diff --git a/openstack_auth/models.py b/openstack_auth/models.py
new file mode 100644
index 0000000..76cfc2a
--- /dev/null
+++ b/openstack_auth/models.py
@@ -0,0 +1,15 @@
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#    http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
+# implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# import the User model in here so Django can find it
+from openstack_auth.user import User        # noqa
diff --git a/openstack_auth/user.py b/openstack_auth/user.py
index 72c8638..dd68b0f 100644
--- a/openstack_auth/user.py
+++ b/openstack_auth/user.py
@@ -16,6 +16,7 @@
 
 from django.conf import settings
 from django.contrib.auth import models
+from django.db import models as db_models
 from keystoneclient.common import cms as keystone_cms
 from keystoneclient import exceptions as keystone_exceptions
 import six
@@ -189,6 +190,10 @@ class User(models.AbstractBaseUser, models.AnonymousUser):
         Unscoped Keystone token.
 
     """
+
+    keystone_user_id = db_models.CharField(primary_key=True, max_length=256)
+    USERNAME_FIELD = 'keystone_user_id'
+
     def __init__(self, id=None, token=None, user=None, tenant_id=None,
                  service_catalog=None, tenant_name=None, roles=None,
                  authorized_tenants=None, endpoint=None, enabled=False,
@@ -199,6 +204,7 @@ def __init__(self, id=None, token=None, user=None, tenant_id=None,
         self.id = id
         self.pk = id
         self.token = token
+        self.keystone_user_id = id
         self.username = user
         self.user_domain_id = user_domain_id
         self.user_domain_name = user_domain_name