diff --git a/contrib/devstack/lib/rally b/contrib/devstack/lib/rally
index 5018dc698a..75d5344651 100644
--- a/contrib/devstack/lib/rally
+++ b/contrib/devstack/lib/rally
@@ -62,8 +62,8 @@ function _create_deployment_config() {
     cat >$1 <<EOF
 {
     "type": "ExistingCloud",
-    "endpoint": {
-        "auth_url": "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION",
+    "auth_url": "$KEYSTONE_SERVICE_PROTOCOL://$KEYSTONE_SERVICE_HOST:$KEYSTONE_SERVICE_PORT/v$IDENTITY_API_VERSION",
+    "admin": {
         "username": "admin",
         "password": "$ADMIN_PASSWORD",
         "tenant_name": "benchmark"
diff --git a/doc/samples/deployments/existing-keystone-v3.json b/doc/samples/deployments/existing-keystone-v3.json
new file mode 100644
index 0000000000..3ca38c5b30
--- /dev/null
+++ b/doc/samples/deployments/existing-keystone-v3.json
@@ -0,0 +1,14 @@
+{
+    "type": "ExistingCloud",
+    "auth_url": "http://example.net:5000/v3/",
+    "region_name": "RegionOne",
+    "use_public_urls": true,
+    "admin_port": 35357,
+    "admin": {
+        "username": "admin",
+        "password": "myadminpass",
+        "user_domain_name": "admin",
+        "project_name": "admin",
+        "project_domain_name": "admin",
+    }
+}
diff --git a/doc/samples/deployments/existing.json b/doc/samples/deployments/existing.json
index 0a52d94a43..107c0fcc63 100644
--- a/doc/samples/deployments/existing.json
+++ b/doc/samples/deployments/existing.json
@@ -1,7 +1,10 @@
 {
     "type": "ExistingCloud",
-    "endpoint": {
-        "auth_url": "http://example.net:5000/v2.0/",
+    "auth_url": "http://example.net:5000/v2.0/",
+    "region_name": "RegionOne",
+    "use_public_urls": true,
+    "admin_port": 35357,
+    "admin": {
         "username": "admin",
         "password": "myadminpass",
         "tenant_name": "demo"
diff --git a/rally/benchmark/engine.py b/rally/benchmark/engine.py
index af6cf64fd8..386976a162 100644
--- a/rally/benchmark/engine.py
+++ b/rally/benchmark/engine.py
@@ -82,8 +82,10 @@ class BenchmarkEngine(object):
             ...
             benchmark_engine = BenchmarkEngine(config, task)
             # Deploying the cloud...
-            # endpoint - is a dict with data on endpoint of deployed cloud
-            with benchmark_engine.bind(endpoints):
+            # admin - is an objects.Endpoint that actually presents admin user
+            # users - is a list of objects.Endpoint that actually presents list
+                      of users.
+            with benchmark_engine.bind(admin=admin, users=users):
                 benchmark_engine.run()
     """
 
@@ -173,7 +175,8 @@ class BenchmarkEngine(object):
     def _get_runner(self, config):
         runner = config.get("runner", {})
         runner.setdefault("type", consts.RunnerType.SERIAL)
-        return base_runner.ScenarioRunner.get_runner(self.task, self.endpoints,
+        return base_runner.ScenarioRunner.get_runner(self.task,
+                                                     self.admin_endpoint,
                                                      runner)
 
     @rutils.log_task_wrapper(LOG.info, _("Benchmarking."))
@@ -203,15 +206,17 @@ class BenchmarkEngine(object):
         self.task.update_status(consts.TaskStatus.FINISHED)
 
     @rutils.log_task_wrapper(LOG.info, _("Check cloud."))
-    def bind(self, endpoints):
-        self.endpoints = [endpoint.Endpoint(**endpoint_dict)
-                          for endpoint_dict in endpoints]
-        # NOTE(msdubov): Passing predefined user endpoints hasn't been
-        #                implemented yet, so the scenario runner always gets
-        #                a single admin endpoint here.
-        self.admin_endpoint = self.endpoints[0]
-        self.admin_endpoint.permission = consts.EndpointPermission.ADMIN
-        # Try to access cloud via keystone client
+    def bind(self, admin=None, users=None):
+        """Bind benchmark engine to OpenStack cloud.
+
+        This method will set self.admin_endpoint with passed values,
+        as well it will check that admin user is actually admin.
+
+        :param admin: admin credentials
+        :param users: List of users credentials
+        :returns: self
+        """
+        self.admin_endpoint = endpoint.Endpoint(**admin)
         clients = osclients.Clients(self.admin_endpoint)
         clients.verified_keystone()
         return self
diff --git a/rally/benchmark/runners/base.py b/rally/benchmark/runners/base.py
index 707de21884..52f44ede9f 100644
--- a/rally/benchmark/runners/base.py
+++ b/rally/benchmark/runners/base.py
@@ -154,13 +154,18 @@ class ScenarioRunner(object):
 
     CONFIG_SCHEMA = {}
 
-    def __init__(self, task, endpoints, config):
+    def __init__(self, task, admin, config):
+        """Runner constructor.
+
+        It sets task, admin and config to local variables. Also initialize
+        result_queue, where results will be put by _send_result method.
+
+        :param task: Instance of objects.Task
+        :param admin: Instance of objects.Endpoint
+        :param config: Dict with runner section from benchmark configuration
+        """
         self.task = task
-        self.endpoints = endpoints
-        # NOTE(msdubov): Passing predefined user endpoints hasn't been
-        #                implemented yet, so the scenario runner always gets
-        #                a single admin endpoint here.
-        self.admin_user = endpoints[0]
+        self.admin_user = admin
         self.config = config
         self.result_queue = collections.deque()
 
@@ -172,9 +177,15 @@ class ScenarioRunner(object):
         raise exceptions.NoSuchRunner(type=runner_type)
 
     @staticmethod
-    def get_runner(task, endpoint, config):
-        """Returns instance of a scenario runner for execution type."""
-        return ScenarioRunner._get_cls(config["type"])(task, endpoint, config)
+    def get_runner(task, admin, config):
+        """Returns instance of a scenario runner for execution type.
+
+        :param task: instance of objects.Task corresponding to current task
+        :param admin: endpoint instance with admin credentials.
+        :param config: contents of "runner" section from task configuration
+                       for specific benchmark
+        """
+        return ScenarioRunner._get_cls(config["type"])(task, admin, config)
 
     @staticmethod
     def validate(config):
diff --git a/rally/cmd/commands/deployment.py b/rally/cmd/commands/deployment.py
index eefdf2686a..e02c6c7f14 100644
--- a/rally/cmd/commands/deployment.py
+++ b/rally/cmd/commands/deployment.py
@@ -70,8 +70,8 @@ class DeploymentCommands(object):
 
             config = {
                 "type": "ExistingCloud",
-                "endpoint": {
-                    "auth_url": os.environ['OS_AUTH_URL'],
+                "auth_url": os.environ['OS_AUTH_URL'],
+                "admin": {
                     "username": os.environ['OS_USERNAME'],
                     "password": os.environ['OS_PASSWORD'],
                     "tenant_name": os.environ['OS_TENANT_NAME']
@@ -79,7 +79,7 @@ class DeploymentCommands(object):
             }
             region_name = os.environ.get('OS_REGION_NAME')
             if region_name and region_name != 'None':
-                config['endpoint']['region_name'] = region_name
+                config['region_name'] = region_name
         else:
             if not filename:
                 print("Either --filename or --fromenv is required")
@@ -167,14 +167,19 @@ class DeploymentCommands(object):
                    help='UUID of a deployment.')
     @envutils.with_default_deploy_id
     def endpoint(self, deploy_id=None):
-        """Print endpoint of the deployment.
+        """Print all endpoints of the deployment.
 
