diff --git a/src/rgw/rgw_keystone.cc b/src/rgw/rgw_keystone.cc
index 3fa96d2e403..c2c8fe39da9 100644
--- a/src/rgw/rgw_keystone.cc
+++ b/src/rgw/rgw_keystone.cc
@@ -298,13 +298,17 @@ RGWKeystoneTokenCache& RGWKeystoneTokenCache::get_instance()
   static RGWKeystoneTokenCache instance;
   return instance;
 }
-
 bool RGWKeystoneTokenCache::find(const string& token_id, KeystoneToken& token)
 {
-  lock.Lock();
+  Mutex::Locker l(lock);
+  return find_locked(token_id, token);
+}
+
+bool RGWKeystoneTokenCache::find_locked(const string& token_id, KeystoneToken& token)
+{
+  assert(lock.is_locked_by_me());
   map<string, token_entry>::iterator iter = tokens.find(token_id);
   if (iter == tokens.end()) {
-    lock.Unlock();
     if (perfcounter) perfcounter->inc(l_rgw_keystone_token_cache_miss);
     return false;
   }
@@ -314,7 +318,6 @@ bool RGWKeystoneTokenCache::find(const string& token_id, KeystoneToken& token)
 
   if (entry.token.expired()) {
     tokens.erase(iter);
-    lock.Unlock();
     if (perfcounter) perfcounter->inc(l_rgw_keystone_token_cache_hit);
     return false;
   }
@@ -323,7 +326,6 @@ bool RGWKeystoneTokenCache::find(const string& token_id, KeystoneToken& token)
   tokens_lru.push_front(token_id);
   entry.lru_iter = tokens_lru.begin();
 
-  lock.Unlock();
   if (perfcounter) perfcounter->inc(l_rgw_keystone_token_cache_hit);
 
   return true;
@@ -333,13 +335,20 @@ bool RGWKeystoneTokenCache::find_admin(KeystoneToken& token)
 {
   Mutex::Locker l(lock);
 
-  return find(admin_token_id, token);
+  return find_locked(admin_token_id, token);
 }
 
 void RGWKeystoneTokenCache::add(const string& token_id,
                                 const KeystoneToken& token)
 {
-  lock.Lock();
+  Mutex::Locker l(lock);
+  add_locked(token_id, token);
+}
+
+void RGWKeystoneTokenCache::add_locked(const string& token_id,
+                                const KeystoneToken& token)
+{
+  assert(lock.is_locked_by_me());
   map<string, token_entry>::iterator iter = tokens.find(token_id);
   if (iter != tokens.end()) {
     token_entry& e = iter->second;
@@ -358,8 +367,6 @@ void RGWKeystoneTokenCache::add(const string& token_id,
     tokens.erase(iter);
     tokens_lru.pop_back();
   }
-
-  lock.Unlock();
 }
 
 void RGWKeystoneTokenCache::add_admin(const KeystoneToken& token)
@@ -367,7 +374,7 @@ void RGWKeystoneTokenCache::add_admin(const KeystoneToken& token)
   Mutex::Locker l(lock);
 
   rgw_get_token_id(token.token.id, admin_token_id);
-  add(admin_token_id, token);
+  add_locked(admin_token_id, token);
 }
 
 void RGWKeystoneTokenCache::invalidate(const string& token_id)
diff --git a/src/rgw/rgw_keystone.h b/src/rgw/rgw_keystone.h
index d83542ccb6e..042a84ffb64 100644
--- a/src/rgw/rgw_keystone.h
+++ b/src/rgw/rgw_keystone.h
@@ -173,7 +173,7 @@ class RGWKeystoneTokenCache {
   RGWKeystoneTokenCache()
     : revocator(g_ceph_context, this),
       cct(g_ceph_context),
-      lock("RGWKeystoneTokenCache", true /* recursive */),
+      lock("RGWKeystoneTokenCache"),
       max(cct->_conf->rgw_keystone_token_cache_size) {
     /* The thread name has been kept for backward compliance. */
     revocator.create("rgw_swift_k_rev");
@@ -197,6 +197,10 @@ public:
   void add_admin(const KeystoneToken& token);
   void invalidate(const string& token_id);
   bool going_down() const;
+private:
+  void add_locked(const string& token_id, const KeystoneToken& token);
+  bool find_locked(const string& token_id, KeystoneToken& token);
+
 };