diff --git a/contrib/heat_keystone/README.md b/contrib/heat_keystone/README.md
deleted file mode 100644
index 6c57597e9f..0000000000
--- a/contrib/heat_keystone/README.md
+++ /dev/null
@@ -1,33 +0,0 @@
-Keystone plugin for OpenStack heat
-==================================
-
-This plugin enables keystone resources in a heat template for
-following resources types:
-- Keystone role (OS::Keystone::Role)
-- Keystone project (OS::Keystone::Project)
-- Keystone group (OS::Keystone::Group)
-- Keystone user (OS::Keystone::User)
-- Keystone service (OS::Keystone::Service)
-- Keystone endpoint (OS::Keystone::Endpoint)
-
-And it provides custom constrains for following keystone entities
-- Keystone role
-- Keystone domain
-- Keystone project
-- Keystone group
-- Keystone service
-
-NOTE: It supports only keystone v3 version
-
-### 1. Install the keystone plugin in heat
-
-NOTE: These instructions assume the value of heat.conf plugin_dirs includes
-the default directory /usr/lib/heat.
-
-To install the plugin, from this directory run:
-    sudo python ./setup.py install
-
-### 2. Restart heat
-
-Only the process "heat-engine" needs to be restarted to load the newly
-installed plugin.
diff --git a/contrib/heat_keystone/heat_keystone/client.py b/contrib/heat_keystone/heat_keystone/client.py
deleted file mode 100644
index 4e7a019931..0000000000
--- a/contrib/heat_keystone/heat_keystone/client.py
+++ /dev/null
@@ -1,125 +0,0 @@
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
-import exceptions
-
-from keystoneclient import exceptions as keystone_exceptions
-
-from heat.engine.clients.os import keystone
-from heat.engine import constraints
-
-
-class KeystoneClientPlugin(keystone.KeystoneClientPlugin):
-
-    def get_role_id(self, role):
-        try:
-            role_obj = self.client().client.roles.get(role)
-            return role_obj.id
-        except keystone_exceptions.NotFound:
-            role_list = self.client().client.roles.list(name=role)
-            for role_obj in role_list:
-                if role_obj.name == role:
-                    return role_obj.id
-
-        raise exceptions.KeystoneRoleNotFound(role_id=role)
-
-    def get_project_id(self, project):
-        try:
-            project_obj = self.client().client.projects.get(project)
-            return project_obj.id
-        except keystone_exceptions.NotFound:
-            project_list = self.client().client.projects.list(name=project)
-            for project_obj in project_list:
-                if project_obj.name == project:
-                    return project_obj.id
-
-        raise exceptions.KeystoneProjectNotFound(project_id=project)
-
-    def get_domain_id(self, domain):
-        try:
-            domain_obj = self.client().client.domains.get(domain)
-            return domain_obj.id
-        except keystone_exceptions.NotFound:
-            domain_list = self.client().client.domains.list(name=domain)
-            for domain_obj in domain_list:
-                if domain_obj.name == domain:
-                    return domain_obj.id
-
-        raise exceptions.KeystoneDomainNotFound(domain_id=domain)
-
-    def get_group_id(self, group):
-        try:
-            group_obj = self.client().client.groups.get(group)
-            return group_obj.id
-        except keystone_exceptions.NotFound:
-            group_list = self.client().client.groups.list(name=group)
-            for group_obj in group_list:
-                if group_obj.name == group:
-                    return group_obj.id
-
-        raise exceptions.KeystoneGroupNotFound(group_id=group)
-
-    def get_service_id(self, service):
-        try:
-            service_obj = self.client().client.services.get(service)
-            return service_obj.id
-        except keystone_exceptions.NotFound:
-            service_list = self.client().client.services.list(name=service)
-
-            if len(service_list) == 1:
-                return service_list[0].id
-            elif len(service_list) > 1:
-                raise exceptions.KeystoneServiceNameConflict(service=service)
-            else:
-                raise exceptions.KeystoneServiceNotFound(service_id=service)
-
-
-class KeystoneRoleConstraint(constraints.BaseCustomConstraint):
-
-    expected_exceptions = (exceptions.KeystoneRoleNotFound,)
-
-    def validate_with_client(self, client, role):
-        client.client_plugin('keystone').get_role_id(role)
-
-
-class KeystoneDomainConstraint(constraints.BaseCustomConstraint):
-
-    expected_exceptions = (exceptions.KeystoneDomainNotFound,)
-
-    def validate_with_client(self, client, domain):
-        client.client_plugin('keystone').get_domain_id(domain)
-
-
-class KeystoneProjectConstraint(constraints.BaseCustomConstraint):
-
-    expected_exceptions = (exceptions.KeystoneProjectNotFound,)
-
-    def validate_with_client(self, client, project):
-        client.client_plugin('keystone').get_project_id(project)
-
-
