diff --git a/manifests/cron/token_flush.pp b/manifests/cron/token_flush.pp
index 7b334b2a6..177bbe77f 100644
--- a/manifests/cron/token_flush.pp
+++ b/manifests/cron/token_flush.pp
@@ -21,6 +21,10 @@
 #
 # === Parameters
 #
+#  [*ensure*]
+#    (optional) Defaults to present.
+#    Valid values are present, absent.
+#
 #  [*minute*]
 #    (optional) Defaults to '1'.
 #
@@ -36,16 +40,30 @@
 #  [*weekday*]
 #    (optional) Defaults to '*'.
 #
+#  [*maxdelay*]
+#    (optional) Seconds. Defaults to 0. Should be a positive integer.
+#    Induces a random delay before running the cronjob to avoid running all
+#    cron jobs at the same time on all hosts this job is configured.
+#
 class keystone::cron::token_flush (
+  $ensure   = present,
   $minute   = 1,
   $hour     = 0,
   $monthday = '*',
   $month    = '*',
   $weekday  = '*',
+  $maxdelay = 0,
 ) {
 
+  if $maxdelay == 0 {
+    $sleep = ''
+  } else {
+    $sleep = "sleep `expr \${RANDOM} \\% ${maxdelay}`; "
+  }
+
   cron { 'keystone-manage token_flush':
-    command     => 'keystone-manage token_flush >>/var/log/keystone/keystone-tokenflush.log 2>&1',
+    ensure      => $ensure,
+    command     => "${sleep}keystone-manage token_flush >>/var/log/keystone/keystone-tokenflush.log 2>&1",
     environment => 'PATH=/bin:/usr/bin:/usr/sbin',
     user        => 'keystone',
     minute      => $minute,
diff --git a/spec/classes/keystone_cron_token_flush_spec.rb b/spec/classes/keystone_cron_token_flush_spec.rb
index 0da4522a1..16f3bbe33 100644
--- a/spec/classes/keystone_cron_token_flush_spec.rb
+++ b/spec/classes/keystone_cron_token_flush_spec.rb
@@ -6,16 +6,63 @@ describe 'keystone::cron::token_flush' do
     { :osfamily => 'Debian' }
   end
 
-  it 'configures a cron' do
-    should contain_cron('keystone-manage token_flush').with(
-      :command     => 'keystone-manage token_flush >>/var/log/keystone/keystone-tokenflush.log 2>&1',
-      :environment => 'PATH=/bin:/usr/bin:/usr/sbin',
-      :user        => 'keystone',
-      :minute      => 1,
-      :hour        => 0,
-      :monthday    => '*',
-      :month       => '*',
-      :weekday     => '*'
-    )
+  describe 'with default parameters' do
+    it 'configures a cron' do
+      should contain_cron('keystone-manage token_flush').with(
+        :ensure      => 'present',
+        :command     => 'keystone-manage token_flush >>/var/log/keystone/keystone-tokenflush.log 2>&1',
+        :environment => 'PATH=/bin:/usr/bin:/usr/sbin',
+        :user        => 'keystone',
+        :minute      => 1,
+        :hour        => 0,
+        :monthday    => '*',
+        :month       => '*',
+        :weekday     => '*'
+      )
+    end
+  end
+
+  describe 'when specifying a maxdelay param' do
+    let :params do
+      {
+        :maxdelay => 600
+      }
+    end
+
+    it 'configures a cron with delay' do
+      should contain_cron('keystone-manage token_flush').with(
+        :ensure      => 'present',
+        :command     => 'sleep `expr ${RANDOM} \\% 600`; keystone-manage token_flush >>/var/log/keystone/keystone-tokenflush.log 2>&1',
+        :environment => 'PATH=/bin:/usr/bin:/usr/sbin',
+        :user        => 'keystone',
+        :minute      => 1,
+        :hour        => 0,
+        :monthday    => '*',
+        :month       => '*',
+        :weekday     => '*'
+      )
+    end
+  end
+
+  describe 'when specifying a maxdelay param' do
+    let :params do
+      {
+        :ensure => 'absent'
+      }
+    end
+
+    it 'configures a cron with delay' do
+      should contain_cron('keystone-manage token_flush').with(
+        :ensure      => 'absent',
+        :command     => 'keystone-manage token_flush >>/var/log/keystone/keystone-tokenflush.log 2>&1',
+        :environment => 'PATH=/bin:/usr/bin:/usr/sbin',
+        :user        => 'keystone',
+        :minute      => 1,
+        :hour        => 0,
+        :monthday    => '*',
+        :month       => '*',
+        :weekday     => '*'
+      )
+    end
   end
 end