diff --git a/opencontrail/files/3.0/contrail-api.conf b/opencontrail/files/3.0/contrail-api.conf
index 2191201..629b1ac 100644
--- a/opencontrail/files/3.0/contrail-api.conf
+++ b/opencontrail/files/3.0/contrail-api.conf
@@ -49,3 +49,5 @@
 certfile=/etc/contrail/ssl/certs/apiserver.pem
 ca_certs=/etc/contrail/ssl/certs/ca.pem
 
+[KEYSTONE]
+keystone_sync_on_demand={{ config.identity.get('sync_on_demand', 'true') }}
diff --git a/opencontrail/files/3.0/contrail-keystone-auth.conf b/opencontrail/files/3.0/contrail-keystone-auth.conf
index 5ea6161..8b37f27 100644
--- a/opencontrail/files/3.0/contrail-keystone-auth.conf
+++ b/opencontrail/files/3.0/contrail-keystone-auth.conf
@@ -18,4 +18,3 @@
 {%- else %}
 auth_url=http://{{ config.identity.host }}:{{ config.identity.port }}/v2.0
 {%- endif %}
-keystone_sync_on_demand={{ config.identity.get('sync_on_demand', 'true') }}
\ No newline at end of file
diff --git a/opencontrail/files/4.0/contrail-api.conf b/opencontrail/files/4.0/contrail-api.conf
index efe12cc..accbf49 100644
--- a/opencontrail/files/4.0/contrail-api.conf
+++ b/opencontrail/files/4.0/contrail-api.conf
@@ -60,3 +60,6 @@
 #sandesh_keyfile=/etc/contrail/ssl/private/server-privkey.pem
 #sandesh_certfile=/etc/contrail/ssl/certs/server.pem
 #sandesh_ca_cert=/etc/contrail/ssl/certs/ca-cert.pem
+
+[KEYSTONE]
+keystone_sync_on_demand={{ config.identity.get('sync_on_demand', 'true') }}
diff --git a/opencontrail/files/4.0/contrail-keystone-auth.conf b/opencontrail/files/4.0/contrail-keystone-auth.conf
index 422f2f2..8b37f27 100644
--- a/opencontrail/files/4.0/contrail-keystone-auth.conf
+++ b/opencontrail/files/4.0/contrail-keystone-auth.conf
@@ -18,4 +18,3 @@
 {%- else %}
 auth_url=http://{{ config.identity.host }}:{{ config.identity.port }}/v2.0
 {%- endif %}
-keystone_sync_on_demand={{ config.identity.get('sync_on_demand', 'true') }}