diff --git a/cinder/backup/drivers/swift.py b/cinder/backup/drivers/swift.py
index 431f3e20076..4f0da356dd2 100644
--- a/cinder/backup/drivers/swift.py
+++ b/cinder/backup/drivers/swift.py
@@ -192,7 +192,8 @@ class SwiftBackupDriver(chunkeddriver.ChunkedBackupDriver):
 
         sa_plugin = service_auth.get_service_auth_plugin()
         if sa_plugin is not None:
-            result['X-Service-Token'] = sa_plugin.get_token()
+            sa_session = service_auth.get_service_session()
+            result['X-Service-Token'] = sa_plugin.get_token(session=sa_session)
 
         return result
 
diff --git a/cinder/service_auth.py b/cinder/service_auth.py
index 1e092454e06..fd854f85172 100644
--- a/cinder/service_auth.py
+++ b/cinder/service_auth.py
@@ -19,6 +19,7 @@ from cinder import exception
 
 CONF = cfg.CONF
 _SERVICE_AUTH = None
+_SERVICE_SESSION = None
 
 SERVICE_USER_GROUP = 'service_user'
 
@@ -66,6 +67,16 @@ def get_service_auth_plugin():
     return None
 
 
+def get_service_session():
+    if CONF.service_user.send_service_user_token:
+        global _SERVICE_SESSION
+        if not _SERVICE_SESSION:
+            _SERVICE_SESSION = ks_loading.load_session_from_conf_options(
+                CONF, SERVICE_USER_GROUP, auth=get_service_auth_plugin())
+        return _SERVICE_SESSION
+    return None
+
+
 def get_auth_plugin(context, auth=None):
     if auth:
         user_auth = auth
diff --git a/cinder/tests/unit/backup/drivers/test_backup_swift.py b/cinder/tests/unit/backup/drivers/test_backup_swift.py
index 750e7ba1385..04c72e241cb 100644
--- a/cinder/tests/unit/backup/drivers/test_backup_swift.py
+++ b/cinder/tests/unit/backup/drivers/test_backup_swift.py
@@ -317,7 +317,7 @@ class BackupSwiftTestCase(test.TestCase):
     @mock.patch.object(service_auth, 'get_service_auth_plugin')
     def test_backup_swift_service_auth_headers_enabled(self, mock_plugin):
         class FakeServiceAuthPlugin:
-            def get_token(self):
+            def get_token(self, session):
                 return "fake"
         self.override_config('send_service_user_token', True,
                              group='service_user')
diff --git a/releasenotes/notes/bug-2058596-3c676e7fdc642b3d.yaml b/releasenotes/notes/bug-2058596-3c676e7fdc642b3d.yaml
new file mode 100644
index 00000000000..15440ba4b4b
--- /dev/null
+++ b/releasenotes/notes/bug-2058596-3c676e7fdc642b3d.yaml
@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    `Bug #2058596 <https://bugs.launchpad.net/cinder/+bug/2058596>`_: Fixed
+    broken ``backup_swift_service_auth=True`` which made swift backup driver
+    consistently fail during object data access.