docs: def _auth(profile=None, api_version=1, **connection_args):
      '''
      Set up heat credentials, returns
      `heatclient.client.Client`. Optional parameter
      "api_version" defaults to 1.
  
      Only intended to be used within heat-enabled modules
      '''
  
      if profile:
          prefix = profile + ':keystone.'
      else:
          prefix = 'keystone.'
  
      def get(key, default=None):
          '''
          Checks connection_args, then salt-minion config,
          falls back to specified default value.
          '''
          return connection_args.get('connection_' + key,
                                     __salt__['config.get'](prefix + key, default))
  
      user = get('user', 'admin')
      password = get('password', None)
      tenant = get('tenant', 'admin')
      tenant_id = get('tenant_id')
      auth_url = get('auth_url', 'http://127.0.0.1:35357/v2.0')
      insecure = get('insecure', False)
      admin_token = get('token')
      region_name = get('region_name', None)
  
      if admin_token and api_version != 1 and not password:
          # If we had a password we could just
          # ignore the admin-token and move on...
          raise SaltInvocationError('Only can use keystone admin token ' +
                                    'with Heat API v1')
      elif password:
          # Can't use the admin-token anyway
          kwargs = {'username': user,
                    'password': password,
                    'tenant_id': tenant_id,
                    'auth_url': auth_url,
                    'region_name': region_name,
                    'tenant_name': tenant}
          # 'insecure' keyword not supported by all v2.0 keystone clients
          #   this ensures it's only passed in when defined
          if insecure:
              kwargs['insecure'] = True
      elif api_version == 1 and admin_token:
          kwargs = {'token': admin_token,
                    'auth_url': auth_url}
      else:
          raise SaltInvocationError('No credentials to authenticate with.')
  
      token = __salt__['keystone.token_get'](profile)
      kwargs['token'] = token['id']
      # This doesn't realy prevent the password to show up
      # in the minion log as keystoneclient.session is
      # logging it anyway when in debug-mode
      kwargs.pop('password')
      try:
          heat_endpoint = __salt__['keystone.endpoint_get']('heat', profile)['url']
      except KeyError:
          heat_endpoint = __salt__['keystone.endpoint_get']('heat', profile)['publicurl']
      heat_endpoint = heat_endpoint % token
      log.debug('Calling heatclient.client.Client(%s, %s, **%s)',
                api_version, heat_endpoint, kwargs)
      # may raise exc.HTTPUnauthorized, exc.HTTPNotFound
      # but we deal with those elsewhere
      return heatclient.client.Client(api_version, endpoint=heat_endpoint, **kwargs)