diff --git a/manifests/keystone/service_user.pp b/manifests/keystone/service_user.pp
index 47674756..36208669 100644
--- a/manifests/keystone/service_user.pp
+++ b/manifests/keystone/service_user.pp
@@ -34,7 +34,7 @@
 #
 # [*send_service_user_token*]
 #   (Optional) The service uses service token feature when this is set as true
-#   Defaults to 'false'
+#   Defaults to $facts['os_service_default']
 #
 # [*insecure*]
 #  (Optional) If true, explicitly allow TLS without checking server cert
@@ -75,7 +75,7 @@ class cinder::keystone::service_user(
   $user_domain_name        = 'Default',
   $project_domain_name     = 'Default',
   $system_scope            = $facts['os_service_default'],
-  $send_service_user_token = false,
+  $send_service_user_token = $facts['os_service_default'],
   $insecure                = $facts['os_service_default'],
   $auth_type               = 'password',
   $auth_version            = $facts['os_service_default'],
diff --git a/spec/classes/cinder_keystone_service_user_spec.rb b/spec/classes/cinder_keystone_service_user_spec.rb
index 3cef3287..47982d9d 100644
--- a/spec/classes/cinder_keystone_service_user_spec.rb
+++ b/spec/classes/cinder_keystone_service_user_spec.rb
@@ -21,7 +21,7 @@ describe 'cinder::keystone::service_user' do
           :user_domain_name        => 'Default',
           :project_domain_name     => 'Default',
           :insecure                => '<SERVICE DEFAULT>',
-          :send_service_user_token => false,
+          :send_service_user_token => '<SERVICE DEFAULT>',
           :auth_type               => 'password',
           :auth_version            => '<SERVICE DEFAULT>',
           :cafile                  => '<SERVICE DEFAULT>',