         :param deploy_id: a UUID of the deployment
         """
         headers = ['auth_url', 'username', 'password', 'tenant_name',
                    'region_name', 'use_public_urls', 'admin_port']
         table_rows = []
-        endpoints = db.deployment_get(deploy_id)['endpoints']
+
+        deployment = db.deployment_get(deploy_id)
+        users = deployment.get("users", [])
+        admin = deployment.get("admin")
+        endpoints = users + [admin] if admin else users
+
         for ep in endpoints:
             data = [ep.get(m, '') for m in headers]
             table_rows.append(utils.Struct(**dict(zip(headers, data))))
@@ -193,8 +198,9 @@ class DeploymentCommands(object):
         headers = ['services', 'type', 'status']
         table_rows = []
         try:
-            endpoints = db.deployment_get(deploy_id)['endpoints']
-            for endpoint_dict in endpoints:
+            admin = db.deployment_get(deploy_id)['admin']
+            # TODO(boris-42): make this work for users in future
+            for endpoint_dict in [admin]:
                 clients = osclients.Clients(endpoint.Endpoint(**endpoint_dict))
                 client = clients.verified_keystone()
                 print("keystone endpoints are valid and following "
diff --git a/rally/cmd/commands/show.py b/rally/cmd/commands/show.py
index 9946cf6f4b..06943a3171 100644
--- a/rally/cmd/commands/show.py
+++ b/rally/cmd/commands/show.py
@@ -17,20 +17,26 @@
 
 from __future__ import print_function
 
-import sys
-
 from rally.cmd import cliutils
 from rally.cmd import envutils
 from rally import db
 from rally import exceptions
 from rally.objects import endpoint
 from rally.openstack.common import cliutils as common_cliutils
+from rally.openstack.common.gettextutils import _
 from rally import osclients
 from rally import utils
 
 
 class ShowCommands(object):
 
+    def _get_endpoints(self, deploy_id):
+        deployment = db.deployment_get(deploy_id)
+        admin = deployment.get("admin")
+        admin = [admin] if admin else []
+
+        return admin + deployment.get("users", [])
+
     @cliutils.args('--deploy-id', dest='deploy_id', type=str, required=False,
                    help='the UUID of a deployment')
     @envutils.with_default_deploy_id
@@ -46,22 +52,23 @@ class ShowCommands(object):
         formatters = dict(zip(float_cols,
                               [cliutils.pretty_float_formatter(col)
                                for col in float_cols]))
+
         try:
-            endpoints = db.deployment_get(deploy_id)['endpoints']
-            for endpoint_dict in endpoints:
+            for endpoint_dict in self._get_endpoints(deploy_id):
                 clients = osclients.Clients(endpoint.Endpoint(**endpoint_dict))
                 glance_client = clients.glance()
                 for image in glance_client.images.list():
                     data = [image.id, image.name, image.size]
                     table_rows.append(utils.Struct(**dict(zip(headers, data))))
 
-        except exceptions.InvalidArgumentsException:
-            print(_("Authentication Issues: %s") % sys.exc_info()[1])
+                common_cliutils.print_list(table_rows,
+                                           fields=headers,
+                                           formatters=formatters,
+                                           mixed_case_fields=mixed_case_fields)
+
+        except exceptions.InvalidArgumentsException as e:
+            print(_("Authentication Issues: %s") % e)
             return(1)
-        common_cliutils.print_list(table_rows,
-                                   fields=headers,
-                                   formatters=formatters,
-                                   mixed_case_fields=mixed_case_fields)
 
     @cliutils.args('--deploy-id', dest='deploy_id', type=str, required=False,
                    help='the UUID of a deployment')
@@ -79,8 +86,7 @@ class ShowCommands(object):
                                for col in float_cols]))
         table_rows = []
         try:
-            endpoints = db.deployment_get(deploy_id)['endpoints']
-            for endpoint_dict in endpoints:
+            for endpoint_dict in self._get_endpoints(deploy_id):
                 clients = osclients.Clients(endpoint.Endpoint(**endpoint_dict))
                 nova_client = clients.nova()
                 for flavor in nova_client.flavors.list():
@@ -88,13 +94,14 @@ class ShowCommands(object):
                             flavor.ram, flavor.swap, flavor.disk]
                     table_rows.append(utils.Struct(**dict(zip(headers, data))))
 
-        except exceptions.InvalidArgumentsException:
-            print(_("Authentication Issues: %s") % sys.exc_info()[1])
+                common_cliutils.print_list(table_rows,
+                                           fields=headers,
+                                           formatters=formatters,
+                                           mixed_case_fields=mixed_case_fields)
+
+        except exceptions.InvalidArgumentsException as e:
+            print(_("Authentication Issues: %s") % e)
             return(1)
-        common_cliutils.print_list(table_rows,
-                                   fields=headers,
-                                   formatters=formatters,
-                                   mixed_case_fields=mixed_case_fields)
 
     @cliutils.args('--deploy-id', dest='deploy_id', type=str, required=False,
                    help='the UUID of a deployment')
@@ -104,19 +111,19 @@ class ShowCommands(object):
         mixed_case_fields = ['ID', 'Label', 'CIDR']
         table_rows = []
         try:
-            endpoints = db.deployment_get(deploy_id)['endpoints']
-            for endpoint_dict in endpoints:
+            for endpoint_dict in self._get_endpoints(deploy_id):
                 clients = osclients.Clients(endpoint.Endpoint(**endpoint_dict))
-            nova_client = clients.nova()
-            for network in nova_client.networks.list():
-                data = [network.id, network.label, network.cidr]
-                table_rows.append(utils.Struct(**dict(zip(headers, data))))
-        except exceptions.InvalidArgumentsException:
-            print(_("Authentication Issues: %s") % sys.exc_info()[1])
+                nova_client = clients.nova()
+                for network in nova_client.networks.list():
+                    data = [network.id, network.label, network.cidr]
+                    table_rows.append(utils.Struct(**dict(zip(headers, data))))
+
+                common_cliutils.print_list(table_rows,
+                                           fields=headers,
+                                           mixed_case_fields=mixed_case_fields)
+        except exceptions.InvalidArgumentsException as e:
+            print(_("Authentication Issues: %s") % e)
             return(1)
-        common_cliutils.print_list(table_rows,
-                                   fields=headers,
-                                   mixed_case_fields=mixed_case_fields)
 
     @cliutils.args('--deploy-id', dest='deploy_id', type=str, required=False,
                    help='the UUID of a deployment')
@@ -126,8 +133,7 @@ class ShowCommands(object):
         mixed_case_fields = ['ID', 'Name', 'Description']
         table_rows = []
         try:
-            endpoints = db.deployment_get(deploy_id)['endpoints']
-            for endpoint_dict in endpoints:
+            for endpoint_dict in self._get_endpoints(deploy_id):
                 clients = osclients.Clients(endpoint.Endpoint(**endpoint_dict))
                 nova_client = clients.nova()
                 for secgroup in nova_client.security_groups.list():
@@ -135,12 +141,14 @@ class ShowCommands(object):
                             secgroup.description]
                     table_rows.append(utils.Struct(**dict(zip(headers,
                                                               data))))
-        except exceptions.InvalidArgumentsException:
-            print(_("Authentication Issues: %s") % sys.exc_info()[1])
+                    common_cliutils.print_list(
+                        table_rows,
+                        fields=headers,
+                        mixed_case_fields=mixed_case_fields)
+
+        except exceptions.InvalidArgumentsException as e:
+            print(_("Authentication Issues: %s") % e)
             return(1)
-        common_cliutils.print_list(table_rows,
-                                   fields=headers,
-                                   mixed_case_fields=mixed_case_fields)
 
     @cliutils.args('--deploy-id', dest='deploy_id', type=str, required=False,
                    help='the UUID of a deployment')
@@ -150,16 +158,16 @@ class ShowCommands(object):
         mixed_case_fields = ['Name', 'Fingerprint']
         table_rows = []
         try:
-            endpoints = db.deployment_get(deploy_id)['endpoints']
-            for endpoint_dict in endpoints:
+            for endpoint_dict in self._get_endpoints(deploy_id):
                 clients = osclients.Clients(endpoint.Endpoint(**endpoint_dict))
                 nova_client = clients.nova()
                 for keypair in nova_client.keypairs.list():
                     data = [keypair.name, keypair.fingerprint]
                     table_rows.append(utils.Struct(**dict(zip(headers, data))))
-        except exceptions.InvalidArgumentsException:
-            print(_("Authentication Issues: %s") % sys.exc_info()[1])
+                common_cliutils.print_list(table_rows,
+                                           fields=headers,
+                                           mixed_case_fields=mixed_case_fields)
+
+        except exceptions.InvalidArgumentsException as e:
+            print(_("Authentication Issues: %s") % e)
             return(1)
-        common_cliutils.print_list(table_rows,
-                                   fields=headers,
-                                   mixed_case_fields=mixed_case_fields)
diff --git a/rally/cmd/commands/use.py b/rally/cmd/commands/use.py
index b4411cb437..c625c6e76a 100644
--- a/rally/cmd/commands/use.py
+++ b/rally/cmd/commands/use.py
@@ -25,23 +25,18 @@ from rally import fileutils
 
 class UseCommands(object):
 
