diff --git a/README.rst b/README.rst
index a3a507c..6c97682 100644
--- a/README.rst
+++ b/README.rst
@@ -895,6 +895,30 @@
           max_retries: '-1'
           max_overflow: 40
 
+Configure cinder to use service user tokens:
+========
+Long-running operations such as snapshot can sometimes overrun the expiry of the user token.
+In such cases, post operations such as cleaning up after a snapshot can fail when the
+cinder service needs to cleanup resources.
+
+This pillar enables cinder to use service user tokens to supplement the regular user token
+used to initiate the operation. The identity service (keystone) will then authenticate
+a request using the service user token if the user token has already expired.
+
+.. code-block:: yaml
+
+   cinder:
+     controller:
+     enabled: True
+     ...
+       service_user:
+         enabled: True
+         auth_type: password
+         user_domain_id: default
+         project_domain_id: default
+         project_name: service
+         username: cinder
+         password: pswd
 
 Upgrades
 ========
diff --git a/cinder/files/queens/cinder.conf.controller.Debian b/cinder/files/queens/cinder.conf.controller.Debian
index d034ef5..9cb21bd 100644
--- a/cinder/files/queens/cinder.conf.controller.Debian
+++ b/cinder/files/queens/cinder.conf.controller.Debian
@@ -3247,6 +3247,15 @@
 # When True, if sending a user token to an REST API, also send a service token.
 #  (boolean value)
 #send_service_user_token = false
+{%- if controller.get('service_user', {}).get('enabled', True) %}
+send_service_user_token = True
+{%- set _data = {} %}
+{%- do _data.update(controller.get('identity', {})) %}
+{%- do _data.update(controller.get('service_user', {})) %}
+{%- if not _data.port == '5000' %}{% do _data.update({'port': '5000'}) %}{% endif %}
+{%- if 'cacert_file' not in _data.keys() %}{% do _data.update({'cacert_file': controller.cacert_file}) %}{% endif %}
+{%- include "oslo_templates/files/queens/keystoneauth/_type_"+ _data.get('auth_type','password') +".conf" %}
+{%- endif %}
 
 {%- if controller.get('barbican', {}).get('enabled', False) %}
 {%- set _data = controller.identity %}
diff --git a/cinder/files/queens/cinder.conf.volume.Debian b/cinder/files/queens/cinder.conf.volume.Debian
index 3c60abc..195ee91 100644
--- a/cinder/files/queens/cinder.conf.volume.Debian
+++ b/cinder/files/queens/cinder.conf.volume.Debian
@@ -3249,6 +3249,15 @@
 # When True, if sending a user token to an REST API, also send a service token.
 #  (boolean value)
 #send_service_user_token = false
+{%- if volume.get('service_user', {}).get('enabled', True) %}
+send_service_user_token = True
+{%- set _data = {} %}
+{%- do _data.update(volume.get('identity', {})) %}
+{%- do _data.update(volume.get('service_user', {})) %}
+{%- if not _data.port == '5000' %}{% do _data.update({'port': '5000'}) %}{% endif %}
+{%- if 'cacert_file' not in _data.keys() %}{% do _data.update({'cacert_file': volume.cacert_file}) %}{% endif %}
+{%- include "oslo_templates/files/queens/keystoneauth/_type_"+ _data.get('auth_type','password') +".conf" %}
+{%- endif %}
 
 {%- if volume.get('barbican', {}).get('enabled', False) %}
 {%- set _data = volume.identity %}
diff --git a/cinder/files/rocky/cinder.conf.controller.Debian b/cinder/files/rocky/cinder.conf.controller.Debian
index 7f349b3..e94b3fa 100644
--- a/cinder/files/rocky/cinder.conf.controller.Debian
+++ b/cinder/files/rocky/cinder.conf.controller.Debian
@@ -4016,6 +4016,14 @@
 # When True, if sending a user token to an REST API, also send a service token.
 #  (boolean value)
 #send_service_user_token = false
+{%- if controller.get('service_user', {}).get('enabled', True) %}
+send_service_user_token = True
+{%- set _data = {} %}
+{%- do _data.update(controller.get('identity', {})) %}
+{%- do _data.update(controller.get('service_user', {})) %}
+{%- if not _data.port == '5000' %}{% do _data.update({'port': '5000'}) %}{% endif %}
+{%- if 'cacert_file' not in _data.keys() %}{% do _data.update({'cacert_file': controller.cacert_file}) %}{% endif %}
+{%- include "oslo_templates/files/" ~ controller.version ~ "/keystoneauth/_type_"+ _data.get('auth_type','password') +".conf" %}
 
 # PEM encoded Certificate Authority to use when verifying HTTPs connections.
 # (string value)
@@ -4038,6 +4046,7 @@
 
 # Log requests to multiple loggers. (boolean value)
 #split_loggers = false
+{%- endif %}
 
 
 [ssl]
diff --git a/cinder/files/rocky/cinder.conf.volume.Debian b/cinder/files/rocky/cinder.conf.volume.Debian
index 2bbe2ba..11242fe 100644
--- a/cinder/files/rocky/cinder.conf.volume.Debian
+++ b/cinder/files/rocky/cinder.conf.volume.Debian
@@ -4019,6 +4019,14 @@
 # When True, if sending a user token to an REST API, also send a service token.
 #  (boolean value)
 #send_service_user_token = false
+{%- if volume.get('service_user', {}).get('enabled', True) %}
+send_service_user_token = True
+{%- set _data = {} %}
+{%- do _data.update(volume.get('identity', {})) %}
+{%- do _data.update(volume.get('service_user', {})) %}
+{%- if not _data.port == '5000' %}{% do _data.update({'port': '5000'}) %}{% endif %}
+{%- if 'cacert_file' not in _data.keys() %}{% do _data.update({'cacert_file': volume.cacert_file}) %}{% endif %}
+{%- include "oslo_templates/files/" ~ volume.version ~ "/keystoneauth/_type_"+ _data.get('auth_type','password') +".conf" %}
 
 # PEM encoded Certificate Authority to use when verifying HTTPs connections.
 # (string value)
@@ -4041,6 +4049,7 @@
 
 # Log requests to multiple loggers. (boolean value)
 #split_loggers = false
+{%- endif %}
 
 
 [ssl]
diff --git a/tests/pillar/control_cluster.sls b/tests/pillar/control_cluster.sls
index 05456c0..e1e6dc5 100644
--- a/tests/pillar/control_cluster.sls
+++ b/tests/pillar/control_cluster.sls
@@ -24,6 +24,14 @@
       user: cinder
       password: password
       endpoint_type: internalURL
+    service_user:
+      enabled: True
+      auth_type: password
+      user_domain_id: default
+      project_domain_id: default
+      project_name: service
+      username: cinder
+      password: password
     glance:
       host: 127.0.0.1
       port: 9292
diff --git a/tests/pillar/control_single.sls b/tests/pillar/control_single.sls
index cd1f7d9..9f6d66d 100644
--- a/tests/pillar/control_single.sls
+++ b/tests/pillar/control_single.sls
@@ -21,6 +21,14 @@
       user: cinder
       password: password
       endpoint_type: internalURL
+    service_user:
+      enabled: True
+      auth_type: password
+      user_domain_id: default
+      project_domain_id: default
+      project_name: service
+      username: cinder
+      password: password
     glance:
       host: 127.0.0.1
       port: 9292