diff --git a/tobiko/openstack/keystone/__init__.py b/tobiko/openstack/keystone/__init__.py
index 5e47e0e46..561f39da7 100644
--- a/tobiko/openstack/keystone/__init__.py
+++ b/tobiko/openstack/keystone/__init__.py
@@ -32,7 +32,11 @@ get_keystone_credentials = _credentials.get_keystone_credentials
 default_keystone_credentials = _credentials.default_keystone_credentials
 KeystoneCredentials = _credentials.KeystoneCredentials
 KeystoneCredentialsFixture = _credentials.KeystoneCredentialsFixture
+EnvironKeystoneCredentialsFixture = \
+    _credentials.EnvironKeystoneCredentialsFixture
 InvalidKeystoneCredentials = _credentials.InvalidKeystoneCredentials
+DEFAULT_KEYSTONE_CREDENTIALS_FIXTURES = \
+    _credentials.DEFAULT_KEYSTONE_CREDENTIALS_FIXTURES
 
 has_service = _services.has_service
 is_service_missing = _services.is_service_missing
diff --git a/tobiko/openstack/keystone/_credentials.py b/tobiko/openstack/keystone/_credentials.py
index 5f65b2552..86e168fbc 100644
--- a/tobiko/openstack/keystone/_credentials.py
+++ b/tobiko/openstack/keystone/_credentials.py
@@ -14,6 +14,7 @@
 from __future__ import absolute_import
 
 import collections
+import os
 import sys
 
 from oslo_log import log
@@ -147,25 +148,40 @@ class KeystoneCredentialsFixture(tobiko.SharedFixture):
 
 class EnvironKeystoneCredentialsFixture(KeystoneCredentialsFixture):
 
+    environ = None
+
+    def __init__(self, credentials=None, environ=None):
+        super(EnvironKeystoneCredentialsFixture, self).__init__(
+            credentials=credentials)
+        if environ is not None:
+            self.environ = environ
+
+    def setup_fixture(self):
+        if self.environ is None:
+            self.environ = self.get_environ()
+        super(EnvironKeystoneCredentialsFixture, self).setup_fixture()
+
+    def get_environ(self):
+        return os.environ
+
     def get_credentials(self):
-        from tobiko import config
-        auth_url = config.get_env('OS_AUTH_URL')
+        auth_url = self.get_env('OS_AUTH_URL')
         if not auth_url:
             LOG.debug("OS_AUTH_URL environment variable not defined")
             return None
 
         api_version = (
-            config.get_int_env('OS_IDENTITY_API_VERSION') or
+            self.get_int_env('OS_IDENTITY_API_VERSION') or
             api_version_from_url(auth_url))
         username = (
-            config.get_env('OS_USERNAME') or
-            config.get_env('OS_USER_ID'))
-        password = config.get_env('OS_PASSWORD')
+            self.get_env('OS_USERNAME') or
+            self.get_env('OS_USER_ID'))
+        password = self.get_env('OS_PASSWORD')
         project_name = (
-            config.get_env('OS_PROJECT_NAME') or
-            config.get_env('OS_TENANT_NAME') or
-            config.get_env('OS_PROJECT_ID') or
-            config.get_env('OS_TENANT_ID'))
+            self.get_env('OS_PROJECT_NAME') or
+            self.get_env('OS_TENANT_NAME') or
+            self.get_env('OS_PROJECT_ID') or
+            self.get_env('OS_TENANT_ID'))
         if api_version == 2:
             return keystone_credentials(
                 api_version=api_version,
@@ -175,16 +191,16 @@ class EnvironKeystoneCredentialsFixture(KeystoneCredentialsFixture):
                 project_name=project_name)
         else:
             domain_name = (
-                config.get_env('OS_DOMAIN_NAME') or
-                config.get_env('OS_DOMAIN_ID'))
+                self.get_env('OS_DOMAIN_NAME') or
+                self.get_env('OS_DOMAIN_ID'))
             user_domain_name = (
-                config.get_env('OS_USER_DOMAIN_NAME') or
-                config.get_env('OS_USER_DOMAIN_ID'))
+                self.get_env('OS_USER_DOMAIN_NAME') or
+                self.get_env('OS_USER_DOMAIN_ID'))
             project_domain_name = (
-                config.get_env('OS_PROJECT_DOMAIN_NAME'))
+                self.get_env('OS_PROJECT_DOMAIN_NAME'))
             project_domain_id = (
-                config.get_env('OS_PROJECT_DOMAIN_ID'))
-            trust_id = config.get_env('OS_TRUST_ID')
+                self.get_env('OS_PROJECT_DOMAIN_ID'))
+            trust_id = self.get_env('OS_TRUST_ID')
             return keystone_credentials(
                 api_version=api_version,
                 auth_url=auth_url,
@@ -197,6 +213,15 @@ class EnvironKeystoneCredentialsFixture(KeystoneCredentialsFixture):
                 project_domain_id=project_domain_id,
                 trust_id=trust_id)
 