-    def _update_openrc_deployment_file(self, deploy_id, endpoints):
+    def _update_openrc_deployment_file(self, deploy_id, endpoint):
         openrc_path = os.path.expanduser('~/.rally/openrc-%s' % deploy_id)
         # NOTE(msdubov): In case of multiple endpoints write the first one.
         with open(openrc_path, 'w+') as env_file:
-            if endpoints[0].get('region_name'):
-                env_file.write('export OS_AUTH_URL=%(auth_url)s\n'
-                               'export OS_USERNAME=%(username)s\n'
-                               'export OS_PASSWORD=%(password)s\n'
-                               'export OS_TENANT_NAME=%(tenant_name)s\n'
-                               'export OS_REGION_NAME=%(region_name)s\n'
-                               % endpoints[0])
-            else:
-                env_file.write('export OS_AUTH_URL=%(auth_url)s\n'
-                               'export OS_USERNAME=%(username)s\n'
-                               'export OS_PASSWORD=%(password)s\n'
-                               'export OS_TENANT_NAME=%(tenant_name)s\n'
-                               % endpoints[0])
+            env_file.write('export OS_AUTH_URL=%(auth_url)s\n'
+                           'export OS_USERNAME=%(username)s\n'
+                           'export OS_PASSWORD=%(password)s\n'
+                           'export OS_TENANT_NAME=%(tenant_name)s\n'
+                           % endpoint)
+            if endpoint.get('region_name'):
+                env_file.write('export OS_REGION_NAME=%(region_name)s\n'
+                               % endpoint)
         expanded_path = os.path.expanduser('~/.rally/openrc')
         if os.path.exists(expanded_path):
             os.remove(expanded_path)
@@ -88,8 +83,8 @@ class UseCommands(object):
             self._ensure_rally_configuration_dir_exists()
             self._update_attribute_in_global_file('RALLY_DEPLOYMENT',
                                                   deploy_id)
-            self._update_openrc_deployment_file(deploy_id,
-                                                deploy['endpoints'])
+            self._update_openrc_deployment_file(
+                deploy_id, deploy.get('admin') or deploy.get('users')[0])
             print ('~/.rally/openrc was updated\n\nHINTS:\n'
                    '* To get your cloud resources, run:\n\t'
                    'rally show [flavors|images|keypairs|networks|secgroups]\n'
diff --git a/rally/db/sqlalchemy/models.py b/rally/db/sqlalchemy/models.py
index f5bf23a418..cc6f6ec705 100644
--- a/rally/db/sqlalchemy/models.py
+++ b/rally/db/sqlalchemy/models.py
@@ -76,14 +76,11 @@ class Deployment(BASE, RallyBase):
         nullable=False,
     )
 
-    # TODO(akscram): Actually a endpoint of a deployment can be
-    #                represented by a set of parameters are auth_url,
-    #                user, password and project.
-    endpoints = sa.Column(
-        types.PickleType,
-        default=[],
-        nullable=False,
-    )
+    # NOTE(boris-42): This is pickled rally.object.Endpoint object
+    admin = sa.Column(types.PickleType, nullable=True)
+
+    # NOTE(boris-42): This is list of pickled rally.object.Endpoint objects
+    users = sa.Column(types.PickleType, default=[], nullable=False)
 
     status = sa.Column(
         sa.Enum(*consts.DeployStatus),
diff --git a/rally/deploy/engines/devstack.py b/rally/deploy/engines/devstack.py
index c336886c72..0f40b79d7d 100644
--- a/rally/deploy/engines/devstack.py
+++ b/rally/deploy/engines/devstack.py
@@ -116,7 +116,7 @@ class DevstackEngine(engine.EngineFactory):
                                           self.localrc['ADMIN_PASSWORD'],
                                           'admin',
                                           consts.EndpointPermission.ADMIN)
-        return [admin_endpoint]
+        return {"admin": admin_endpoint}
 
     def cleanup(self):
         for resource in self.deployment.get_resources(type='credentials'):
diff --git a/rally/deploy/engines/existing.py b/rally/deploy/engines/existing.py
index 0f61bf37f1..514e258b6b 100644
--- a/rally/deploy/engines/existing.py
+++ b/rally/deploy/engines/existing.py
@@ -19,20 +19,20 @@ from rally import objects
 
 
 class ExistingCloud(engine.EngineFactory):
-    """ExistingCloud doesn't deploy OpenStack it just use existing.
+    """ExistingCloud doesn't deploy OpenStack it just use existing cloud.
 
        To use ExistingCloud you should put in a config endpoint key, e.g:
 
             {
                 "type": "ExistingCloud",
-                "endpoint": {
-                    "auth_url": "http://localhost:5000/v2.0/",
+                "auth_url": "http://localhost:5000/v2.0/",
+                "region_name": "RegionOne",
+                "use_public_urls": true,
+                "admin_port": 35357
+                "admin": {
                     "username": "admin",
                     "password": "password",
                     "tenant_name": "demo",
-                    "region_name": "RegionOne",
-                    "use_public_urls": True,
-                    "admin_port": 35357
                 }
             }
 
@@ -40,83 +40,103 @@ class ExistingCloud(engine.EngineFactory):
 
             {
                 "type": "ExistingCloud",
-                "endpoint": {
-                    "auth_url": "http://localhost:5000/v3/",
-                    "username": "engineer1",
-                    "user_domain_name": "qa",
-                    "project_name": "qa_admin_project",
-                    "project_domain_name": "qa",
-                    "password": "password",
-                    "region_name": "RegionOne",
-                    "use_public_urls": False,
-                    "admin_port": 35357,
+                "auth_url": "http://localhost:5000/v3/",
+                "region_name": "RegionOne",
+                "use_public_urls": false,
+                "admin_port": 35357
+                "admin": {
+                    "username": "admin",
+                    "password": "admin",
+                    "user_domain_name": "admin",
+                    "project_name": "admin",
+                    "project_domain_name": "admin",
                 }
             }
     """
 
     CONFIG_SCHEMA = {
-        'type': 'object',
-        'properties': {
-            'type': {'type': 'string'},
-            'endpoint': {
-                'type': 'object',
-                'properties': {
-                    'auth_url': {'type': 'string'},
-                    'username': {'type': 'string'},
-                    'password': {'type': 'string'},
-                    'region_name': {'type': 'string'},
-                    'use_public_urls': {'type': 'boolean'},
-                    'admin_port': {
-                        'type': 'integer',
-                        'minimum': 2,
-                        'maximum': 65535
-                    },
+        "type": "object",
+
+        "definitions": {
+            "user": {
+                "type": "object",
+                "properties": {
+                    "username": {"type": "string"},
+                    "password": {"type": "string"},
                 },
-                'oneOf': [
+                "oneOf": [
                     {
                         # v2.0 authentication
-                        'properties': {
-                            'tenant_name': {'type': 'string'},
+                        "properties": {
+                            "tenant_name": {"type": "string"},
                         },
-                        'required': ['auth_url', 'username', 'password',
-                                     'tenant_name'],
+                        "required": ["username", "password", "tenant_name"],
                     },
                     {
                         # Authentication in project scope
-                        'properties': {
-                            'user_domain_name': {'type': 'string'},
-                            'project_name': {'type': 'string'},
-                            'project_domain_name': {'type': 'string'},
+                        "properties": {
+                            "user_domain_name": {"type": "string"},
+                            "project_name": {"type": "string"},
+                            "project_domain_name": {"type": "string"},
                         },
-                        'required': ['auth_url', 'username', 'password',
-                                     'project_name'],
-                    },
+                        "required": ["username", "password", "project_name"],
+                    }
                 ]
-            },
+            }
         },
-        'required': ['type', 'endpoint'],
+
+        "properties": {
+            "type": {"type": "string"},
+            "auth_url": {"type": "string"},
+            "region_name": {"type": "string"},
+            "use_public_urls": {"type": "boolean"},
+            "admin_port": {
+                "type": "integer",
+                "minimum": 2,
+                "maximum": 65535
+            }
+        },
+        "anyOf": [
+            {
+                "properties": {
+                    "admin": {"$ref": "#/definitions/user"}
+                },
+                "required": ["type", "auth_url", "admin"]
+            },
+            {
+                "users": {
+                    "type": "array",
+                    "items": {"$ref": "#/definitions/user"}
+                },
+                "required": ["type", "auth_url", "users"]
+            }
+        ]
     }
 
