diff --git a/manifests/compute/hypervisor.pp b/manifests/compute/hypervisor.pp
index 3e7633a4..3b8543f4 100644
--- a/manifests/compute/hypervisor.pp
+++ b/manifests/compute/hypervisor.pp
@@ -150,9 +150,10 @@ Host *
       ensure => 'present'
     })
 
-    @user { 'nova': groups => 'cephkeyring' }
-    User <| title == nova |>
-    realize User[nova]
+    ensure_resource ('exec','add-nova-to-group', {
+      'command' => 'usermod -a -G cephkeyring nova',
+      'unless'  => 'groups nova | grep cephkeyring'
+    })
 
     ensure_resource('file', "/etc/ceph/ceph.client.${cinder_rbd_user}.keyring", {
       owner   => 'root',
diff --git a/manifests/volume/backend/rbd.pp b/manifests/volume/backend/rbd.pp
index 99b125ff..17158b93 100644
--- a/manifests/volume/backend/rbd.pp
+++ b/manifests/volume/backend/rbd.pp
@@ -80,9 +80,10 @@ define cloud::volume::backend::rbd (
     ensure => 'present'
   })
 
-  @user { 'cinder': groups => 'cephkeyring' }
-  User <| title == cinder |>
-  realize User[cinder]
+  ensure_resource ('exec','add-cinder-to-group', {
+    'command' => 'usermod -a -G cephkeyring cinder',
+    'unless'  => 'groups cinder | grep cephkeyring'
+  })
 
   ensure_resource('file', "/etc/ceph/ceph.client.${rbd_user}.keyring", {
     owner   => 'root',
diff --git a/spec/classes/cloud_compute_hypervisor_spec.rb b/spec/classes/cloud_compute_hypervisor_spec.rb
index d7effc22..0e85487c 100644
--- a/spec/classes/cloud_compute_hypervisor_spec.rb
+++ b/spec/classes/cloud_compute_hypervisor_spec.rb
@@ -240,6 +240,10 @@ describe 'cloud::compute::hypervisor' do
       should contain_nova_config('DEFAULT/rbd_user').with('value' => 'cinder')
       should contain_nova_config('DEFAULT/rbd_secret_uuid').with('value' => 'secrete')
       should contain_group('cephkeyring').with(:ensure => 'present')
+      should contain_exec('add-nova-to-group').with(
+        :command => 'usermod -a -G cephkeyring nova',
+        :unless  => 'groups nova | grep cephkeyring'
+      )
     end
 
     it 'configure nova-compute with extra parameters' do
diff --git a/spec/classes/cloud_volume_storage_spec.rb b/spec/classes/cloud_volume_storage_spec.rb
index 637437d2..b72bc646 100644
--- a/spec/classes/cloud_volume_storage_spec.rb
+++ b/spec/classes/cloud_volume_storage_spec.rb
@@ -107,6 +107,10 @@ describe 'cloud::volume::storage' do
           :os_auth_url    => 'http://keystone.host:5000/v2.0'
         )
         should contain_group('cephkeyring').with(:ensure => 'present')
+        should contain_exec('add-cinder-to-group').with(
+          :command => 'usermod -a -G cephkeyring cinder',
+          :unless  => 'groups cinder | grep cephkeyring'
+        )
       end
     end