-class KeystoneGroupConstraint(constraints.BaseCustomConstraint):
-
-    expected_exceptions = (exceptions.KeystoneGroupNotFound,)
-
-    def validate_with_client(self, client, group):
-        client.client_plugin('keystone').get_group_id(group)
-
-
-class KeystoneServiceConstraint(constraints.BaseCustomConstraint):
-
-    expected_exceptions = (exceptions.KeystoneServiceNotFound,
-                           exceptions.KeystoneServiceNameConflict,)
-
-    def validate_with_client(self, client, service):
-        client.client_plugin('keystone').get_service_id(service)
diff --git a/contrib/heat_keystone/heat_keystone/exceptions.py b/contrib/heat_keystone/heat_keystone/exceptions.py
deleted file mode 100644
index ea114cc615..0000000000
--- a/contrib/heat_keystone/heat_keystone/exceptions.py
+++ /dev/null
@@ -1,40 +0,0 @@
-#
-#    Licensed under the Apache License, Version 2.0 (the "License"); you may
-#    not use this file except in compliance with the License. You may obtain
-#    a copy of the License at
-#
-#         http://www.apache.org/licenses/LICENSE-2.0
-#
-#    Unless required by applicable law or agreed to in writing, software
-#    distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
-#    WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
-#    License for the specific language governing permissions and limitations
-#    under the License.
-
-from heat.common import exception
-from heat.common.i18n import _
-
-
-class KeystoneRoleNotFound(exception.HeatException):
-    msg_fmt = _("Keystone role %(role_id)s does not found")
-
-
-class KeystoneProjectNotFound(exception.HeatException):
-    msg_fmt = _("Keystone project %(project_id)s does not found")
-
-
-class KeystoneDomainNotFound(exception.HeatException):
-    msg_fmt = _("Keystone domain %(domain_id)s does not found")
-
-
-class KeystoneGroupNotFound(exception.HeatException):
-    msg_fmt = _("Keystone group %(group_id)s does not found")
-
-
-class KeystoneServiceNotFound(exception.HeatException):
-    msg_fmt = _("Keystone service %(service_id)s does not found")
-
-
-class KeystoneServiceNameConflict(exception.HeatException):
-    msg_fmt = _("Keystone has more than one service with same name "
-                "%(service)s. Please use service id instead of name")
diff --git a/contrib/heat_keystone/heat_keystone/tests/__init__.py b/contrib/heat_keystone/heat_keystone/tests/__init__.py
deleted file mode 100644
index e69de29bb2..0000000000
diff --git a/contrib/heat_keystone/setup.cfg b/contrib/heat_keystone/setup.cfg
deleted file mode 100644
index 0dbffa1c17..0000000000
--- a/contrib/heat_keystone/setup.cfg
+++ /dev/null
@@ -1,42 +0,0 @@
-[metadata]
-name = heat-contrib-keystone
-summary = Heat resources for Keystone
-description-file =
-    README.md
-author = OpenStack
-author-email = openstack-dev@lists.openstack.org
-home-page = http://www.openstack.org/
-classifier =
-    Environment :: OpenStack
-    Intended Audience :: Information Technology
-    Intended Audience :: System Administrators
-    License :: OSI Approved :: Apache Software License
-    Operating System :: POSIX :: Linux
-    Programming Language :: Python
-    Programming Language :: Python :: 2
-    Programming Language :: Python :: 2.7
-    Programming Language :: Python :: 2.6
-
-[files]
-packages =
-    heat_keystone
-
-# Copy to /usr/lib/heat for plugin loading
-data_files =
-    lib/heat/keystone = heat_keystone/resources/*
-
-[entry_points]
-heat.clients =
-    keystone=heat_keystone.client:KeystoneClientPlugin
-
-heat.constraints =
-    keystone.role=heat_keystone.client:KeystoneRoleConstraint
-    keystone.domain=heat_keystone.client:KeystoneDomainConstraint
-    keystone.project=heat_keystone.client:KeystoneProjectConstraint
-    keystone.group=heat_keystone.client:KeystoneGroupConstraint
-    keystone.service=heat_keystone.client:KeystoneServiceConstraint
-
-[global]
-setup-hooks =
-    pbr.hooks.setup_hook
-
diff --git a/contrib/heat_keystone/setup.py b/contrib/heat_keystone/setup.py
deleted file mode 100644
index 62f38a592f..0000000000
--- a/contrib/heat_keystone/setup.py
+++ /dev/null
@@ -1,29 +0,0 @@
-#!/usr/bin/env python
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#    http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
-# implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-
-# THIS FILE IS MANAGED BY THE GLOBAL REQUIREMENTS REPO - DO NOT EDIT
-import setuptools
-
-# In python < 2.7.4, a lazy loading of package `pbr` will break
-# setuptools if some other modules registered functions in `atexit`.
-# solution from: http://bugs.python.org/issue15881#msg170215
-try:
-    import multiprocessing  # noqa
-except ImportError:
-    pass
-
-setuptools.setup(
-    setup_requires=['pbr'],
-    pbr=True)
diff --git a/heat/common/exception.py b/heat/common/exception.py
index bccffa45ee..dc0497405a 100644
--- a/heat/common/exception.py
+++ b/heat/common/exception.py
@@ -452,7 +452,7 @@ class EventSendFailed(HeatException):
 