-    def deploy(self):
-        endpoint_dict = self.deployment['config']['endpoint']
-        project_name = endpoint_dict.get('project_name',
-                                         endpoint_dict.get('tenant_name'))
-
-        admin_endpoint = objects.Endpoint(
-            endpoint_dict['auth_url'], endpoint_dict['username'],
-            endpoint_dict['password'],
-            tenant_name=project_name,
-            permission=consts.EndpointPermission.ADMIN,
-            region_name=endpoint_dict.get('region_name'),
-            use_public_urls=endpoint_dict.get('use_public_urls', False),
-            admin_port=endpoint_dict.get('admin_port', 35357),
-            domain_name=endpoint_dict.get('domain_name'),
-            user_domain_name=endpoint_dict.get('user_domain_name',
-                                               'Default'),
-            project_domain_name=endpoint_dict.get('project_domain_name',
-                                                  'Default')
+    def _create_endpoint(self, common, user, permission):
+        return objects.Endpoint(
+            common["auth_url"], user["username"], user["password"],
+            tenant_name=user.get("project_name", user.get("tenant_name")),
+            permission=permission,
+            region_name=common.get("region_name"),
+            use_public_urls=common.get("use_public_urls", False),
+            admin_port=common.get("admin_port", 35357),
+            domain_name=user.get("domain_name"),
+            user_domain_name=user.get("user_domain_name", "Default"),
+            project_domain_name=user.get("project_domain_name", "Default")
         )
-        return [admin_endpoint]
+
+    def deploy(self):
+        permissions = consts.EndpointPermission
+
+        users = [self._create_endpoint(self.config, user, permissions.USER)
+                 for user in self.config.get("users", [])]
+
+        admin = self._create_endpoint(self.config,
+                                      self.config.get("admin"),
+                                      permissions.ADMIN)
+
+        return {"admin": admin, "users": users}
 
     def cleanup(self):
         pass
diff --git a/rally/deploy/engines/fuel.py b/rally/deploy/engines/fuel.py
index 3ff2a0d10b..6cb927884f 100644
--- a/rally/deploy/engines/fuel.py
+++ b/rally/deploy/engines/fuel.py
@@ -164,13 +164,13 @@ class FuelEngine(engine.EngineFactory):
         ip = cluster.get_endpoint_ip()
         attrs = cluster.get_attributes()['editable']['access']
 
-        return [objects.Endpoint(
+        admin_endpoint = objects.Endpoint(
             'http://%s:5000/v2.0/' % ip,
             attrs['user']['value'],
             attrs['password']['value'],
             attrs['tenant']['value'],
-            consts.EndpointPermission.ADMIN
-        )]
+            consts.EndpointPermission.ADMIN)
+        return {"admin": admin_endpoint}
 
     def cleanup(self):
         resources = self.deployment.get_resources(provider_name='FuelEngine',
diff --git a/rally/deploy/engines/lxc.py b/rally/deploy/engines/lxc.py
index e6ddffd8d3..e8c986af08 100644
--- a/rally/deploy/engines/lxc.py
+++ b/rally/deploy/engines/lxc.py
@@ -148,7 +148,7 @@ class LxcEngine(engine.EngineFactory):
                 container.ssh.run('/bin/sh -e', stdin=open(start_script, 'rb'))
             if network:
                 network += 1
-        return objects.Endpoint('', '', '', '')
+        return {"admin": objects.Endpoint('', '', '', '')}
 
     def cleanup(self):
         resources = self.deployment.get_resources()
diff --git a/rally/objects/deploy.py b/rally/objects/deploy.py
index 0ad8cd1a59..cd1cdb20ae 100644
--- a/rally/objects/deploy.py
+++ b/rally/objects/deploy.py
@@ -40,39 +40,46 @@ class Deployment(object):
         db.deployment_delete(uuid)
 
     def _update(self, values):
-        self.deployment = db.deployment_update(self.deployment['uuid'], values)
+        self.deployment = db.deployment_update(self.deployment["uuid"], values)
 
     def update_status(self, status):
-        self._update({'status': status})
+        self._update({"status": status})
 
     def update_name(self, name):
-        self._update({'name': name})
+        self._update({"name": name})
 
     def update_config(self, config):
-        self._update({'config': config})
+        self._update({"config": config})
 
     def update_endpoints(self, endpoints):
-        self._update({'endpoints': [e.to_dict(include_permission=True)
-                                    for e in endpoints]})
+        admin = endpoints.get("admin", {})
+        if admin:
+            admin = admin.to_dict(include_permission=True)
+
+        self._update({
+            "admin": admin,
+            "users": [e.to_dict(include_permission=True)
+                      for e in endpoints.get("users", [])]
+        })
 
     def set_started(self):
-        self._update({'started_at': datetime.datetime.now(),
-                      'status': consts.DeployStatus.DEPLOY_STARTED})
+        self._update({"started_at": datetime.datetime.now(),
+                      "status": consts.DeployStatus.DEPLOY_STARTED})
 
     def set_completed(self):
-        self._update({'completed_at': datetime.datetime.now(),
-                      'status': consts.DeployStatus.DEPLOY_FINISHED})
+        self._update({"completed_at": datetime.datetime.now(),
+                      "status": consts.DeployStatus.DEPLOY_FINISHED})
 
     def add_resource(self, provider_name, type=None, info=None):
         return db.resource_create({
-            'deployment_uuid': self.deployment['uuid'],
-            'provider_name': provider_name,
-            'type': type,
-            'info': info,
+            "deployment_uuid": self.deployment["uuid"],
+            "provider_name": provider_name,
+            "type": type,
+            "info": info,
         })
 
     def get_resources(self, provider_name=None, type=None):
-        return db.resource_get_all(self.deployment['uuid'],
+        return db.resource_get_all(self.deployment["uuid"],
                                    provider_name=provider_name, type=type)
 
     @staticmethod
@@ -80,4 +87,4 @@ class Deployment(object):
         db.resource_delete(resource_id)
 
     def delete(self):
-        db.deployment_delete(self.deployment['uuid'])
+        db.deployment_delete(self.deployment["uuid"])
diff --git a/rally/orchestrator/api.py b/rally/orchestrator/api.py
index d0cc7693c1..eccb4db308 100644
--- a/rally/orchestrator/api.py
+++ b/rally/orchestrator/api.py
@@ -98,10 +98,11 @@ def start_task(deploy_uuid, config, task=None):
     LOG.info("Benchmark Task %s on Deployment %s" % (task['uuid'],
                                                      deployment['uuid']))
     benchmark_engine = engine.BenchmarkEngine(config, task)
-    endpoint = deployment['endpoints']
+    admin = deployment["admin"]
+    users = deployment["users"]
 
     try:
-        benchmark_engine.bind(endpoint)
+        benchmark_engine.bind(admin=admin, users=users)
         benchmark_engine.validate()
         benchmark_engine.run()
     except exceptions.InvalidTaskException:
diff --git a/rally/verification/verifiers/tempest/config.py b/rally/verification/verifiers/tempest/config.py
index 48b55e58ab..66396fe552 100644
--- a/rally/verification/verifiers/tempest/config.py
+++ b/rally/verification/verifiers/tempest/config.py
@@ -49,7 +49,7 @@ CONF.register_opts(image_opts, 'image')
 class TempestConf(object):
 