+    def get_env(self, name):
+        return self.environ.get(name, None)
+
+    def get_int_env(self, name):
+        value = self.get_env(name=name)
+        if value is not None:
+            value = int(value)
+        return value
+
 
 class ConfigKeystoneCredentialsFixture(KeystoneCredentialsFixture):
 
diff --git a/tobiko/tripleo/config.py b/tobiko/tripleo/config.py
index 28d6ded42..20a4c3438 100644
--- a/tobiko/tripleo/config.py
+++ b/tobiko/tripleo/config.py
@@ -41,9 +41,17 @@ OPTIONS = [
 
 
 def register_tobiko_options(conf):
-
     conf.register_opts(group=cfg.OptGroup(GROUP_NAME), opts=OPTIONS)
 
 
 def list_options():
     return [(GROUP_NAME, itertools.chain(OPTIONS))]
+
+
+def setup_tobiko_config(conf):
+    # pylint: disable=unused-argument
+    from tobiko.openstack import keystone
+    from tobiko.tripleo import undercloud
+    if undercloud.has_undercloud():
+        keystone.DEFAULT_KEYSTONE_CREDENTIALS_FIXTURES.append(
+            undercloud.OvercloudKeystoneCredentialsFixture)
diff --git a/tobiko/tripleo/undercloud.py b/tobiko/tripleo/undercloud.py
index 65737f94b..d9d851c0d 100644
--- a/tobiko/tripleo/undercloud.py
+++ b/tobiko/tripleo/undercloud.py
@@ -1,9 +1,10 @@
 from __future__ import absolute_import
 
 import tobiko
+from tobiko import config
+from tobiko.openstack import keystone
 from tobiko.shell import ssh
 from tobiko.shell import sh
-from tobiko import config
 
 CONF = config.CONF
 
@@ -35,14 +36,25 @@ def load_overcloud_rcfile():
     return fetch_os_env(rcfile=CONF.tobiko.tripleo.overcloud_rcfile)
 
 
+class UndercloudKeystoneCredentialsFixture(
+        keystone.EnvironKeystoneCredentialsFixture):
+    def get_environ(self):
+        return load_undercloud_rcfile()
+
+
+class OvercloudKeystoneCredentialsFixture(
+        keystone.EnvironKeystoneCredentialsFixture):
+    def get_environ(self):
+        return load_overcloud_rcfile()
+
+
 def has_undercloud():
     host_config = undercloud_host_config()
     return bool(host_config.hostname)
 
 
 skip_if_missing_undercloud = tobiko.skip_unless(
-    'TripleO Undercloud hostname is not configured',
-    has_undercloud)
+    'TripleO undercloud hostname not configured', has_undercloud)
 
 
 class UndecloudHostConfig(tobiko.SharedFixture):