = Realm.unscoped.first.id
    put :update, { :id => realm_id, :realm => { :name => "realm.new" } }
    assert_equal "realm.new", Realm.unscoped.find(realm_id).name
    refute Realm.unscoped.find_by_id(realm['id'])
    assert_equal taxonomies(:location1).realms.length, assigns(:realms).length
    assert_equal assigns(:realms), taxonomies(:location1).realms
    assert_equal taxonomies(:organization1).realms.length, assigns(:realms).length
    assert_equal assigns(:realms), taxonomies(:organization1).realms
      proxy.update_attribute(:url, 'http://foremanimporter.report')
    expected_proxy_ids = SmartProxy.unscoped.with_features("TFTP").map { |p| p.id }
    expected_proxy_ids = SmartProxy.unscoped.with_features("TFTP").map { |p| p.id }
    assert_difference('SmartProxy.unscoped.count') do
    assert_difference('SmartProxy.unscoped.count', -1) do
    assert_difference('Environment.unscoped.count', 2) do
        assert_difference('Puppetclass.unscoped.count', 1) do
      assert_difference('Puppetclass.unscoped.count', 0) do
    assert_difference('Environment.unscoped.count', -1) do
      assert_difference('Environment.unscoped.find_by_name("env1").puppetclasses.count', -2) do
    assert_difference('LookupKey.unscoped.count', 1) do
    assert_difference('Environment.unscoped.count', 0) do
      assert_difference('Environment.unscoped.count', 1) do
    assert_difference('Environment.unscoped.count', 0) do
    assert_difference('LookupKey.unscoped.count', 0) do
      post :import_puppetclasses, {:id => smart_proxies(:puppetmaster).id, :except => 'new,updated'}, set_session_user
      assert_difference('Puppetclass.unscoped.count', 1) do
      assert_difference('Puppetclass.unscoped.count', 2) do
    assert_difference('Subnet.unscoped.count') do
    assert_difference('Subnet.unscoped.count') do
    subnet = Subnet.unscoped.find_by_name(valid_v4_attrs[:name])
    assert_difference('Subnet.unscoped.count') do
    assert_difference('Subnet.unscoped.count', -1) do
    assert_difference('Subnet.unscoped.count', 0) do
    mod_user = User.unscoped.find_by_id(user.id)
    assert User.unscoped.find_by_id(user.id).admin?
    mod_user = User.unscoped.find_by_id(user.id)
    mod_user = User.unscoped.find_by_id(user.id)
    mod_user = User.unscoped.find_by_id(user.id)
    refute User.unscoped.exists?(user.id)
      assert User.unscoped.exists?(user.id)
      as_admin do
        @user = FactoryGirl.create(:user)
      end
      get :index, {}, set_session_user.merge(:user => @user.id)
      assert_redirected_to edit_user_path(@user)
    @model = AuthSourceLdap.unscoped.first
    post :create, {:auth_source_ldap => {:name => AuthSourceLdap.unscoped.first.name}}, set_session_user
    put :update, {:id => AuthSourceLdap.unscoped.first, :auth_source_ldap => {:name => AuthSourceLdap.unscoped.first.name} }, set_session_user
    put :update, {:id => AuthSourceLdap.unscoped.first.id, :format => "weird", :auth_source_ldap => {:name => AuthSourceLdap.unscoped.first.name} }, set_session_user
    wierd_id = "#{AuthSourceLdap.unscoped.first.id}.weird"
    put :update, {:id => wierd_id, :auth_source_ldap => {:name => AuthSourceLdap.unscoped.first.name} }, set_session_user
    parameterized_id = "#{AuthSourceLdap.unscoped.first.id}-#{AuthSourceLdap.unscoped.first.name.parameterize}"
    put :update, {:id => parameterized_id, :auth_source_ldap => {:name => AuthSourceLdap.unscoped.first.name} }, set_session_user
    put :update, {:id => AuthSourceLdap.unscoped.first, :auth_source_ldap => {:name => AuthSourceLdap.unscoped.first.name} }, set_session_user
    auth_source_ldap = AuthSourceLdap.unscoped.first
    User.unscoped.where(:auth_source_id => auth_source_ldap.id).update_all(:auth_source_id => nil)
    refute AuthSourceLdap.unscoped.exists?(auth_source_ldap.id)
      get :edit, { :id => AuthSourceLdap.unscoped.first.id },
    auth_source_ldap = AuthSourceLdap.unscoped.find(auth_source_ldap.id)
    put :test_connection, {:id => AuthSourceLdap.unscoped.first, :auth_source_ldap => {:name => AuthSourceLdap.unscoped.first.name} }, set_session_user