     def __init__(self, deploy_id):
-        self.endpoint = db.deployment_get(deploy_id)['endpoints'][0]
+        self.endpoint = db.deployment_get(deploy_id)['admin']
         self.clients = osclients.Clients(endpoint.Endpoint(**self.endpoint))
         try:
             self.keystoneclient = self.clients.verified_keystone()
@@ -102,7 +102,7 @@ class TempestConf(object):
     def _get_url(self, servicename):
         for service in self.keystoneclient.auth_ref['serviceCatalog']:
             if service['name'] == servicename:
-                return service['endpoints'][0]['publicURL']
+                return service['admin']['publicURL']
 
     def _set_default(self):
         lock_path = os.path.join(self.data_path,
diff --git a/tests/benchmark/runners/test_base.py b/tests/benchmark/runners/test_base.py
index ea736dea72..fcd6cd5eda 100644
--- a/tests/benchmark/runners/test_base.py
+++ b/tests/benchmark/runners/test_base.py
@@ -197,13 +197,12 @@ class ScenarioRunnerTestCase(test.TestCase):
             __execution_type__ = "new_runner"
 
         task = mock.MagicMock()
-        endpoints = [mock.MagicMock(), mock.MagicMock()]
+        admin = mock.MagicMock()
         config = {"type": "new_runner", "a": 123}
-        runner = base.ScenarioRunner.get_runner(task, endpoints, config)
+        runner = base.ScenarioRunner.get_runner(task, admin, config)
 
         self.assertEqual(runner.task, task)
-        self.assertEqual(runner.endpoints, endpoints)
-        self.assertEqual(runner.admin_user, endpoints[0])
+        self.assertEqual(runner.admin_user, admin)
         self.assertEqual(runner.config, config)
         self.assertIsInstance(runner, NewRunner)
 
diff --git a/tests/benchmark/test_engine.py b/tests/benchmark/test_engine.py
index 6b5d9d486b..1f8a0d7bb2 100644
--- a/tests/benchmark/test_engine.py
+++ b/tests/benchmark/test_engine.py
@@ -242,7 +242,7 @@ class BenchmarkEngineTestCase(test.TestCase):
             "b.args": [{"args": {"a": 1}}]
         }
         task = mock.MagicMock()
-        eng = engine.BenchmarkEngine(config, task).bind([{}])
+        eng = engine.BenchmarkEngine(config, task).bind({})
         eng.run()
 
     @mock.patch("rally.benchmark.engine.BenchmarkEngine.consume_results")
@@ -256,7 +256,7 @@ class BenchmarkEngineTestCase(test.TestCase):
             "b.args": [{"runner": {"a": 1}}]
         }
         task = mock.MagicMock()
-        eng = engine.BenchmarkEngine(config, task).bind([{}])
+        eng = engine.BenchmarkEngine(config, task).bind({})
         eng.run()
 
     @mock.patch("rally.benchmark.engine.BenchmarkEngine.consume_results")
@@ -270,7 +270,7 @@ class BenchmarkEngineTestCase(test.TestCase):
             "b.args": [{"context": {"context_b": {"b": 2}}}]
         }
         task = mock.MagicMock()
-        eng = engine.BenchmarkEngine(config, task).bind([{}])
+        eng = engine.BenchmarkEngine(config, task).bind({})
         eng.run()
 
     @mock.patch("rally.benchmark.engine.osclients")
@@ -279,16 +279,16 @@ class BenchmarkEngineTestCase(test.TestCase):
         mock_endpoint.return_value = mock.MagicMock()
         benchmark_engine = engine.BenchmarkEngine(mock.MagicMock(),
                                                   mock.MagicMock())
-        endpoint = {
+        admin = {
             "auth_url": "http://valid.com",
             "username": "user",
             "password": "pwd",
             "tenant_name": "tenant"
         }
 
-        binded_benchmark_engine = benchmark_engine.bind([endpoint])
-        self.assertEqual([mock_endpoint.return_value],
-                         benchmark_engine.endpoints)
+        binded_benchmark_engine = benchmark_engine.bind(admin)
+        self.assertEqual(mock_endpoint.return_value,
+                         benchmark_engine.admin_endpoint)
         self.assertEqual(benchmark_engine, binded_benchmark_engine)
         expected_calls = [
             mock.call.Clients(mock_endpoint.return_value),
diff --git a/tests/cmd/commands/test_deployment.py b/tests/cmd/commands/test_deployment.py
index bf1003347a..c1742fa905 100644
--- a/tests/cmd/commands/test_deployment.py
+++ b/tests/cmd/commands/test_deployment.py
@@ -50,15 +50,15 @@ class DeploymentCommandsTestCase(test.TestCase):
         mock_create.assert_called_once_with(
             {
                 "type": "ExistingCloud",
-                "endpoint": {
-                    "auth_url": 'fake_auth_url',
-                    "username": 'fake_username',
-                    "password": 'fake_password',
-                    "tenant_name": 'fake_tenant_name',
-                    "region_name": 'fake_region_name'
+                "auth_url": 'fake_auth_url',
+                "region_name": "fake_region_name",
+                "admin": {
+                    "username": "fake_username",
+                    "password": "fake_password",
+                    "tenant_name": "fake_tenant_name"
                 }
             },
-            'from_env'
+            "from_env"
         )
 
     @mock.patch('rally.cmd.commands.deployment.DeploymentCommands.list')
@@ -193,15 +193,26 @@ class DeploymentCommandsTestCase(test.TestCase):
     @mock.patch('rally.cmd.commands.deployment.utils.Struct')
     @mock.patch('rally.cmd.commands.deployment.db.deployment_get')
     def test_endpoint(self, mock_deployment, mock_struct, mock_print_list):
-        deploy_id = 'b1a6153e-a314-4cb3-b63b-cf08c1a416c3'
-        value = {'endpoints': [{}]}
+        deploy_id = "b1a6153e-a314-4cb3-b63b-cf08c1a416c3"
+        value = {
+            "admin": {
+                "auth_url": "url",
+                "username": "u",
+                "password": "p",
+                "tenant_name": "t",
+                "region_name": "r",
+                "use_public_urls": "upu",
+                "admin_port": "ap"
+            },
+            "users": []
+        }
         mock_deployment.return_value = value
         self.deployment.endpoint(deploy_id)
         mock_deployment.assert_called_once_with(deploy_id)
 
-        headers = ['auth_url', 'username', 'password', 'tenant_name',
-                   'region_name', 'use_public_urls', 'admin_port']
-        fake_data = ['', '', '', '', '', '', '']
+        headers = ["auth_url", "username", "password", "tenant_name",
+                   "region_name", "use_public_urls", "admin_port"]
+        fake_data = ["url", "u", "p", "t", "r", "upu", "ap"]
         mock_struct.assert_called_once_with(**dict(zip(headers, fake_data)))
         mock_print_list.assert_called_once_with([mock_struct()], headers)
 
