diff --git a/defaults/main.yml b/defaults/main.yml
index c58c284a..921e6756 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -142,7 +142,12 @@ cinder_service_project_domain_id: default
 cinder_service_user_domain_id: default
 cinder_service_user_name: cinder
 cinder_service_project_name: service
-cinder_service_role_name: admin
+cinder_service_role_names:
+  - admin
+  - service
+cinder_service_token_roles:
+  - service
+cinder_service_token_roles_required: "{{ openstack_service_token_roles_required | default(True) }}"
 cinder_service_region: "{{ service_region | default('RegionOne') }}"
 cinder_service_description: "Cinder Volume Service"
 cinder_service_port: 8776
diff --git a/tasks/main.yml b/tasks/main.yml
index 88e95268..9dd3eb92 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -180,7 +180,7 @@
     _service_users:
       - name: "{{ cinder_service_user_name }}"
         password: "{{ cinder_service_password }}"
-        role: "{{ cinder_service_role_name }}"
+        role: "{{ cinder_service_role_names }}"
   when:
     - "_cinder_is_first_play_host"
   tags:
diff --git a/templates/cinder.conf.j2 b/templates/cinder.conf.j2
index a7c550c8..78140436 100644
--- a/templates/cinder.conf.j2
+++ b/templates/cinder.conf.j2
@@ -165,6 +165,10 @@ token_cache_time = 300
 memcache_security_strategy = ENCRYPT
 memcache_secret_key = {{ memcached_encryption_key }}
 
+service_token_roles_required = {{ cinder_service_token_roles_required | bool }}
+service_token_roles = {{ cinder_service_token_roles | join(',') }}
+service_type = {{ cinder_service_type }}
+
 [nova]
 interface = internal
 insecure = {{ keystone_service_internaluri_insecure | bool }}