    put :test_connection, {:id => AuthSourceLdap.unscoped.first, :auth_source_ldap => {:name => AuthSourceLdap.unscoped.first.name} }, set_session_user
    auth_source_ldap_params = { :name => AuthSourceLdap.unscoped.first.name,
    put :update, { :id => AuthSourceLdap.unscoped.first,
      AuthSourceLdap.unscoped.first.organizations.to_a
      AuthSourceLdap.unscoped.first.locations.to_a
    assert_difference('ComputeResource.unscoped.count', 0) do
    assert_difference('ComputeResource.unscoped.count', +1) do
    @compute_resource = ComputeResource.unscoped.find(@compute_resource.id)
    @compute_resource = ComputeResource.unscoped.find(@compute_resource.id)
    assert_difference('ComputeResource.unscoped.count', 0) do
    assert_difference('ComputeResource.unscoped.count', 0) do
    assert_difference('ComputeResource.unscoped.count', -1) do
    @compute_resource.organizations = User.current.organizations
    @compute_resource.locations = User.current.locations
    @model = domains(:mydomain)
    put :update, {:id => @model.to_param, :domain => {:name => @model.name }}, set_session_user
    put :update, {:id => @model.to_param, :domain => {:name => @model.name }}, set_session_user
    domain = @model
    get :edit, {:id => @model.id}
    assert_difference 'Environment.unscoped.count' do
    env = Environment.unscoped.find(environment.id)
    assert_difference('Environment.unscoped.count', -1) do
    assert_equal ["a", "b", "c"],
      Environment.unscoped.find_by_name("env1").puppetclasses.map(&:name).sort
    envs = Environment.unscoped.find_by_name("env1").puppetclasses.map(&:name).sort
    assert_equal ["a", "b", "c"], envs
    assert_equal [], Environment.unscoped.find_by_name("env3").puppetclasses.map(&:name).sort
       {"obsolete" =>
        {"env1"  => '["a","b","c","_destroy_"]'}
       }
    }, set_session_user
    assert Environment.unscoped.find_by_name("env1").hosts.count > 0
    assert Environment.unscoped.find_by_name("env1")
      {"changed" =>
       {"new" =>
        {"new" => '{"a":{"new":{}}}'}
       }
    }, set_session_user
    assert(Environment.unscoped.all.map(&:name).include?('new'), 'Should include environment with name "new"')
    as_admin do
      users(:one).roles = [Role.default, Role.find_by_name('Viewer')]
    end
    get :nest, {:id => hostgroups(:common).id}, set_session_user
    get :clone, {:id => hostgroups(:common)}, set_session_user
    get :edit, {:id => hostgroups(:common)}, set_session_user
    put :update, {:id => hostgroups(:common), :hostgroup => { :name => '' }}, set_session_user
    put :update, {:id => hostgroups(:common), :hostgroup => { :name => hostgroups(:common).name }}, set_session_user
    get :edit, {:id => hostgroups(:common).id}, set_session_user.merge(:user => users(:one).id)
    assert_response :forbidden
    xhr :post, :domain_selected, {:id => hostgroups(:common), :hostgroup => {}, :domain_id => domain.id, :format => :json}, set_session_user
    xhr :post, :domain_selected, {:id => hostgroups(:common), :hostgroup => {}, :format => :json, :domain_id => nil}, set_session_user
    post :architecture_selected, {:id => hostgroups(:common), :hostgroup => {}, :architecture_id => nil}, set_session_user
      hostgroup = Hostgroup.unscoped.where(:name => "test_it").last
      as_admin do
        assert_equal "overridden", hostgroup.parameters["x"]
      end
      as_admin do
        child.reload
        assert_equal "overridden", child.parameters["x"]
      end
      as_admin do
        child.reload
        assert_equal "overridden", child.parameters["y"]
        assert_equal "", child.parameters["x"]
      end
    assert_difference 'Host.unscoped.count' do
    assert_difference 'Host.unscoped.count' do
    assert_difference('Host.unscoped.count', -1) do
      @host2.organization = users(:two).organizations.first
      @host2.location = users(:two).locations.first
    as_admin do
      hosts.each { |host| assert_equal hostgroup, host.reload.hostgroup }
    end
      as_admin do
        host = Host.unscoped.find_by_name(name)