diff --git a/tests/cmd/commands/test_show.py b/tests/cmd/commands/test_show.py
index 3d5197662b..42b57ceb31 100644
--- a/tests/cmd/commands/test_show.py
+++ b/tests/cmd/commands/test_show.py
@@ -45,7 +45,7 @@ class ShowCommandsTestCase(test.TestCase):
         fake_image = self.fake_glance_client.images.cache.values()[0]
         fake_image.size = 1
         mock_get_glance.return_value = self.fake_glance_client
-        mock_deployment_get.return_value = {'endpoints': [self.fake_endpoint]}
+        mock_deployment_get.return_value = {'admin': self.fake_endpoint}
         self.show.images(self.fake_deploy_id)
         mock_deployment_get.assert_called_once_with(self.fake_deploy_id)
         mock_get_glance.assert_called_once_with()
@@ -74,7 +74,7 @@ class ShowCommandsTestCase(test.TestCase):
         fake_flavor.id, fake_flavor.name, fake_flavor.vcpus = 1, 'm1.fake', 1
         fake_flavor.ram, fake_flavor.swap, fake_flavor.disk = 1024, 128, 10
         mock_get_nova.return_value = self.fake_nova_client
-        mock_deployment_get.return_value = {'endpoints': [self.fake_endpoint]}
+        mock_deployment_get.return_value = {'admin': self.fake_endpoint}
         self.show.flavors(self.fake_deploy_id)
         mock_deployment_get.assert_called_once_with(self.fake_deploy_id)
         mock_get_nova.assert_called_once_with()
@@ -105,7 +105,7 @@ class ShowCommandsTestCase(test.TestCase):
         fake_network.label = 'fakenet'
         fake_network.cidr = '10.0.0.0/24'
         mock_get_nova.return_value = self.fake_nova_client
-        mock_deployment_get.return_value = {'endpoints': [self.fake_endpoint]}
+        mock_deployment_get.return_value = {'admin': self.fake_endpoint}
         self.show.networks(self.fake_deploy_id)
         mock_deployment_get.assert_called_once_with(self.fake_deploy_id)
         mock_get_nova.assert_called_once_with()
@@ -129,7 +129,7 @@ class ShowCommandsTestCase(test.TestCase):
         fake_secgroup = self.fake_nova_client.security_groups.cache.values()[0]
         fake_secgroup.id = 0
         mock_get_nova.return_value = self.fake_nova_client
-        mock_deployment_get.return_value = {'endpoints': [self.fake_endpoint]}
+        mock_deployment_get.return_value = {'admin': self.fake_endpoint}
         self.show.secgroups(self.fake_deploy_id)
         mock_deployment_get.assert_called_once_with(self.fake_deploy_id)
         mock_get_nova.assert_called_once_with()
@@ -154,7 +154,7 @@ class ShowCommandsTestCase(test.TestCase):
         fake_keypair = self.fake_nova_client.keypairs.cache.values()[0]
         fake_keypair.fingerprint = '84:87:58'
         mock_get_nova.return_value = self.fake_nova_client
-        mock_deployment_get.return_value = {'endpoints': [self.fake_endpoint]}
+        mock_deployment_get.return_value = {'admin': self.fake_endpoint}
         self.show.keypairs(self.fake_deploy_id)
         mock_deployment_get.assert_called_once_with(self.fake_deploy_id)
         mock_get_nova.assert_called_once_with()
diff --git a/tests/cmd/commands/test_use.py b/tests/cmd/commands/test_use.py
index 3704430625..db8b449a7f 100644
--- a/tests/cmd/commands/test_use.py
+++ b/tests/cmd/commands/test_use.py
@@ -40,7 +40,7 @@ class UseCommandsTestCase(test.TestCase):
     @mock.patch(MOD + 'db')
     def test_deployment_use_by_name(self, m_db, m_ercde, m_uaigf, m_uodf):
         fake_deployment = {'uuid': 'fake_uuid',
-                           'endpoints': 'fake_endpoints'}
+                           'admin': 'fake_endpoints'}
         m_db.deployment_list.return_value = [fake_deployment]
         m_db.deployment_get.return_value = fake_deployment
         status = self.use.deployment(name='fake_name')
@@ -58,11 +58,15 @@ class UseCommandsTestCase(test.TestCase):
     def test_deployment(self, mock_env, mock_path, mock_deployment,
                         mock_symlink, mock_remove):
         deploy_id = '593b683c-4b16-4b2b-a56b-e162bd60f10b'
-        endpoints = {'endpoints': [{'auth_url': 'fake_auth_url',
-                                    'username': 'fake_username',
-                                    'password': 'fake_password',
-                                    'tenant_name': 'fake_tenant_name',
-                                    'region_name': None}]}
+        endpoints = {
+            'admin': {
+                'auth_url': 'fake_auth_url',
+                'username': 'fake_username',
+                'password': 'fake_password',
+                'tenant_name': 'fake_tenant_name',
+                'region_name': None
+            }
+        }
         mock_deployment.return_value = endpoints
         with mock.patch('rally.cmd.commands.use.open', mock.mock_open(),
                         create=True) as mock_file:
diff --git a/tests/deploy/engines/test_devstack.py b/tests/deploy/engines/test_devstack.py
index 911967ba68..4b7c8f751a 100644
--- a/tests/deploy/engines/test_devstack.py
+++ b/tests/deploy/engines/test_devstack.py
@@ -85,7 +85,7 @@ class DevstackEngineTestCase(test.TestCase):
         fake_provider.create_servers.return_value = [server]
         with mock.patch.object(self.engine, 'deployment') as m_d:
             endpoints = self.engine.deploy()
-        self.assertEqual(['fake_endpoint'], endpoints)
+        self.assertEqual({"admin": "fake_endpoint"}, endpoints)
         m_endpoint.assert_called_once_with('http://host:5000/v2.0/', 'admin',
                                            'secret', 'admin', 'admin')
         m_d.add_resource.assert_called_once_with(
diff --git a/tests/deploy/engines/test_existing.py b/tests/deploy/engines/test_existing.py
index 2bb2e87480..d7703e5c44 100644
--- a/tests/deploy/engines/test_existing.py
+++ b/tests/deploy/engines/test_existing.py
@@ -24,44 +24,47 @@ from tests import test
 
 class TestExistingCloud(test.TestCase):
     def setUp(self):
-        self.deployment = {
-            'config': {
-                'type': 'ExistingCloud',
-                'endpoint': {
-                    'auth_url': 'http://example.net:5000/v2.0/',
-                    'username': 'admin',
-                    'password': 'myadminpass',
-                    'tenant_name': 'demo',
-                    'region_name': 'RegionOne',
-                    'use_public_urls': False,
-                    'admin_port': 35357,
-                    'domain_name': None,
-                    'project_domain_name': 'Default',
-                    'user_domain_name': 'Default',
-                },
-            },
-        }
         super(TestExistingCloud, self).setUp()
+        self.deployment = {
+            "config": {
+                "type": "ExistingCloud",
+                "auth_url": "http://example.net:5000/v2.0/",
+                "region_name": "RegionOne",
+                "use_public_urls": False,
+                "admin_port": 35357,
+                "admin": {
+                    "username": "admin",
+                    "password": "myadminpass",
+                    "tenant_name": "demo",
+                    "domain_name": None,
+                    "project_domain_name": "Default",
+                    "user_domain_name": "Default",
+                }
+            }
+        }
 
     def test_init(self):
         existing.ExistingCloud(self.deployment)
 
     def test_init_invalid_config(self):
-        self.deployment['config']['endpoint'] = 42
+        self.deployment["config"]["admin"] = 42
         self.assertRaises(jsonschema.ValidationError,
                           existing.ExistingCloud, self.deployment)
 
     def test_deploy(self):
         engine = existing.ExistingCloud(self.deployment)
         endpoints = engine.deploy()
-        admin_endpoint = self.deployment['config']['endpoint'].copy()
-        self.assertEqual(admin_endpoint, endpoints[0].to_dict())
+        admin_endpoint = self.deployment["config"].copy()
+        admin_endpoint.pop("type")
+        admin_endpoint.update(admin_endpoint.pop("admin"))
+        self.assertEqual(admin_endpoint, endpoints["admin"].to_dict())
+        self.assertEqual([], endpoints["users"])
 
     def test_cleanup(self):
         existing.ExistingCloud(self.deployment).cleanup()
 
     def test_is_in_factory(self):
-        name = self.deployment['config']['type']
+        name = self.deployment["config"]["type"]
         engine = deploy.EngineFactory.get_engine(name,
                                                  self.deployment)
         self.assertIsInstance(engine, existing.ExistingCloud)
diff --git a/tests/deploy/engines/test_fuel.py b/tests/deploy/engines/test_fuel.py
index 09d0b0c153..376e3ba662 100644
--- a/tests/deploy/engines/test_fuel.py
+++ b/tests/deploy/engines/test_fuel.py
@@ -103,8 +103,8 @@ class FuelEngineTestCase(test.TestCase):
         engine._get_release_id = mock.Mock()
 
         endpoint = engine.deploy()
-        self.assertEqual(1, len(endpoint))
-        endpoint = endpoint[0]
+        self.assertEqual(["admin"], endpoint.keys())
+        endpoint = endpoint["admin"]
 
         self.assertEqual('user', endpoint.username)
         self.assertEqual('pw', endpoint.password)
diff --git a/tests/deploy/test_lxc.py b/tests/deploy/test_lxc.py
index 47c49b449e..e4a70a67b1 100644
--- a/tests/deploy/test_lxc.py
+++ b/tests/deploy/test_lxc.py
@@ -113,7 +113,7 @@ class LxcEngineTestCase(test.TestCase):
         with mock.patch.object(self.engine, 'deployment') as m_deployment:
             endpoint = self.engine.deploy()
 
