diff --git a/templates/.gitignore b/templates/.gitignore
new file mode 100644
index 0000000..e69de29
diff --git a/tests/021-basic-xenial-mitaka b/tests/021-basic-xenial-mitaka
new file mode 100755
index 0000000..cf1f4d5
--- /dev/null
+++ b/tests/021-basic-xenial-mitaka
@@ -0,0 +1,9 @@
+#!/usr/bin/python
+
+"""Amulet tests on a basic cinder-backup deployment on xenial-mitaka."""
+
+from basic_deployment import CinderBackupBasicDeployment
+
+if __name__ == '__main__':
+    deployment = CinderBackupBasicDeployment(series='xenial')
+    deployment.run_tests()
diff --git a/tests/basic_deployment.py b/tests/basic_deployment.py
index a85d9eb..eb0a0db 100644
--- a/tests/basic_deployment.py
+++ b/tests/basic_deployment.py
@@ -206,6 +206,9 @@ class CinderBackupBasicDeployment(OpenStackAmuletDeployment):
             services[self.ceph1_sentry] = ceph_services
             services[self.ceph2_sentry] = ceph_services
 
+        if self._get_openstack_release() >= self.trusty_liberty:
+            services[self.keystone_sentry] = ['apache2']
+
         ret = u.validate_services_by_name(services)
         if ret:
             amulet.raise_status(amulet.FAIL, msg=ret)
@@ -514,6 +517,8 @@ class CinderBackupBasicDeployment(OpenStackAmuletDeployment):
 
         auth_uri = 'http://' + rel_ks_ci['auth_host'] + \
                    ':' + rel_ks_ci['service_port'] + '/'
+        auth_url = ('http://%s:%s/' %
+                    (rel_ks_ci['auth_host'], rel_ks_ci['auth_port']))
 
         expected = {
             'DEFAULT': {
@@ -549,6 +554,18 @@ class CinderBackupBasicDeployment(OpenStackAmuletDeployment):
             'rabbit_password': rel_mq_ci['password'],
             'rabbit_host': rel_mq_ci['hostname'],
         }
+        if self._get_openstack_release() >= self.trusty_liberty:
+            expected['keystone_authtoken'] = {
+                'auth_uri': auth_uri.rstrip('/'),
+                'auth_url': auth_url.rstrip('/'),
+                'auth_plugin': 'password',
+                'project_domain_id': 'default',
+                'user_domain_id': 'default',
+                'project_name': 'services',
+                'username': rel_ks_ci['service_username'],
+                'password': rel_ks_ci['service_password'],
+                'signing_dir': '/var/cache/cinder'
+            }
 
         if self._get_openstack_release() >= self.trusty_kilo:
             # Kilo or later