diff --git a/labs/config/credentials b/labs/config/credentials
index 5ebc9dc8..46693707 100644
--- a/labs/config/credentials
+++ b/labs/config/credentials
@@ -26,6 +26,11 @@
 : ${ADMIN_USER_NAME:=admin}
 : ${ADMIN_PASSWORD:=admin_pass}
 
+# Tenant name, user name and password for normal (demo) user
+: ${DEMO_TENANT_NAME:=demo}
+: ${DEMO_USER_NAME:=demo}
+: ${DEMO_PASSWORD:=demo_pass}
+
 # OpenStack Services needs to be affiliated with a tenant to provide
 # authentication to other OpenStack services. We create a "service" tenant for
 # the OpenStack services. All the OpenStack services will be registered via
diff --git a/labs/config/demo-openstackrc.sh b/labs/config/demo-openstackrc.sh
new file mode 100644
index 00000000..ffa1218b
--- /dev/null
+++ b/labs/config/demo-openstackrc.sh
@@ -0,0 +1,15 @@
+# The variables in this file are exported for use by OpenStack client
+# applications.
+
+# Unlike a regular openstackrc.sh file, this file gets its variable values
+# from other configuration files (to limit redundancy).
+
+# Use BASH_SOURCE so the file works when sourced from a shell, too
+CONFIG_DIR=$(dirname "$BASH_SOURCE")
+source "$CONFIG_DIR/openstack"
+source "$CONFIG_DIR/credentials"
+
+export OS_USERNAME=$DEMO_USER_NAME
+export OS_PASSWORD=$DEMO_PASSWORD
+export OS_TENANT_NAME=$DEMO_TENANT_NAME
+export OS_AUTH_URL="http://controller-mgmt:5000/v2.0"
diff --git a/labs/config/scripts.controller b/labs/config/scripts.controller
index 513bfc62..0749c93f 100644
--- a/labs/config/scripts.controller
+++ b/labs/config/scripts.controller
@@ -9,6 +9,7 @@ scripts setup_cinder_controller.sh
 scripts setup_cinder_volumes.sh
 scripts setup_horizon.sh
 scripts config_external_network.sh
+scripts config_demo_user.sh
 scripts shutdown.sh
 boot
 wait_for_shutdown
diff --git a/labs/scripts/config_demo_user.sh b/labs/scripts/config_demo_user.sh
new file mode 100755
index 00000000..3633467c
--- /dev/null
+++ b/labs/scripts/config_demo_user.sh
@@ -0,0 +1,28 @@
+#!/usr/bin/env bash
+TOP_DIR=$(cd $(dirname "$0")/.. && pwd)
+source "$TOP_DIR/config/paths"
+source "$CONFIG_DIR/credentials"
+source "$LIB_DIR/functions.guest"
+source "$CONFIG_DIR/admin-openstackrc.sh"
+exec_logfile
+
+indicate_current_auto
+
+#------------------------------------------------------------------------------
+# Create a normal user
+#------------------------------------------------------------------------------
+
+echo "Creating the demo user."
+keystone user-create \
+    --name="$DEMO_USER_NAME" \
+    --pass="$DEMO_PASSWORD" \
+    --email=demo@example.com
+
+echo "Creating the demo tenant."
+keystone tenant-create --name="$DEMO_TENANT_NAME" --description="Demo Tenant"
+
+echo "Linking the demo user, _member_ role, and demo tenant."
+keystone user-role-add \
+    --user "$DEMO_USER_NAME" \
+    --role _member_ \
+    --tenant "$DEMO_TENANT_NAME"