        assert_not_nil host
        assert_equal host.hostgroup, hostgroup
      end
    as_admin do
      assert_equal environments(:global_puppetmaster), @host1.reload.environment
      assert_equal environments(:global_puppetmaster), @host2.reload.environment
    end
    assert_equal hostgroup.environment_id, Host.unscoped.find(@host1.id).environment_id
    assert_equal hostgroup.environment_id, Host.unscoped.find(@host2.id).environment_id
    as_admin do
      assert_equal users(:one).id_and_type, @host1.reload.is_owned_by
      assert_equal users(:one).id_and_type, @host2.reload.is_owned_by
    end
        as_admin do
          assert_equal proxy, host.reload.puppet_ca_proxy
        end
    host = Host.first
    assert_difference "location.hosts.count", (Host.unscoped.count - cnt_hosts_location) do
    assert_difference "organization.hosts.count", (Host.unscoped.count - cnt_hosts_organization) do
    User.current.organizations << taxonomies(:organization1)
    User.current.locations << taxonomies(:location1)
    assert_difference('Image.unscoped.count') do
    as_admin do
      assert_redirected_to compute_resource_path(@image.compute_resource)
    end
    as_admin do
      assert_redirected_to compute_resource_path(@image.compute_resource)
    end
    as_admin do
      assert_redirected_to compute_resource_path(@image.compute_resource)
    end
  test "should clone location with associations" do
    assert_difference "Location.unscoped.count", 1 do
      post :create, {
        :location => location_dup.selected_ids.each { |_,v| v.uniq! }
          .merge(:name => 'location_dup_name')
      }, set_session_user
    assert_equal new_location.environment_ids.uniq.sort, location.environment_ids.uniq.sort
    assert_equal new_location.hostgroup_ids.uniq.sort, location.hostgroup_ids.uniq.sort
    assert_equal new_location.environment_ids.uniq.sort, location.environment_ids.uniq.sort
    assert_equal new_location.domain_ids.uniq.sort, location.domain_ids.uniq.sort
    assert_equal new_location.medium_ids.uniq.sort, location.medium_ids.uniq.sort
    assert_equal new_location.user_ids.uniq.sort, location.user_ids.uniq.sort
    assert_equal new_location.smart_proxy_ids.uniq.sort, location.smart_proxy_ids.uniq.sort
    assert_equal new_location.provisioning_template_ids.uniq.sort, location.provisioning_template_ids.uniq.sort
    assert_equal new_location.compute_resource_ids.uniq.sort, location.compute_resource_ids.uniq.sort
    assert_equal new_location.organization_ids.uniq.sort, location.organization_ids.uniq.sort
    put :update, {:id => @model, :medium => {:name => nil}}, set_session_user
    put :update, {:id => @model, :medium => {:name => "MyUpdatedMedia"}}, set_session_user
    get :edit, {:id => @model.id}, set_session_user.merge(:user => users(:one).id)
  test "should clone organization with associations" do
    assert_difference "Organization.unscoped.count", 1 do
      post :create, {
        :organization => organization_dup.selected_ids.each { |_,v| v.uniq! }
          .merge(:name => 'organization_dup_name')
    assert_equal new_organization.environment_ids.uniq.sort, organization.environment_ids.uniq.sort
    assert_equal new_organization.hostgroup_ids.uniq.sort, organization.hostgroup_ids.uniq.sort
    assert_equal new_organization.environment_ids.uniq.sort, organization.environment_ids.uniq.sort
    assert_equal new_organization.domain_ids.uniq.sort, organization.domain_ids.uniq.sort
    assert_equal new_organization.medium_ids.uniq.sort, organization.medium_ids.uniq.sort
    assert_equal new_organization.user_ids.uniq.sort, organization.user_ids.uniq.sort
    assert_equal new_organization.smart_proxy_ids.uniq.sort, organization.smart_proxy_ids.uniq.sort
    assert_equal new_organization.provisioning_template_ids.uniq.sort, organization.provisioning_template_ids.uniq.sort
    assert_equal new_organization.compute_resource_ids.uniq.sort, organization.compute_resource_ids.uniq.sort
    assert_equal new_organization.location_ids.uniq.sort, organization.location_ids.uniq.sort
