@@ -13,6 +13,19 @@ compute and network services.
    :command: availability zone list
 
 
+cloud cache
+-----------
+
+Authentication is cached in the keyring between invocations when the
+``cache.auth`` setting is enabled in ``clouds.yaml``. This deletes what is
+cached for a cloud, so that the next command authenticates again. For a plugin
+that authenticates in a browser, such as ``v3websso``, that means logging in
+again.
+
+.. autoprogram-cliff:: openstack.common
+   :command: cloud cache delete
+
+
 command
 -------
 
 
@@ -0,0 +1,40 @@
+#   Licensed under the Apache License, Version 2.0 (the "License"); you may
+#   not use this file except in compliance with the License. You may obtain
+#   a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#   WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#   License for the specific language governing permissions and limitations
+#   under the License.
+#
+
+"""Cloud action implementations"""
+
+import argparse
+
+from openstackclient import command
+from openstackclient.i18n import _
+
+
+class DeleteCloudCache(command.Command):
+    _description = _("Delete the authentication cached for a cloud")
+
+    # Authenticating in order to throw away the credential that would have
+    # been used to do it makes no sense, and would defeat the point when the
+    # cached credential is the broken thing being cleared.
+    auth_required = False
+
+    def get_parser(self, prog_name: str) -> argparse.ArgumentParser:
+        parser = super().get_parser(prog_name)
+        parser.epilog = _(
+            "Authentication is only cached when the 'cache.auth' setting is "
+            "enabled in clouds.yaml. Without it there is nothing stored and "
+            "nothing to delete."
+        )
+        return parser
+
+    def take_action(self, parsed_args: argparse.Namespace) -> None:
+        self.app.client_manager._cli_options.clear_auth_cache()
@@ -0,0 +1,48 @@
+#   Licensed under the Apache License, Version 2.0 (the "License"); you may
+#   not use this file except in compliance with the License. You may obtain
+#   a copy of the License at
+#
+#        http://www.apache.org/licenses/LICENSE-2.0
+#
+#   Unless required by applicable law or agreed to in writing, software
+#   distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
+#   WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
+#   License for the specific language governing permissions and limitations
+#   under the License.
+#
+
+from unittest import mock
+
+import fixtures
+
+from openstackclient.common import cloud
+from openstackclient.tests.unit import utils
+
+
+class TestDeleteCloudCache(utils.TestCommand):
+    def setUp(self):
+        super().setUp()
+
+        self.cmd = cloud.DeleteCloudCache(self.app, None)
+        # The fake client manager has no cloud region of its own.
+        self.cloud_region = self.useFixture(
+            fixtures.MockPatchObject(
+                self.app.client_manager,
+                '_cli_options',
+                mock.Mock(),
+                create=True,
+            )
+        ).mock
+
+    def test_delete(self):
+        parsed_args = self.check_parser(self.cmd, [], [])
+
+        self.cmd.take_action(parsed_args)
+
+        self.cloud_region.clear_auth_cache.assert_called_once_with()
+
+    def test_does_not_authenticate(self):
+        # Authenticating in order to discard the credential that would be used
+        # to do it is pointless, and impossible when that credential is the
+        # broken thing being cleared.
+        self.assertFalse(self.cmd.auth_required)
@@ -47,6 +47,7 @@ volume = "openstackclient.volume.client"
 
 [project.entry-points."openstack.common"]
 availability_zone_list = "openstackclient.common.availability_zone:ListAvailabilityZone"
+cloud_cache_delete = "openstackclient.common.cloud:DeleteCloudCache"
 configuration_show = "openstackclient.common.configuration:ShowConfiguration"
 extension_list = "openstackclient.common.extension:ListExtension"
 extension_show = "openstackclient.common.extension:ShowExtension"
 
@@ -0,0 +1,10 @@
+---
+features:
+  - |
+    Added the ``cloud cache delete`` command, which deletes the authentication
+    cached in the keyring for a cloud so that the next command authenticates
+    again. Use it when the cached credential has been revoked, or to switch to
+    a different account with a plugin that authenticates in a browser.
+
+    Authentication is only cached when the ``cache.auth`` setting is enabled
+    in ``clouds.yaml``.