diff --git a/manifests/cache.pp b/manifests/cache.pp
index d28b170bc..f08a9020c 100644
--- a/manifests/cache.pp
+++ b/manifests/cache.pp
@@ -107,6 +107,18 @@
 #   (oslo_cache.memcache_pool backend only)
 #   Defaults to $facts['os_service_default']
 #
+# [*memcache_sasl_enabled*]
+#   (Optional) Whether SASL is enabled in memcached
+#   Defaults to $facts['os_service_default']
+#
+# [*memcache_username*]
+#   (Optional) The user name for the memcached with SASL enabled
+#   Defaults to $facts['os_service_default']
+#
+# [*memcache_password*]
+#   (Optional) The password for the memcached with SASL enabled
+#   Defaults to $facts['os_service_default']
+#
 # [*manage_backend_package*]
 #   (Optional) Whether to install the backend package for the cache.
 #   Defaults to true
@@ -199,7 +211,9 @@ class keystone::cache(
   $memcache_pool_unused_timeout         = $facts['os_service_default'],
   $memcache_pool_connection_get_timeout = $facts['os_service_default'],
   $memcache_pool_flush_on_reconnect     = $facts['os_service_default'],
-  $manage_backend_package               = true,
+  $memcache_sasl_enabled                = $facts['os_service_default'],
+  $memcache_username                    = $facts['os_service_default'],
+  $memcache_password                    = $facts['os_service_default'],
   $token_caching                        = $facts['os_service_default'],
   $tls_enabled                          = $facts['os_service_default'],
   $tls_cafile                           = $facts['os_service_default'],
@@ -212,6 +226,7 @@ class keystone::cache(
   $hashclient_retry_attempts            = $facts['os_service_default'],
   $hashclient_retry_delay               = $facts['os_service_default'],
   $dead_timeout                         = $facts['os_service_default'],
+  Boolean $manage_backend_package       = true,
 ){
 
   include keystone::deps
@@ -243,7 +258,9 @@ class keystone::cache(
     memcache_pool_unused_timeout         => $memcache_pool_unused_timeout,
     memcache_pool_connection_get_timeout => $memcache_pool_connection_get_timeout,
     memcache_pool_flush_on_reconnect     => $memcache_pool_flush_on_reconnect,
-    manage_backend_package               => $manage_backend_package,
+    memcache_sasl_enabled                => $memcache_sasl_enabled,
+    memcache_username                    => $memcache_username,
+    memcache_password                    => $memcache_password,
     tls_enabled                          => $tls_enabled,
     tls_cafile                           => $tls_cafile,
     tls_certfile                         => $tls_certfile,
@@ -255,6 +272,7 @@ class keystone::cache(
     hashclient_retry_attempts            => $hashclient_retry_attempts,
     hashclient_retry_delay               => $hashclient_retry_delay,
     dead_timeout                         => $dead_timeout,
+    manage_backend_package               => $manage_backend_package,
   }
 
 }
diff --git a/releasenotes/notes/cache-memcache-sasl-310108b013310508.yaml b/releasenotes/notes/cache-memcache-sasl-310108b013310508.yaml
new file mode 100644
index 000000000..8bb617c84
--- /dev/null
+++ b/releasenotes/notes/cache-memcache-sasl-310108b013310508.yaml
@@ -0,0 +1,5 @@
+---
+features:
+  - |
+    The ``keystone::cache`` class now supports options to allow memcached with
+    SASL enabled.
diff --git a/spec/classes/keystone_cache_spec.rb b/spec/classes/keystone_cache_spec.rb
index cb85a4aab..7a094a302 100644
--- a/spec/classes/keystone_cache_spec.rb
+++ b/spec/classes/keystone_cache_spec.rb
@@ -31,6 +31,9 @@ describe 'keystone::cache' do
           :memcache_pool_unused_timeout         => '<SERVICE DEFAULT>',
           :memcache_pool_connection_get_timeout => '<SERVICE DEFAULT>',
           :memcache_pool_flush_on_reconnect     => '<SERVICE DEFAULT>',
+          :memcache_sasl_enabled                => '<SERVICE DEFAULT>',
+          :memcache_username                    => '<SERVICE DEFAULT>',
+          :memcache_password                    => '<SERVICE DEFAULT>',
           :tls_enabled                          => '<SERVICE DEFAULT>',
           :tls_cafile                           => '<SERVICE DEFAULT>',
           :tls_certfile                         => '<SERVICE DEFAULT>',
@@ -67,6 +70,9 @@ describe 'keystone::cache' do
           :memcache_pool_unused_timeout         => '120',
           :memcache_pool_connection_get_timeout => '360',
           :memcache_pool_flush_on_reconnect     => false,
+          :memcache_sasl_enabled                => false,
+          :memcache_username                    => 'sasluser',
+          :memcache_password                    => 'saslpass',
           :tls_enabled                          => false,
           :enable_retry_client                  => false,
           :retry_attempts                       => 2,
@@ -101,6 +107,9 @@ describe 'keystone::cache' do
           :memcache_pool_unused_timeout         => '120',
           :memcache_pool_connection_get_timeout => '360',
           :memcache_pool_flush_on_reconnect     => false,
+          :memcache_sasl_enabled                => false,
+          :memcache_username                    => 'sasluser',
+          :memcache_password                    => 'saslpass',
           :tls_enabled                          => false,
           :tls_cafile                           => '<SERVICE DEFAULT>',
           :tls_certfile                         => '<SERVICE DEFAULT>',