    assert_equal ProvisioningTemplate.unscoped.find(templates(:pxekickstart).id).locked, true
    assert_equal ProvisioningTemplate.unscoped.find(templates(:locked).id).locked, false
    assert ProvisioningTemplate.unscoped.exists?(config_template.id)
    assert !ProvisioningTemplate.unscoped.exists?(config_template.id)
      assert_difference('TemplateCombination.unscoped.count', 1) do
        assert_difference('ProvisioningTemplate.unscoped.count', 1) do
        as_admin do
          @template_combination.reload
          assert_equal new_environment, @template_combination.environment
        end
    as_admin do
      lookup_keys_added = overridable_lookup_keys(puppetclass, assigns(:obj))
      assert_equal 1, lookup_keys_added.count
      assert lookup_keys_added.map(&:key).include?("special_info")
      refute lookup_keys_added.map(&:key).include?("custom_class_param")
    end
    as_admin do
      lookup_keys_added = overridable_lookup_keys(puppetclass, hostgroup)
      assert_equal 2, lookup_keys_added.count
      assert lookup_keys_added.map(&:key).include?("special_info")
      assert lookup_keys_added.map(&:key).include?("custom_class_param")
    end
    as_admin do
      lookup_keys_added = overridable_lookup_keys(puppetclass, host)
      assert_equal 2, lookup_keys_added.count
      assert lookup_keys_added.map(&:key).include?("special_info")
      assert lookup_keys_added.map(&:key).include?("custom_class_param")
    end
    as_admin do
      lookup_keys_added = overridable_lookup_keys(puppetclass, hostgroup)
      assert_equal 2, lookup_keys_added.count
      assert lookup_keys_added.map(&:key).include?("special_info")
      assert lookup_keys_added.map(&:key).include?("custom_class_param")
    end
    env = FactoryGirl.create(:environment,
                             :organizations => [users(:one).organizations.first],
                             :locations => [users(:one).locations.first])
    env = FactoryGirl.create(:environment,
                             :organizations => [users(:one).organizations.first],
                             :locations => [users(:one).locations.first])
    realm_id = Realm.unscoped.first.id
    proxy_id = SmartProxy.unscoped.first.id
    put :update, {:id => realm_id,
                  :realm => { :realm_proxy_id => proxy_id } }, set_session_user
    assert_equal proxy_id, Realm.unscoped.find(realm_id).realm_proxy_id
    put :update, {:id => SmartProxy.unscoped.first,
                  :smart_proxy => {:url => "http://elsewhere.com:8443"}}, set_session_user
    assert_equal "http://elsewhere.com:8443", SmartProxy.unscoped.first.url
    @model = subnets(:one)
    subnet_id = @model
    put :update, {:id => subnet_id, :subnet => {:network => nil}}, set_session_user
    put :update, {:id => @model, :subnet => {:network => '192.168.100.10'}}, set_session_user
    assert_equal '192.168.100.10', Subnet.unscoped.find(@model).network
    assert Subnet.unscoped.exists?(subnet.id)
    @model.hosts.clear
    @model.interfaces.clear
    @model.domains.clear
    delete :destroy, {:id => @model}, set_session_user
    refute Subnet.exists?(@model.id)
    assert_difference 'Subnet.unscoped.count', 1 do
      users(:one).organizations << @rh_host.organization
      users(:one).locations << @rh_host.location
    user = FactoryGirl.create(:user, :with_mail, :admin => false,
                              :organizations => [@org], :locations => [@loc])
    FactoryGirl.create(:filter, :role => user.roles.first,
                       :permissions => Permission.where(:name => 'view_hosts'),
                       :search => "name = #{@rh_host.name}")
    FactoryGirl.create(:filter, :role => user.roles.first,
                       :permissions => Permission.where(:name => 'view_hosts'),
                       :search => "name = does_not_exist")
    refute User.unscoped.find_by_login('foo').admin
    assert User.unscoped.find_by_login('foo').admin
    mod_user = User.unscoped.find_by_id(user.id)
    user = User.unscoped.find_by_id(user.id)
    mod_user = User.unscoped.find_by_id(user.id)

