diff --git a/setup.cfg b/setup.cfg
index 5c7008051..2b4aa7c12 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -30,6 +30,7 @@ console_scripts =
     tobiko-create = tobiko.cmd.create:main
     tobiko-delete = tobiko.cmd.delete:main
     tobiko-fixture = tobiko.cmd.fixture:main
+    tobiko-keystone-credentials = tobiko.openstack.keystone._credentials:print_credentials
     tobiko-list = tobiko.cmd.list:main
     tobiko-fault = tobiko.cmd.fault:main
     tobiko = tobiko.cmd.run:main
diff --git a/tobiko/openstack/keystone/_credentials.py b/tobiko/openstack/keystone/_credentials.py
index 44bcc43ea..fe36e4880 100644
--- a/tobiko/openstack/keystone/_credentials.py
+++ b/tobiko/openstack/keystone/_credentials.py
@@ -14,8 +14,10 @@
 from __future__ import absolute_import
 
 import collections
+import sys
 
 from oslo_log import log
+import yaml
 
 import tobiko
 
@@ -265,3 +267,11 @@ def api_version_from_url(auth_url):
         LOG.warning('Unable to get Keystone API version from auth_url:  %r',
                     auth_url)
         return None
+
+
+def print_credentials():
+    credentials = default_keystone_credentials()
+    yaml.dump(dict(credentials.to_dict()),
+              sys.stdout,
+              indent=4,
+              sort_keys=True)
diff --git a/tobiko/tests/functional/openstack/test_keystone.py b/tobiko/tests/functional/openstack/test_keystone.py
new file mode 100644
index 000000000..b64700e3b
--- /dev/null
+++ b/tobiko/tests/functional/openstack/test_keystone.py
@@ -0,0 +1,60 @@
+# Copyright (c) 2019 Red Hat, Inc.
+#
+# All Rights Reserved.
+#
+#    Licensed under the Apache License, Version 2.0 (the "License"); you may
+#    not use this file except in compliance with the License. You may obtain
+#    a copy of the License at
+#
+#         http://www.apache.org/licenses/LICENSE-2.0
+#
+#    Unless required by applicable law or agreed to in writing, software
+#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#    License for the specific language governing permissions and limitations
+#    under the License.
+from __future__ import absolute_import
+
+import contextlib
+import os
+import subprocess
+
+import testtools
+import yaml
+
+from tobiko.openstack import keystone
+
+
+class TobikoKeystoneCredentialsCommandTest(testtools.TestCase):
+
+    def test_execute(self):
+        with execute('tobiko-keystone-credentials') as process:
+            actual = yaml.full_load(process.stdout)
+
+        expected = keystone.default_keystone_credentials().to_dict()
+        self.assertEqual(expected, actual)
+
+
+@contextlib.contextmanager
+def execute(command, check_exit_status=0):
+    process = subprocess.Popen(command,
+                               shell=True,
+                               env=os.environ,
+                               stdout=subprocess.PIPE,
+                               stderr=subprocess.PIPE,
+                               universal_newlines=True)
+
+    try:
+        yield process
+
+        process.wait()
+        if (check_exit_status is not None and
+                check_exit_status != process.returncode):
+            error = process.stderr.read()
+            message = "Unexpected exit status ({!s}):\n{!s}".format(
+                process.returncode, error)
+            raise RuntimeError(message)
+
+    finally:
+        if process.returncode is None:
+            process.kill()
diff --git a/tools/ci/keystone-credentials b/tools/ci/keystone-credentials
new file mode 100755
index 000000000..9b8eaf04b
--- /dev/null
+++ b/tools/ci/keystone-credentials
@@ -0,0 +1,18 @@
+#!/bin/bash
+
+set -eu
+
+source $(dirname "$0")/activate
+source $(dirname "$0")/os
+
+
+function keystone_credentials {
+    os_setup
+
+    tobiko-keystone-credentials "$@"
+}
+
+
+if [ $(basename "$0") == keystone-credentials ]; then
+    keystone_credentials "$@"
+fi