diff --git a/src/util/viridentity.c b/src/util/viridentity.c
index 75c1f685c3768aed0ddac0a275c00b0326331fe9..42d78fb77316192017b02f9aca8caaf24934073e 100644
--- a/src/util/viridentity.c
+++ b/src/util/viridentity.c
@@ -39,6 +39,7 @@ struct _virIdentity {
 };
 
 static virClassPtr virIdentityClass;
+static virThreadLocal virIdentityCurrent;
 
 static void virIdentityDispose(void *obj);
 
@@ -50,11 +51,69 @@ static int virIdentityOnceInit(void)
                                          virIdentityDispose)))
         return -1;
 
+    if (virThreadLocalInit(&virIdentityCurrent,
+                           (virThreadLocalCleanup)virObjectUnref) < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                       _("Cannot initialize thread local for current identity"));
+        return -1;
+    }
+
     return 0;
 }
 
 VIR_ONCE_GLOBAL_INIT(virIdentity)
 
+/**
+ * virIdentityGetCurrent:
+ *
+ * Get the current identity associated with this thread. The
+ * caller will own a reference to the returned identity, but
+ * must not modify the object in any way, other than to
+ * release the reference when done with virObjectUnref
+ *
+ * Returns: a reference to the current identity, or NULL
+ */
+virIdentityPtr virIdentityGetCurrent(void)
+{
+    virIdentityPtr ident;
+
+    if (virIdentityOnceInit() < 0)
+        return NULL;
+
+    ident = virThreadLocalGet(&virIdentityCurrent);
+    return virObjectRef(ident);
+}
+
+
+/**
+ * virIdentitySetCurrent:
+ *
+ * Set the new identity to be associated with this thread.
+ * The caller should not modify the passed identity after
+ * it has been set, other than to release its own reference.
+ *
+ * Returns 0 on success, or -1 on error
+ */
+int virIdentitySetCurrent(virIdentityPtr ident)
+{
+    virIdentityPtr old;
+
+    if (virIdentityOnceInit() < 0)
+        return -1;
+
+    old = virThreadLocalGet(&virIdentityCurrent);
+    virObjectUnref(old);
+
+    if (virThreadLocalSet(&virIdentityCurrent,
+                          virObjectRef(ident)) < 0) {
+        virReportError(VIR_ERR_INTERNAL_ERROR, "%s",
+                       _("Unable to set thread local identity"));
+        return -1;
+    }
+
+    return 0;
+}
+
 
 /**
  * virIdentityNew:
diff --git a/src/util/viridentity.h b/src/util/viridentity.h
index d09bdb00f55e77236f05662ed3cf191dad65fda3..68eae1a7135dcec907c528df09297d9e57a4cee8 100644
--- a/src/util/viridentity.h
+++ b/src/util/viridentity.h
@@ -38,6 +38,9 @@ typedef enum {
       VIR_IDENTITY_ATTR_LAST,
 } virIdentityAttrType;
 
+virIdentityPtr virIdentityGetCurrent(void);
+int virIdentitySetCurrent(virIdentityPtr ident);
+
 virIdentityPtr virIdentityNew(void);
 
 int virIdentitySetAttr(virIdentityPtr ident,