    mod_user = User.unscoped.find_by_id(user.id)
    assert User.unscoped.exists?(user.id)
    assert !User.unscoped.find_by_login(user.login).mail.blank?
    assert_redirected_to edit_user_path(User.unscoped.find_by_login('ares'))
    get :edit, { :id => users(:two) }, set_session_user
    put :update, { :id => users(:two).id, :user => { :firstname => 'test' } },
      set_session_user
    AuthSourceLdap.any_instance.stubs(:organizations).returns([taxonomies(:organization1)])
    AuthSourceLdap.any_instance.stubs(:locations).returns([taxonomies(:location1)])
    user = User.unscoped.find_by_login('ldap-user')
      updated_user = User.unscoped.find(users(:one).id)
    setup_users
    setup_users
    organizations { [Organization.find_by_name('Organization 1')] } if SETTINGS[:organizations_enabled]
    locations { [Location.find_by_name('Location 1')] } if SETTINGS[:locations_enabled]
    organizations { [Organization.find_by_name('Organization 1')] } if SETTINGS[:organizations_enabled]
    locations { [Location.find_by_name('Location 1')] } if SETTINGS[:locations_enabled]
    organization { Organization.find_by_name('Organization 1') } if SETTINGS[:organizations_enabled]
    location { Location.find_by_name('Location 1') } if SETTINGS[:locations_enabled]
    organizations { [Organization.find_by_name('Organization 1')] } if SETTINGS[:organizations_enabled]
    locations { [Location.find_by_name('Location 1')] } if SETTINGS[:locations_enabled]
    organizations { [Organization.find_by_name('Organization 1')] } if SETTINGS[:organizations_enabled]
    locations { [Location.find_by_name('Location 1')] } if SETTINGS[:locations_enabled]

