diff --git a/keystonemiddleware/opts.py b/keystonemiddleware/opts.py
new file mode 100644
index 00000000..6abea9d2
--- /dev/null
+++ b/keystonemiddleware/opts.py
@@ -0,0 +1,49 @@
+# Copyright (c) 2014 OpenStack Foundation.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+__all__ = [
+    'list_auth_token_opts',
+]
+
+import copy
+
+import keystonemiddleware.auth_token
+
+
+auth_token_opts = [
+    ('keystone_authtoken', keystonemiddleware.auth_token._OPTS)
+]
+
+
+def list_auth_token_opts():
+    """Return a list of oslo.config options available in auth_token middleware.
+
+    The returned list includes all oslo.config options which may be registered
+    at runtime by the project.
+
+    Each element of the list is a tuple. The first element is the name of the
+    group under which the list of elements in the second element will be
+    registered. A group name of None corresponds to the [DEFAULT] group in
+    config files.
+
+    This function is also discoverable via the entry point
+    'keystonemiddleware.auth_token' under the 'oslo.config.opts'
+    namespace.
+
+    The purpose of this is to allow tools like the Oslo sample config file
+    generator to discover the options exposed to users by this middleware.
+
+    :returns: a list of (group_name, opts) tuples
+    """
+    return [(g, copy.deepcopy(o)) for g, o in auth_token_opts]
diff --git a/keystonemiddleware/tests/test_opts.py b/keystonemiddleware/tests/test_opts.py
new file mode 100644
index 00000000..d6839b21
--- /dev/null
+++ b/keystonemiddleware/tests/test_opts.py
@@ -0,0 +1,79 @@
+# Copyright (c) 2014 OpenStack Foundation.
+#
+# Licensed under the Apache License, Version 2.0 (the "License"); you may
+# not use this file except in compliance with the License. You may obtain
+# a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+# License for the specific language governing permissions and limitations
+# under the License.
+
+import pkg_resources
+from testtools import matchers
+
+from keystonemiddleware import opts
+from keystonemiddleware.tests import utils
+
+
+class OptsTestCase(utils.TestCase):
+
+    def _test_list_auth_token_opts(self, result):
+        self.assertThat(result, matchers.HasLength(1))
+
+        for group in (g for (g, _l) in result):
+            self.assertEqual('keystone_authtoken', group)
+
+        expected_opt_names = [
+            'auth_admin_prefix',
+            'auth_host',
+            'auth_port',
+            'auth_protocol',
+            'auth_uri',
+            'identity_uri',
+            'auth_version',
+            'delay_auth_decision',
+            'http_connect_timeout',
+            'http_request_max_retries',
+            'admin_token',
+            'admin_user',
+            'admin_password',
+            'admin_tenant_name',
+            'cache',
+            'certfile',
+            'keyfile',
+            'cafile',
+            'insecure',
+            'signing_dir',
+            'memcached_servers',
+            'token_cache_time',
+            'revocation_cache_time',
+            'memcache_security_strategy',
+            'memcache_secret_key',
+            'include_service_catalog',
+            'enforce_token_bind',
+            'check_revocations_for_cached',
+            'hash_algorithms'
+        ]
+        opt_names = [o.name for (g, l) in result for o in l]
+        self.assertThat(opt_names, matchers.HasLength(len(expected_opt_names)))
+
+        for opt in opt_names:
+            self.assertIn(opt, expected_opt_names)
+
+    def test_list_auth_token_opts(self):
+        self._test_list_auth_token_opts(opts.list_auth_token_opts())
+
+    def test_entry_point(self):
+        result = None
+        for ep in pkg_resources.iter_entry_points('oslo.config.opts'):
+            if ep.name == 'keystonemiddleware.auth_token':
+                list_fn = ep.load()
+                result = list_fn()
+                break
+
+        self.assertIsNotNone(result)
+        self._test_list_auth_token_opts(result)
diff --git a/setup.cfg b/setup.cfg
index 62298f09..a24cbb5b 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -27,6 +27,10 @@ packages =
 setup-hooks =
     pbr.hooks.setup_hook
 
+[entry_points]
+oslo.config.opts =
+    keystonemiddleware.auth_token = keystonemiddleware.opts:list_auth_token_opts
+
 [build_sphinx]
 source-dir = doc/source
 build-dir = doc/build