diff --git a/lib/puppet/provider/keystone_paste_ini/ini_setting.rb b/lib/puppet/provider/keystone_paste_ini/ini_setting.rb
new file mode 100644
index 000000000..23a47af65
--- /dev/null
+++ b/lib/puppet/provider/keystone_paste_ini/ini_setting.rb
@@ -0,0 +1,27 @@
+Puppet::Type.type(:keystone_paste_ini).provide(
+  :ini_setting,
+  :parent => Puppet::Type.type(:ini_setting).provider(:ruby)
+) do
+
+  def section
+    resource[:name].split('/', 2).first
+  end
+
+  def setting
+    resource[:name].split('/', 2).last
+  end
+
+  def separator
+    '='
+  end
+
+  def self.file_path
+    '/etc/keystone/keystone-paste.ini'
+  end
+
+  # this needs to be removed. This has been replaced with the class method
+  def file_path
+    self.class.file_path
+  end
+
+end
diff --git a/lib/puppet/type/keystone_paste_ini.rb b/lib/puppet/type/keystone_paste_ini.rb
new file mode 100644
index 000000000..e315a9570
--- /dev/null
+++ b/lib/puppet/type/keystone_paste_ini.rb
@@ -0,0 +1,43 @@
+Puppet::Type.newtype(:keystone_paste_ini) do
+
+  ensurable
+
+  newparam(:name, :namevar => true) do
+    desc 'Section/setting name to manage from keystone/keystone-paste.ini'
+    newvalues(/\S+\/\S+/)
+  end
+
+  newproperty(:value) do
+    desc 'The value of the setting to be defined.'
+    munge do |value|
+      value = value.to_s.strip
+      value.capitalize! if value =~ /^(true|false)$/i
+      value
+    end
+
+    def is_to_s( currentvalue )
+      if resource.secret?
+        return '[old secret redacted]'
+      else
+        return currentvalue
+      end
+    end
+
+    def should_to_s( newvalue )
+      if resource.secret?
+        return '[new secret redacted]'
+      else
+        return newvalue
+      end
+    end
+  end
+
+  newparam(:secret, :boolean => true) do
+    desc 'Whether to hide the value from Puppet logs. Defaults to `false`.'
+
+    newvalues(:true, :false)
+
+    defaultto false
+  end
+
+end
diff --git a/spec/unit/provider/keystone_paste_ini/ini_setting_spec.rb b/spec/unit/provider/keystone_paste_ini/ini_setting_spec.rb
new file mode 100644
index 000000000..2eff5d63f
--- /dev/null
+++ b/spec/unit/provider/keystone_paste_ini/ini_setting_spec.rb
@@ -0,0 +1,29 @@
+#
+# these tests are a little concerning b/c they are hacking around the
+# modulepath, so these tests will not catch issues that may eventually arise
+# related to loading these plugins.
+# I could not, for the life of me, figure out how to programatcally set the modulepath
+$LOAD_PATH.push(
+  File.join(
+    File.dirname(__FILE__),
+    '..',
+    '..',
+    '..',
+    'fixtures',
+    'modules',
+    'inifile',
+    'lib')
+)
+require 'spec_helper'
+provider_class = Puppet::Type.type(:keystone_paste_ini).provider(:ini_setting)
+describe provider_class do
+
+  it 'should allow setting to be set explicitly' do
+    resource = Puppet::Type::Keystone_paste_ini.new(
+      {:name => 'dude/foo', :value => 'bar'}
+    )
+    provider = provider_class.new(resource)
+    provider.section.should == 'dude'
+    provider.setting.should == 'foo'
+  end
+end
diff --git a/spec/unit/type/keystone_paste_ini_spec.rb b/spec/unit/type/keystone_paste_ini_spec.rb
new file mode 100644
index 000000000..98f7157b6
--- /dev/null
+++ b/spec/unit/type/keystone_paste_ini_spec.rb
@@ -0,0 +1,23 @@
+require 'spec_helper'
+# this hack is required for now to ensure that the path is set up correctly
+# to retrive the parent provider
+$LOAD_PATH.push(
+  File.join(
+    File.dirname(__FILE__),
+    '..',
+    '..',
+    'fixtures',
+    'modules',
+    'inifile',
+    'lib')
+)
+require 'puppet/type/keystone_paste_ini'
+describe 'Puppet::Type.type(:keystone_paste_ini)' do
+  before :each do
+    @keystone_paste_ini = Puppet::Type.type(:keystone_paste_ini).new(:name => 'DEFAULT/foo', :value => 'bar')
+  end
+  it 'should accept a valid value' do
+    @keystone_paste_ini[:value] = 'bar'
+    @keystone_paste_ini[:value].should == 'bar'
+  end
+end