    organizations { [Organization.find_by_name('Organization 1')] } if SETTINGS[:organizations_enabled]
    locations { [Location.find_by_name('Location 1')] } if SETTINGS[:locations_enabled]
    organizations { [ Organization.find_by_name('Organization 1') ] }
    locations { [ Location.find_by_name('Location 1') ] }

user_one_org:
  taxonomy: organization1
  taxable: one
  taxable_type: "User"

user_one_loc:
  taxonomy: location1
  taxable: one
  taxable_type: "User"

subnet_one_org:
  taxonomy: organization1
  taxable: one
  taxable_type: "Subnet"

subnet_one_loc:
  taxonomy: location1
  taxable: one
  taxable_type: "Subnet"

compute_mycompute_org:
  taxonomy: organization1
  taxable: mycompute
  taxable_type: "ComputeResource"

compute_mycompute_loc:
  taxonomy: location1
  taxable: mycompute
  taxable_type: "ComputeResource"

hostgroup_common_org:
  taxonomy: organization1
  taxable: common
  taxable_type: "Hostgroup"

hostgroup_common_loc:
  taxonomy: location1
  taxable: common
  taxable_type: "Hostgroup"

medium_one_org:
  taxonomy: organization1
  taxable: one
  taxable_type: "Medium"

medium_one_loc:
  taxonomy: location1
  taxable: one
  taxable_type: "Medium"

auth_source_ldap_one_org:
  taxonomy: organization1
  taxable: one
  taxable_type: "AuthSource"

auth_source_ldap_one_loc:
  taxonomy: location1
  taxable: one
  taxable_type: "AuthSource"
    FactoryGirl.create(:host, :location => nil)
    assert_new_button(locations_path, "New Location", new_location_path)
    FactoryGirl.create(:host, :organization => nil)
      FactoryGirl.create(:filter, :role => user_role.role,
                         :permissions => Permission.unscoped.where(:name => 'view_hosts'),
                         :unlimited => true)
      target_host.organization = user_role.owner.organizations.first
      target_host.location = user_role.owner.locations.first
      other_host.organization = user_role.owner.organizations.first
      other_host.location = user_role.owner.locations.first
    assert_difference('LookupValue.unscoped.count') do
      :subnet => subnets(:two), :architecture => architectures(:x86_64),
      :puppet_proxy => smart_proxies(:puppetmaster), :medium => media(:one),
      :organization => nil, :location => nil,
    users(:one).organizations << [org1, org2, org3]
    interface = FactoryGirl.build(:nic_managed,
                                  :ip => "3.3.4.127",
                                  :mac => "cabbccddeeff",
                                  :host => FactoryGirl.create(:host),
                                  :subnet => subnet,
                                  :name => "a" + FactoryGirl.create(:host).name,
                                  :domain => domain)
      setup_user('view', 'hosts',
                 "hostgroup_id = #{@target_host.hostgroup_id}")
      assert_equal @target_reports.map(&:id).sort, Report.my_reports.map(&:id).sort
                                  :"#{opposite_taxonomy}_ids" => [],
      assert_equal selected_ids[:subnet_ids].sort, subnet_ids.uniq.sort
      assert_equal selected_ids[:medium_ids].sort, medium_ids.uniq.sort
      assert_equal selected_ids[:hostgroup_ids], [hostgroups(:common).id]
      assert_equal selected_ids[:user_ids], [users(:one).id, users(:scoped).id]
      assert_equal selected_ids[:compute_resource_ids], [compute_resources(:one).id, compute_resources(:mycompute).id]
      taxonomy_dup.name = "taxonomy_dup_name_#{rand}"
      assert taxonomy_dup.save
                                     users(:one)).sort
      as_admin do
        assert_equal parent.selected_ids, taxonomy.inherited_ids
      end
      parent.update_attribute(:domains, [domain1, domain2])
      parent.update_attribute(:subnets, [subnet])
                         :"#{taxonomy_name}" => parent,
                         :"#{taxonomy_name}" => parent,
      taxonomy.inherited_ids.each do |k,v|
        assert_equal v.sort, parent.selected_ids[k].sort
    test "multiple inheritance" do
    assert_equal subnet, Subnet::Ipv6.unscoped.subnet_for(get_ip(subnet, 10))
    assert_match /is used by/, subnet.errors.full_messages.join("\n")
      user = FactoryGirl.create(:user, :organizations => [@org, org2],
                                :locations => [])
  describe '#taxable_ids' do
    test "can work with empty array returning nil" do
      assert_nil @dummy.class.taxable_ids([], [])
    end
    test 'returns IDs for non-admin user of any context when no org/loc' do
      assert @dummy.class.all.count > 1

      as_user(:one) do
        any_org = User.current.organizations
        any_loc = User.current.locations

        visible_dummies = any_org.map(&:"#{@dummy.class.table_name}").flatten.map(&:id) &
          any_loc.map(&:"#{@dummy.class.table_name}").flatten.map(&:id)

