diff --git a/openstackclient/common/clientmanager.py b/openstackclient/common/clientmanager.py
index 27f3b7055..67912f0cd 100644
--- a/openstackclient/common/clientmanager.py
+++ b/openstackclient/common/clientmanager.py
@@ -41,6 +41,9 @@ class ClientManager(clientmanager.ClientManager):
     # A simple incrementing version for the plugin to know what is available
     PLUGIN_INTERFACE_VERSION = "2"
 
+    # Let the commands set this
+    _auth_required = False
+
     def __init__(
         self,
         cli_options=None,
@@ -72,7 +75,10 @@ class ClientManager(clientmanager.ClientManager):
         #                because openstack_config is an optional argument to
         #                CloudConfig.__init__() and we'll die if it was not
         #                passed.
-        if self._cli_options._openstack_config is not None:
+        if (
+                self._auth_required and
+                self._cli_options._openstack_config is not None
+        ):
             self._cli_options._openstack_config._pw_callback = \
                 shell.prompt_for_password
             try:
@@ -85,6 +91,13 @@ class ClientManager(clientmanager.ClientManager):
 
         return super(ClientManager, self).setup_auth()
 
+    @property
+    def auth_ref(self):
+        if not self._auth_required:
+            return None
+        else:
+            return super(ClientManager, self).auth_ref
+
     def _fallback_load_auth_plugin(self, e):
         # NOTES(RuiChen): Hack to avoid auth plugins choking on data they don't
         #                 expect, delete fake token and endpoint, then try to
diff --git a/openstackclient/shell.py b/openstackclient/shell.py
index 8fdf0b61f..2e384f8fc 100644
--- a/openstackclient/shell.py
+++ b/openstackclient/shell.py
@@ -182,6 +182,12 @@ class OpenStackShell(shell.OpenStackShell):
         #                get_one_Cloud()'s validation to avoid loading plugins
         validate = cmd.auth_required
 
+        # Force skipping auth for commands that do not need it
+        # NOTE(dtroyer): This is here because ClientManager does not have
+        #                visibility into the Command object to get
+        #                auth_required. It needs to move into osc-lib
+        self.client_manager._auth_required = cmd.auth_required
+
         # Validate auth options
         self.cloud = self.cloud_config.get_one_cloud(
             cloud=self.options.cloud,
diff --git a/openstackclient/tests/unit/common/test_clientmanager.py b/openstackclient/tests/unit/common/test_clientmanager.py
index 7f82c35d9..f15f9af1f 100644
--- a/openstackclient/tests/unit/common/test_clientmanager.py
+++ b/openstackclient/tests/unit/common/test_clientmanager.py
@@ -66,4 +66,6 @@ class TestClientManager(osc_lib_test_utils.TestClientManager):
         )
 
         self.assertFalse(client_manager.is_service_available('network'))
-        self.assertFalse(client_manager.is_network_endpoint_enabled())
+        # This is True because ClientManager.auth_ref returns None in this
+        # test; "no service catalog" means use Network API by default now
+        self.assertTrue(client_manager.is_network_endpoint_enabled())