diff --git a/keystone/identity/controllers.py b/keystone/identity/controllers.py
index e82b81f..520db70 100644
--- a/keystone/identity/controllers.py
+++ b/keystone/identity/controllers.py
@@ -223,6 +223,7 @@ class User(controller.V2Controller):
     def delete_user(self, context, user_id):
         self.assert_admin(context)
         self.identity_api.delete_user(context, user_id)
+        self._delete_tokens_for_user(context, user_id)
 
     def set_user_enabled(self, context, user_id, user):
         return self.update_user(context, user_id, user)
diff --git a/tests/test_keystoneclient.py b/tests/test_keystoneclient.py
index acca5a0..ec6a6bf 100644
--- a/tests/test_keystoneclient.py
+++ b/tests/test_keystoneclient.py
@@ -395,6 +395,30 @@ class KeystoneClientTests(object):
                           self.get_client,
                           self.user_foo)
 
+    def test_delete_user_invalidates_token(self):
+        from keystoneclient import exceptions as client_exceptions
+
+        admin_client = self.get_client(admin=True)
+        client = self.get_client(admin=False)
+
+        username = uuid.uuid4().hex
+        password = uuid.uuid4().hex
+        user_id = admin_client.users.create(
+            name=username, password=password, email=uuid.uuid4().hex).id
+
+        token_id = client.tokens.authenticate(
+            username=username, password=password).id
+
+        # token should be usable before the user is deleted
+        client.tokens.authenticate(token=token_id)
+
+        admin_client.users.delete(user=user_id)
+
+        # authenticate with a token should not work after the user is deleted
+        self.assertRaises(client_exceptions.Unauthorized,
+                          client.tokens.authenticate,
+                          token=token_id)
+
     def test_token_expiry_maintained(self):
         timeutils.set_time_override()
         foo_client = self.get_client(self.user_foo)