        # We need to call '.taxable_ids' using the Environment class because
        # '.taxable_ids' will look for the 'taxable_taxonomies.taxable_type'
        # table of the caller.
        # Since TaxonomixDummy is defined in terms of the Environment table,
        # the table will have Environment, not TaxonomixDummy as taxable_type
        assert_equal visible_dummies, Environment.taxable_ids(nil, nil)
        assert_equal visible_dummies, Environment.taxable_ids([], [])
      end
    end

    test "can work with array of taxonomies" do
      loc1 = FactoryGirl.create(:location)
      loc2 = FactoryGirl.create(:location, :parent_id => loc1.id)
      loc3 = FactoryGirl.create(:location, :parent_id => loc2.id)
      loc4 = FactoryGirl.create(:location)
      org = FactoryGirl.create(:organization)
      env1 = FactoryGirl.create(:environment, :organizations => [org], :locations => [loc2])
      env2 = FactoryGirl.create(:environment, :organizations => [org])
      env3 = FactoryGirl.create(:environment, :locations => [loc2])
      env4 = FactoryGirl.create(:environment, :locations => [loc4])
      env5 = FactoryGirl.create(:environment, :locations => [loc1])
      env6 = FactoryGirl.create(:environment, :locations => [loc3])
      taxable_ids = Environment.taxable_ids([loc2, loc4], org, :subtree_ids)
      visible = [ env1 ]
      invisible = [ env2, env3, env4, env5, env6 ]
      visible.each { |env| assert_includes taxable_ids, env.id }
      invisible.each { |env| refute_includes taxable_ids, env.id }

      taxable_ids = Environment.taxable_ids([], org, :subtree_ids)
      visible = [ env1, env2 ]
      invisible = [ env3, env4, env5, env6 ]
      visible.each { |env| assert_includes taxable_ids, env.id }
      invisible.each { |env| refute_includes taxable_ids, env.id }

      taxable_ids = Environment.taxable_ids(loc2, [], :subtree_ids)
      visible = [ env1, env3, env5, env6 ]
      invisible = [ env2, env4 ]
      visible.each { |env| assert_includes taxable_ids, env.id }
      invisible.each { |env| refute_includes taxable_ids, env.id }

      taxable_ids = Environment.taxable_ids([loc2, loc4], [], :subtree_ids)
      visible = [ env1, env3, env4, env5, env6 ]
      invisible = [ env2 ]
      visible.each { |env| assert_includes taxable_ids, env.id }
      invisible.each { |env| refute_includes taxable_ids, env.id }
    end
    as_admin do
      used_organizations = user.used_organization_ids
      assert_empty used_organizations
      assert_equal used_organizations.count, 0
    end
  end

  context 'admin permissions' do
    test "returns only visible objects when org/loc are selected" do
      scoped_environments = Environment.
        with_taxonomy_scope([taxonomies(:organization1)])
      assert scoped_environments.include?(*taxonomies(:organization1).environments)
      assert_not_equal Environment.unscoped.all, scoped_environments
      assert_equal taxonomies(:organization1).environments, scoped_environments
    end

    test "returns nil (all objects) when there are no org/loc" do
      assert_equal User.with_taxonomy_scope([],[]).sort, User.unscoped.all.sort
    end
  end

  test 'current user ID and admin IDs are always visible' do
    as_user(:one) do
      scoped_users = User.with_taxonomy_scope([],[])
      assert_include scoped_users, User.current
      assert_include scoped_users, users(:admin)
    end
  end

  test 'users can only see objects scoped to its current taxonomies' do
    # Environment in organization 1 and location 1 cannot be seen by an user
    # who is scoped to organization 1 and location 2
    users(:one).organizations = [taxonomies(:organization1)]
    users(:one).locations = [taxonomies(:location2)]
    unreachable_env = FactoryGirl.create(
      :environment,
      :organizations => [taxonomies(:organization1)],
      :locations => [taxonomies(:location1)])

