diff -Nru keystone-9.3.0/debian/changelog keystone-9.3.0/debian/changelog
--- keystone-9.3.0/debian/changelog	2017-04-06 11:02:04.000000000 -0300
+++ keystone-9.3.0/debian/changelog	2017-05-31 16:38:31.000000000 -0400
@@ -1,3 +1,10 @@
+keystone (2:9.3.0-0ubuntu2) xenial; urgency=high
+
+  * d/patches/0001-Make-flushing-tokens-more-robust.patch: Fixes
+    LP: #1649616.
+
+ -- Jorge Niedbalski <jorge.niedbalski@canonical.com>  Wed, 31 May 2017 16:38:02 -0400
+
 keystone (2:9.3.0-0ubuntu1) xenial; urgency=medium
 
   * New upstream point release for Openstack Mitaka. (LP: #1680098) 
diff -Nru keystone-9.3.0/debian/patches/0001-Make-flushing-tokens-more-robust.patch keystone-9.3.0/debian/patches/0001-Make-flushing-tokens-more-robust.patch
--- keystone-9.3.0/debian/patches/0001-Make-flushing-tokens-more-robust.patch	1969-12-31 21:00:00.000000000 -0300
+++ keystone-9.3.0/debian/patches/0001-Make-flushing-tokens-more-robust.patch	2017-05-31 16:37:50.000000000 -0400
@@ -0,0 +1,41 @@
+From e09fa3d8405df9dc1813f402d81ec3f166a88397 Mon Sep 17 00:00:00 2001
+From: Peter Sabaini <peter.sabaini@canonical.com>
+Date: Thu, 6 Apr 2017 23:06:29 +0200
+Subject: [PATCH] Make flushing tokens more robust
+
+Commit token flushes between batches in order to lower resource
+consumption and make flushing more robust for replication
+
+Change-Id: I9be37e420353a336a8acd820eadd47d4bcf7324f
+Closes-Bug: #1649616
+---
+ keystone/token/persistence/backends/sql.py | 6 ++++++
+ 1 file changed, 6 insertions(+)
+
+diff --git a/keystone/token/persistence/backends/sql.py b/keystone/token/persistence/backends/sql.py
+index 4b3439a..c4d815c 100644
+--- a/keystone/token/persistence/backends/sql.py
++++ b/keystone/token/persistence/backends/sql.py
+@@ -270,6 +270,8 @@ class Token(token.persistence.TokenDriverV8):
+ 
+     def flush_expired_tokens(self):
+         with sql.session_for_write() as session:
++            # Turn off autocommit, as it doesn't work well with batch delete
++            session.autocommit = False
+             dialect = session.bind.dialect.name
+             expiry_range_func = self._expiry_range_strategy(dialect)
+             query = session.query(TokenModel.expires)
+@@ -279,6 +281,10 @@ class Token(token.persistence.TokenDriverV8):
+                 delete_query = query.filter(TokenModel.expires <=
+                                             expiry_time)
+                 row_count = delete_query.delete(synchronize_session=False)
++                # Explicitly commit each batch so as to free up
++                # resources early. We do not actually need
++                # transactional semantics here.
++                session.commit()
+                 total_removed += row_count
+                 LOG.debug('Removed %d total expired tokens', total_removed)
+ 
+-- 
+2.7.4
+
diff -Nru keystone-9.3.0/debian/patches/series keystone-9.3.0/debian/patches/series
--- keystone-9.3.0/debian/patches/series	2017-04-06 11:02:04.000000000 -0300
+++ keystone-9.3.0/debian/patches/series	2017-05-31 16:37:50.000000000 -0400
@@ -3,3 +3,4 @@
 ubuntu-test-overrides.patch
 default-log-dir.patch
 add-version-info.patch
+0001-Make-flushing-tokens-more-robust.patch