diff --git a/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserConfigurationImpl.java b/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserConfigurationImpl.java
index 8a7e88ff3f..ef44100c18 100644
--- a/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserConfigurationImpl.java
+++ b/oak-core/src/main/java/org/apache/jackrabbit/oak/security/user/UserConfigurationImpl.java
@@ -54,6 +54,7 @@ import org.osgi.service.component.annotations.Activate;
 import org.osgi.service.component.annotations.Component;
 import org.osgi.service.component.annotations.Reference;
 import org.osgi.service.component.annotations.ReferenceCardinality;
+import org.osgi.service.component.annotations.ReferencePolicy;
 import org.osgi.service.metatype.annotations.AttributeDefinition;
 import org.osgi.service.metatype.annotations.Designate;
 import org.osgi.service.metatype.annotations.ObjectClassDefinition;
@@ -191,9 +192,18 @@ public class UserConfigurationImpl extends ConfigurationBase implements UserConf
         setParameters(ConfigurationParameters.of(properties));
     }
 
-    @Reference(cardinality = ReferenceCardinality.OPTIONAL)
     private BlobAccessProvider blobAccessProvider;
     
+    @Reference(cardinality = ReferenceCardinality.OPTIONAL,
+            policy = ReferencePolicy.DYNAMIC)
+    void bindBlobAccessProvider(BlobAccessProvider bap) {
+        blobAccessProvider = bap;
+    }
+
+    void unbindBlobAccessProvider(BlobAccessProvider bap) {
+        blobAccessProvider = DEFAULT_BLOB_ACCESS_PROVIDER;
+    }
+
     //----------------------------------------------< SecurityConfiguration >---
     @NotNull
     @Override
@@ -263,8 +273,6 @@ public class UserConfigurationImpl extends ConfigurationBase implements UserConf
         return new UserPrincipalProvider(root, this, namePathMapper);
     }
     
-    //-----------------------------------------------------------< internal >---
-
     @NotNull
     private BlobAccessProvider getBlobAccessProvider() {
         BlobAccessProvider provider = blobAccessProvider;
@@ -279,8 +287,8 @@ public class UserConfigurationImpl extends ConfigurationBase implements UserConf
         }
         if (provider == null) {
             provider = DEFAULT_BLOB_ACCESS_PROVIDER;
-            blobAccessProvider = provider;
         }
+        blobAccessProvider = provider;
         return provider;
     }
 }
diff --git a/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/UserConfigurationImplTest.java b/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/UserConfigurationImplTest.java
index 60177cda9a..db518abc01 100644
--- a/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/UserConfigurationImplTest.java
+++ b/oak-core/src/test/java/org/apache/jackrabbit/oak/security/user/UserConfigurationImplTest.java
@@ -20,6 +20,7 @@ import com.google.common.collect.ImmutableMap;
 import com.google.common.collect.Lists;
 import org.apache.jackrabbit.api.security.user.UserManager;
 import org.apache.jackrabbit.oak.AbstractSecurityTest;
+import org.apache.jackrabbit.oak.api.blob.BlobAccessProvider;
 import org.apache.jackrabbit.oak.plugins.value.jcr.PartialValueFactory;
 import org.apache.jackrabbit.oak.spi.commit.MoveTracker;
 import org.apache.jackrabbit.oak.spi.commit.ThreeWayConflictHandler;
@@ -35,11 +36,13 @@ import org.apache.jackrabbit.oak.spi.xml.ProtectedItemImporter;
 import org.apache.sling.testing.mock.osgi.junit.OsgiContext;
 import org.junit.Rule;
 import org.junit.Test;
+import org.osgi.framework.ServiceRegistration;
 
 import java.lang.reflect.Field;
 import java.security.Principal;
 import java.util.Collections;
 import java.util.HashMap;
+import java.util.Hashtable;
 import java.util.List;
 
 import static org.apache.jackrabbit.oak.spi.security.user.UserConstants.PARAM_DEFAULT_DEPTH;
@@ -140,6 +143,29 @@ public class UserConfigurationImplTest extends AbstractSecurityTest {
         assertSame(PartialValueFactory.DEFAULT_BLOB_ACCESS_PROVIDER, f.get(vf));
     }
     
+    @Test
+    public void testBindBlobAccessProvider() throws Exception {
+        UserConfigurationImpl uc = new UserConfigurationImpl(getSecurityProvider());
+        context.registerInjectActivateService(uc, ImmutableMap.of(PARAM_DEFAULT_DEPTH, "8"));
+
+        BlobAccessProvider bap = mock(BlobAccessProvider.class);
+        uc.getUserManager(root, getNamePathMapper());
+        Field f = UserConfigurationImpl.class.getDeclaredField("blobAccessProvider");
+        f.setAccessible(true);
+        //Validate default service
+        assertSame(PartialValueFactory.DEFAULT_BLOB_ACCESS_PROVIDER, f.get(uc));
+
+        ServiceRegistration reg = context.bundleContext().registerService(
+                BlobAccessProvider.class.getName(),
+                bap, new Hashtable<String, Object>());
+        //Validate newly registered service
+        assertSame(bap, f.get(uc));
+
+        reg.unregister();
+        //Validate default service after unregistering newly registered service
+        assertSame(PartialValueFactory.DEFAULT_BLOB_ACCESS_PROVIDER, f.get(uc));
+    }
+
     @Test
     public void testUserConfigurationWithConstructor() {
         UserConfigurationImpl userConfiguration = new UserConfigurationImpl(getSecurityProvider());