-        self.assertIsInstance(endpoint, objects.Endpoint)
+        self.assertIsInstance(endpoint["admin"], objects.Endpoint)
         LxcHost_calls = [
             mock.call(fake_servers[0], {'network': '10.128.128.0/28',
                                         'tunnel_to': ['1.1.1.1', '2.2.2.2']}),
diff --git a/tests/objects/test_deploy.py b/tests/objects/test_deploy.py
index 88c772f3e4..de1e044d1d 100644
--- a/tests/objects/test_deploy.py
+++ b/tests/objects/test_deploy.py
@@ -119,12 +119,35 @@ class DeploymentTestCase(test.TestCase):
     def test_update_endpoints(self, mock_update):
         mock_update.return_value = self.deployment
         deploy = objects.Deployment(deployment=self.deployment)
-        endpoints = [objects.Endpoint("url", "user", "pwd", "tenant",
-                                      consts.EndpointPermission.ADMIN)]
+        endpoints = {
+            "admin": objects.Endpoint("url", "user", "pwd", "tenant",
+                                      consts.EndpointPermission.ADMIN),
+            "users": [
+                objects.Endpoint("url1", "user1", "pwd1", "tenant1",
+                                 consts.EndpointPermission.USER),
+                objects.Endpoint("url2", "user2", "pwd2", "tenant2",
+                                 consts.EndpointPermission.USER),
+            ]
+        }
+
+        expected_users = [u.to_dict(include_permission=True)
+                          for u in endpoints["users"]]
+
         deploy.update_endpoints(endpoints)
         mock_update.assert_called_once_with(
             self.deployment["uuid"],
-            {"endpoints": [endpoints[0].to_dict(include_permission=True)]})
+            {
+                "admin": endpoints["admin"].to_dict(include_permission=True),
+                "users": expected_users
+            })
+
+    @mock.patch('rally.objects.deploy.db.deployment_update')
+    def test_update_empty_endpoints(self, mock_update):
+        mock_update.return_value = self.deployment
+        deploy = objects.Deployment(deployment=self.deployment)
+        deploy.update_endpoints({})
+        mock_update.assert_called_once_with(self.deployment["uuid"],
+                                            {"admin": {}, "users": []})
 
     @mock.patch('rally.objects.deploy.db.resource_create')
     def test_add_resource(self, mock_create):
diff --git a/tests/orchestrator/test_api.py b/tests/orchestrator/test_api.py
index e78e301251..c5f201a59b 100644
--- a/tests/orchestrator/test_api.py
+++ b/tests/orchestrator/test_api.py
@@ -27,36 +27,36 @@ from tests import test
 
 FAKE_DEPLOY_CONFIG = {
     # TODO(akscram): A fake engine is more suitable for that.
-    'type': 'ExistingCloud',
-    'endpoint': {
-        'auth_url': 'http://example.net:5000/v2.0/',
-        'username': 'admin',
-        'password': 'myadminpass',
-        'tenant_name': 'demo',
-        'region_name': 'RegionOne',
-        'use_public_urls': False,
-        'admin_port': 35357,
-        'domain_name': None,
-        'project_domain_name': 'Default',
-        'user_domain_name': 'Default',
+    "type": "ExistingCloud",
+    "auth_url": "http://example.net:5000/v2.0/",
+    "admin": {
+        "username": "admin",
+        "password": "myadminpass",
+        "tenant_name": "demo",
+        "domain_name": None,
+        "project_domain_name": "Default",
+        "user_domain_name": "Default"
     },
+    "region_name": "RegionOne",
+    "use_public_urls": False,
+    "admin_port": 35357
 }
 
 
 FAKE_TASK_CONFIG = {
-    'FakeScenario.fake': [
+    "FakeScenario.fake": [
         {
-            'args': {},
-            'runner': {
-                'type': 'constant',
-                'timeout': 10000,
-                'times': 3,
-                'concurrency': 2,
+            "args": {},
+            "runner": {
+                "type": "constant",
+                "timeout": 10000,
+                "times": 3,
+                "concurrency": 2,
             },
-            'context': {
-                'users': {
-                    'tenants': 5,
-                    'users_per_tenant': 6,
+            "context": {
+                "users": {
+                    "tenants": 5,
+                    "users_per_tenant": 6,
                 }
             }
         }
@@ -79,26 +79,29 @@ class APITestCase(test.TestCase):
         super(APITestCase, self).setUp()
         self.deploy_config = FAKE_DEPLOY_CONFIG
         self.task_config = FAKE_TASK_CONFIG
-        self.deploy_uuid = '599bdf1d-fe77-461a-a810-d59b1490f4e3'
-        self.endpoints = [FAKE_DEPLOY_CONFIG['endpoint']]
-        # TODO(msdubov): Remove this as soon as ExistingCloud requires
-        #                permission on input
-        self.endpoints[0]["permission"] = consts.EndpointPermission.ADMIN
-        self.task_uuid = 'b0d9cd6c-2c94-4417-a238-35c7019d0257'
+        self.deploy_uuid = "599bdf1d-fe77-461a-a810-d59b1490f4e3"
+        admin_endpoint = FAKE_DEPLOY_CONFIG.copy()
+        admin_endpoint.pop("type")
+        admin_endpoint.update(admin_endpoint.pop("admin"))
+        admin_endpoint["permission"] = consts.EndpointPermission.ADMIN
+        self.endpoints = {"admin": admin_endpoint, "users": []}
+
+        self.task_uuid = "b0d9cd6c-2c94-4417-a238-35c7019d0257"
         self.task = {
-            'uuid': self.task_uuid,
+            "uuid": self.task_uuid,
         }
         self.deployment = {
-            'uuid': self.deploy_uuid,
-            'name': 'fake_name',
-            'config': self.deploy_config,
-            'endpoints': self.endpoints,
+            "uuid": self.deploy_uuid,
+            "name": "fake_name",
+            "config": self.deploy_config,
+            "admin": self.endpoints["admin"],
+            "users": []
         }
         self.tempest = mock.Mock()
 
-    @mock.patch('rally.objects.Task')
+    @mock.patch("rally.objects.Task")
     def test_create_task(self, mock_task):
-        deployment_uuid = 'b0d9cd6c-2c94-4417-a238-35c7019d0257'
+        deployment_uuid = "b0d9cd6c-2c94-4417-a238-35c7019d0257"
         tag = "a"
         api.create_task(deployment_uuid, tag)
         mock_task.assert_called_once_with(deployment_uuid=deployment_uuid,
@@ -110,12 +113,12 @@ class APITestCase(test.TestCase):
                 "._validate_config_syntax")
     @mock.patch("rally.benchmark.engine.BenchmarkEngine"
                 "._validate_config_scenarios_name")
-    @mock.patch('rally.benchmark.engine.osclients')
-    @mock.patch('rally.benchmark.engine.base_runner.ScenarioRunner.get_runner')
-    @mock.patch('rally.objects.deploy.db.deployment_get')
-    @mock.patch('rally.objects.task.db.task_result_create')
-    @mock.patch('rally.objects.task.db.task_update')
-    @mock.patch('rally.objects.task.db.task_create')
+    @mock.patch("rally.benchmark.engine.osclients")
+    @mock.patch("rally.benchmark.engine.base_runner.ScenarioRunner.get_runner")
+    @mock.patch("rally.objects.deploy.db.deployment_get")
+    @mock.patch("rally.objects.task.db.task_result_create")
+    @mock.patch("rally.objects.task.db.task_update")
+    @mock.patch("rally.objects.task.db.task_create")
     def test_start_task(self, mock_task_create, mock_task_update,
                         mock_task_result_create, mock_deploy_get,
                         mock_utils_runner, mock_osclients,
@@ -126,48 +129,47 @@ class APITestCase(test.TestCase):
         mock_deploy_get.return_value = self.deployment
 
         mock_utils_runner.return_value = mock_runner = mock.Mock()
-        mock_runner.result_queue = collections.deque(['fake_result'])
+        mock_runner.result_queue = collections.deque(["fake_result"])
 