    as_user(:one) do
      assert_not_include Environment.all, unreachable_env
    end
    user = FactoryGirl.create(:user, :organizations => [])
      assert_not_equal last_login, User.unscoped.find(user.id).last_login_on
      reloaded_user = User.unscoped.find(user.id)
    record = User.new :login => "dummy", :mail => "j@j.com",
      :auth_source_id => AuthSourceInternal.first.id,
      :organizations => User.current.organizations,
      :locations => User.current.locations
    record               = User.new(:login => "dummy", :mail => "j@j.com",
      :auth_source_id => AuthSourceInternal.first.id,
      :role_ids => [create_role.id.to_s],
      :organizations => User.current.organizations,
      :locations => User.current.locations)
      record               = User.new(:login => "dummy", :mail => "j@j.com",
                                      :auth_source_id => AuthSourceInternal.first.id,
                                      :role_ids => [extra_role.id.to_s],
                                      :organizations => User.current.organizations,
                                      :locations => User.current.locations)
    record.organizations = User.current.organizations
    record.locations = User.current.locations
    user = FactoryGirl.create(:user, :organizations => [org1], :locations => [])
    as_user(user) do
      new_user = FactoryGirl.build(:user, :organizations => [], :locations => [])
      refute new_user.valid?
    users(:one).default_location = taxonomies(:location2)
    users(:one).default_organization = taxonomies(:organization2)
      # User 'one' contains location1 already
      # User 'one' contains organization1 already
  setup :setup_set_script_name, :set_api_user, :turn_off_login,
    :disable_webpack, :set_admin

  def set_admin
    User.current = users(:admin)
  end
    host.hostgroup.subnet.locations = [host.location]
    host.hostgroup.subnet.organizations = [host.organization]
    host.hostgroup.subnet6.locations = [host.location]
    host.hostgroup.subnet6.organizations = [host.organization]
      assert_equal @envs.to_a.sort, lks.last.environments.to_a.sort
      assert_equal @envs.to_a.sort, lks.last.environments.sort
      assert_equal @envs.to_a.sort, lks.last.environments.to_a.sort
    User.current = nil
    User.current = FactoryGirl.build(:user, :admin => true,
                                     :organizations => [], :locations => [])
      assert_difference 'User.unscoped.where(:login => "admin").count', 1 do
      user = User.unscoped.find_by_login('admin')
      assert_difference 'User.unscoped.where(:login => "seed_test").count', 1 do
      user = User.unscoped.find_by_login('seed_test')
    count = Ptable.unscoped.count
    assert_not_equal count, Ptable.unscoped.count
    refute Ptable.unscoped.where(:os_family => nil).any?
    count = Medium.unscoped.count
    assert_not_equal count, Medium.unscoped.count
    refute Medium.unscoped.where(:os_family => nil).any?
    count = ProvisioningTemplate.unscoped.count
    assert_not_equal count, ProvisioningTemplate.unscoped.count
        assert Ptable.unscoped.where(:template => File.read(tmpl)).any?, "No partition table containing #{tmpl}"
        assert ProvisioningTemplate.unscoped.where(:template => File.read(tmpl)).any?, "No template containing #{tmpl}"
    count = Bookmark.unscoped.where(:public => true).count
    assert_not_equal count, Bookmark.unscoped.where(:public => true).count
    ProvisioningTemplate.without_auditing { ProvisioningTemplate.unscoped.find_by_name('Kickstart default').update_attributes(:template => 'test') }
    refute_equal ProvisioningTemplate.unscoped.find_by_name('Kickstart default').template, 'test'
    assert_equal 1, ProvisioningTemplate.unscoped.
      destroy_all(:name => 'Kickstart default').size
    refute ProvisioningTemplate.unscoped.find_by_name('Kickstart default')
    tmpl = ProvisioningTemplate.unscoped.find_by_name('Kickstart default')
    refute ProvisioningTemplate.unscoped.find_by_name('Kickstart default')
    assert Organization.unscoped.find_by_name('seed_test')
    refute Organization.unscoped.find_by_name('seed_test')
    assert Location.unscoped.find_by_name('seed_test')
    refute Location.unscoped.find_by_name('seed_test')
    assert_equal [], view_permissions - Role.unscoped.find_by_name('Viewer').permissions