diff --git a/etc/glance-api.conf b/etc/glance-api.conf
index 5d65809d74..87facb081e 100644
--- a/etc/glance-api.conf
+++ b/etc/glance-api.conf
@@ -133,9 +133,13 @@ delayed_delete = False
 
 [pipeline:glance-api]
 pipeline = versionnegotiation context apiv1app
+# NOTE: use the following pipeline for keystone
+# pipeline = versionnegotiation authtoken context apiv1app
 
 # To enable Image Cache Management API replace pipeline with below:
-# pipeline = versionnegotiation imagecache apiv1app
+# pipeline = versionnegotiation context imagecache apiv1app
+# NOTE: use the following pipeline for keystone auth (with caching)
+# pipeline = versionnegotiation authtoken context imagecache apiv1app
 
 [pipeline:versions]
 pipeline = versionsapp
@@ -154,3 +158,14 @@ paste.filter_factory = glance.api.middleware.image_cache:filter_factory
 
 [filter:context]
 paste.filter_factory = glance.common.context:filter_factory
+
+[filter:authtoken]
+paste.filter_factory = keystone.middleware.auth_token:filter_factory
+service_protocol = http
+service_host = 127.0.0.1
+service_port = 5000
+auth_host = 127.0.0.1
+auth_port = 5001
+auth_protocol = http
+auth_uri = http://127.0.0.1:5000/
+admin_token = 999888777666
diff --git a/etc/glance-registry.conf b/etc/glance-registry.conf
index 48a0ff8e34..2a648ea84e 100644
--- a/etc/glance-registry.conf
+++ b/etc/glance-registry.conf
@@ -42,6 +42,8 @@ limit_param_default = 25
 
 [pipeline:glance-registry]
 pipeline = context registryapp
+# NOTE: use the following pipeline for keystone
+# pipeline = authtoken keystone_shim context registryapp
 
 [app:registryapp]
 paste.app_factory = glance.registry.server:app_factory
@@ -49,3 +51,17 @@ paste.app_factory = glance.registry.server:app_factory
 [filter:context]
 context_class = glance.registry.context.RequestContext
 paste.filter_factory = glance.common.context:filter_factory
+
+[filter:authtoken]
+paste.filter_factory = keystone.middleware.auth_token:filter_factory
+service_protocol = http
+service_host = 127.0.0.1
+service_port = 5000
+auth_host = 127.0.0.1
+auth_port = 5001
+auth_protocol = http
+auth_uri = http://127.0.0.1:5000/
+admin_token = 999888777666
+
+[filter:keystone_shim]
+paste.filter_factory = keystone.middleware.glance_auth_token:filter_factory