         mock_runner.run.return_value = 42
-
         mock_osclients.Clients.return_value = fakes.FakeClients()
 
         api.start_task(self.deploy_uuid, self.task_config)
 
         mock_deploy_get.assert_called_once_with(self.deploy_uuid)
         mock_task_create.assert_called_once_with({
-            'deployment_uuid': self.deploy_uuid,
+            "deployment_uuid": self.deploy_uuid,
         })
         mock_task_update.assert_has_calls([
-            mock.call(self.task_uuid, {'status': consts.TaskStatus.VERIFYING}),
-            mock.call(self.task_uuid, {'status': consts.TaskStatus.RUNNING}),
-            mock.call(self.task_uuid, {'status': consts.TaskStatus.FINISHED})
+            mock.call(self.task_uuid, {"status": consts.TaskStatus.VERIFYING}),
+            mock.call(self.task_uuid, {"status": consts.TaskStatus.RUNNING}),
+            mock.call(self.task_uuid, {"status": consts.TaskStatus.FINISHED})
         ])
         # NOTE(akscram): It looks really awful, but checks degradation.
         mock_task_result_create.assert_called_once_with(
             self.task_uuid,
             {
-                'kw': {
-                    'args': {},
-                    'runner': {
-                        'type': 'constant',
-                        'timeout': 10000,
-                        'times': 3,
-                        'concurrency': 2,
+                "kw": {
+                    "args": {},
+                    "runner": {
+                        "type": "constant",
+                        "timeout": 10000,
+                        "times": 3,
+                        "concurrency": 2,
                     },
-                    'context': {
-                        'users': {
-                            'tenants': 5,
-                            'users_per_tenant': 6,
+                    "context": {
+                        "users": {
+                            "tenants": 5,
+                            "users_per_tenant": 6,
                         }
                     }
                 },
-                'name': 'FakeScenario.fake',
-                'pos': 0,
+                "name": "FakeScenario.fake",
+                "pos": 0,
             },
             {
-                'raw': ['fake_result'],
-                'scenario_duration': 42
+                "raw": ["fake_result"],
+                "scenario_duration": 42
             }
         )
 
@@ -175,35 +177,35 @@ class APITestCase(test.TestCase):
         self.assertRaises(NotImplementedError, api.abort_task,
                           self.task_uuid)
 
-    @mock.patch('rally.objects.task.db.task_delete')
+    @mock.patch("rally.objects.task.db.task_delete")
     def test_delete_task(self, mock_delete):
         api.delete_task(self.task_uuid)
         mock_delete.assert_called_once_with(
             self.task_uuid,
             status=consts.TaskStatus.FINISHED)
 
-    @mock.patch('rally.objects.task.db.task_delete')
+    @mock.patch("rally.objects.task.db.task_delete")
     def test_delete_task_force(self, mock_delete):
         api.delete_task(self.task_uuid, force=True)
         mock_delete.assert_called_once_with(self.task_uuid, status=None)
 
-    @mock.patch('rally.objects.deploy.db.deployment_update')
-    @mock.patch('rally.objects.deploy.db.deployment_create')
+    @mock.patch("rally.objects.deploy.db.deployment_update")
+    @mock.patch("rally.objects.deploy.db.deployment_create")
     def test_create_deploy(self, mock_create, mock_update):
         mock_create.return_value = self.deployment
         mock_update.return_value = self.deployment
-        api.create_deploy(self.deploy_config, 'fake_deploy')
+        api.create_deploy(self.deploy_config, "fake_deploy")
         mock_create.assert_called_once_with({
-            'name': 'fake_deploy',
-            'config': self.deploy_config,
+            "name": "fake_deploy",
+            "config": self.deploy_config,
         })
         mock_update.assert_has_calls([
-            mock.call(self.deploy_uuid, {'endpoints': self.endpoints})
+            mock.call(self.deploy_uuid, self.endpoints)
         ])
 
-    @mock.patch('rally.objects.deploy.db.deployment_delete')
-    @mock.patch('rally.objects.deploy.db.deployment_update')
-    @mock.patch('rally.objects.deploy.db.deployment_get')
+    @mock.patch("rally.objects.deploy.db.deployment_delete")
+    @mock.patch("rally.objects.deploy.db.deployment_update")
+    @mock.patch("rally.objects.deploy.db.deployment_get")
     def test_destroy_deploy(self, mock_get, mock_update, mock_delete):
         mock_get.return_value = self.deployment
         mock_update.return_value = self.deployment
@@ -211,37 +213,37 @@ class APITestCase(test.TestCase):
         mock_get.assert_called_once_with(self.deploy_uuid)
         mock_delete.assert_called_once_with(self.deploy_uuid)
 
-    @mock.patch('rally.objects.deploy.db.deployment_update')
-    @mock.patch('rally.objects.deploy.db.deployment_get')
+    @mock.patch("rally.objects.deploy.db.deployment_update")
+    @mock.patch("rally.objects.deploy.db.deployment_get")
     def test_recreate_deploy(self, mock_get, mock_update):
         mock_get.return_value = self.deployment
         mock_update.return_value = self.deployment
         api.recreate_deploy(self.deploy_uuid)
         mock_get.assert_called_once_with(self.deploy_uuid)
         mock_update.assert_has_calls([
-            mock.call(self.deploy_uuid, {'endpoints': self.endpoints})
+            mock.call(self.deploy_uuid, self.endpoints)
         ])
 
-    @mock.patch('rally.orchestrator.api.objects.Verification')
-    @mock.patch('rally.verification.verifiers.tempest.tempest.Tempest')
+    @mock.patch("rally.orchestrator.api.objects.Verification")
+    @mock.patch("rally.verification.verifiers.tempest.tempest.Tempest")
     def test_verify(self, mock_tempest, mock_verification):
         mock_tempest.return_value = self.tempest
         self.tempest.is_installed.return_value = True
-        api.verify(self.deploy_uuid, 'smoke', None)
+        api.verify(self.deploy_uuid, "smoke", None)
 
         self.tempest.is_installed.assert_called_once_with()
-        self.tempest.verify.assert_called_once_with(set_name='smoke',
+        self.tempest.verify.assert_called_once_with(set_name="smoke",
                                                     regex=None)
 
-    @mock.patch('rally.orchestrator.api.objects.Verification')
-    @mock.patch('rally.verification.verifiers.tempest.tempest.Tempest')
+    @mock.patch("rally.orchestrator.api.objects.Verification")
+    @mock.patch("rally.verification.verifiers.tempest.tempest.Tempest")
     def test_verify_tempest_not_installed(self, mock_tempest,
                                           mock_verification):
         mock_tempest.return_value = self.tempest
         self.tempest.is_installed.return_value = False
-        api.verify(self.deploy_uuid, 'smoke', None)
+        api.verify(self.deploy_uuid, "smoke", None)
 
         self.tempest.is_installed.assert_called_once_with()
         self.tempest.install.assert_called_once_with()
-        self.tempest.verify.assert_called_once_with(set_name='smoke',
+        self.tempest.verify.assert_called_once_with(set_name="smoke",
                                                     regex=None)
diff --git a/tests/verification/verifiers/test_config.py b/tests/verification/verifiers/test_config.py
index 50ffda7b34..28e3518bc3 100644
--- a/tests/verification/verifiers/test_config.py
+++ b/tests/verification/verifiers/test_config.py
@@ -39,7 +39,7 @@ class ConfigTestCase(test.TestCase):
                          "password": "test",
                          "auth_url": "http://test/v2.0",
                          "permission": "admin"}
-        mock_get.return_value = {"endpoints": [self.endpoint]}
+        mock_get.return_value = {"admin": self.endpoint}
         self.deploy_id = "fake_deploy_id"
         self.conf_generator = config.TempestConf(self.deploy_id)
 
@@ -84,7 +84,7 @@ class ConfigTestCase(test.TestCase):
         self.conf_generator.keystoneclient.auth_ref = {
             "serviceCatalog": [{
                 "name": service,
-                "endpoints": [{"publicURL": url}]
+                "admin": {"publicURL": url}
             }]}
         self.assertEqual(self.conf_generator._get_url(service), url)