diff --git a/keystone/common/config.py b/keystone/common/config.py
index 553e6add0e..c8ddeb0ba4 100644
--- a/keystone/common/config.py
+++ b/keystone/common/config.py
@@ -14,6 +14,7 @@
 
 from oslo_config import cfg
 import oslo_messaging
+import passlib.utils
 
 
 _DEFAULT_AUTH_METHODS = ['external', 'password', 'token', 'oauth1']
@@ -158,6 +159,7 @@ FILE_OPTIONS = {
                         'no effect unless global and identity caching are '
                         'enabled.'),
         cfg.IntOpt('max_password_length', default=4096,
+                   max=passlib.utils.MAX_PASSWORD_SIZE,
                    help='Maximum supported length for user passwords; '
                         'decrease to improve performance.'),
         cfg.IntOpt('list_limit',