 
 class ServiceNotFound(HeatException):
-    msg_fmt = _("Service %(service_id)s does not found")
+    msg_fmt = _("Service %(service_id)s not found")
 
 
 class UnsupportedObjectError(HeatException):
@@ -477,3 +477,28 @@ class ReadOnlyFieldError(HeatException):
 
 class ObjectFieldInvalid(HeatException):
     msg_fmt = _('Field %(field)s of %(objname)s is not an instance of Field')
+
+
+class KeystoneRoleNotFound(HeatException):
+    msg_fmt = _("Keystone role %(role_id)s not found")
+
+
+class KeystoneProjectNotFound(HeatException):
+    msg_fmt = _("Keystone project %(project_id)s not found")
+
+
+class KeystoneDomainNotFound(HeatException):
+    msg_fmt = _("Keystone domain %(domain_id)s not found")
+
+
+class KeystoneGroupNotFound(HeatException):
+    msg_fmt = _("Keystone group %(group_id)s not found")
+
+
+class KeystoneServiceNotFound(HeatException):
+    msg_fmt = _("Keystone service %(service_id)s not found")
+
+
+class KeystoneServiceNameConflict(HeatException):
+    msg_fmt = _("Keystone has more than one service with same name "
+                "%(service)s. Please use service id instead of name")
diff --git a/heat/engine/clients/os/keystone.py b/heat/engine/clients/os/keystone.py
index 063c4fe9da..ae755aeab1 100644
--- a/heat/engine/clients/os/keystone.py
+++ b/heat/engine/clients/os/keystone.py
@@ -13,8 +13,10 @@
 
 from keystoneclient import exceptions
 
+from heat.common import exception
 from heat.common import heat_keystoneclient as hkc
 from heat.engine.clients import client_plugin
+from heat.engine import constraints
 
 
 class KeystoneClientPlugin(client_plugin.ClientPlugin):
@@ -32,3 +34,106 @@ class KeystoneClientPlugin(client_plugin.ClientPlugin):
 
     def is_conflict(self, ex):
         return isinstance(ex, exceptions.Conflict)
+
+    def get_role_id(self, role):
+        try:
+            role_obj = self.client().client.roles.get(role)
+            return role_obj.id
+        except exceptions.NotFound:
+            role_list = self.client().client.roles.list(name=role)
+            for role_obj in role_list:
+                if role_obj.name == role:
+                    return role_obj.id
+
+        raise exception.KeystoneRoleNotFound(role_id=role)
+
+    def get_project_id(self, project):
+        try:
+            project_obj = self.client().client.projects.get(project)
+            return project_obj.id
+        except exceptions.NotFound:
+            project_list = self.client().client.projects.list(name=project)
+            for project_obj in project_list:
+                if project_obj.name == project:
+                    return project_obj.id
+
+        raise exception.KeystoneProjectNotFound(project_id=project)
+
+    def get_domain_id(self, domain):
+        try:
+            domain_obj = self.client().client.domains.get(domain)
+            return domain_obj.id
+        except exceptions.NotFound:
+            domain_list = self.client().client.domains.list(name=domain)
+            for domain_obj in domain_list:
+                if domain_obj.name == domain:
+                    return domain_obj.id
+
+        raise exception.KeystoneDomainNotFound(domain_id=domain)
+
+    def get_group_id(self, group):
+        try:
+            group_obj = self.client().client.groups.get(group)
+            return group_obj.id
+        except exceptions.NotFound:
+            group_list = self.client().client.groups.list(name=group)
+            for group_obj in group_list:
+                if group_obj.name == group:
+                    return group_obj.id
+
+        raise exception.KeystoneGroupNotFound(group_id=group)
+
+    def get_service_id(self, service):
+        try:
+            service_obj = self.client().client.services.get(service)
+            return service_obj.id
+        except exceptions.NotFound:
+            service_list = self.client().client.services.list(name=service)
+
+            if len(service_list) == 1:
+                return service_list[0].id
+            elif len(service_list) > 1:
+                raise exception.KeystoneServiceNameConflict(service=service)
+            else:
+                raise exception.KeystoneServiceNotFound(service_id=service)
+
+
+class KeystoneRoleConstraint(constraints.BaseCustomConstraint):
+
+    expected_exceptions = (exception.KeystoneRoleNotFound,)
+
+    def validate_with_client(self, client, role):
+        client.client_plugin('keystone').get_role_id(role)
+
+
+class KeystoneDomainConstraint(constraints.BaseCustomConstraint):
+
+    expected_exceptions = (exception.KeystoneDomainNotFound,)
+
+    def validate_with_client(self, client, domain):
+        client.client_plugin('keystone').get_domain_id(domain)
+
+
+class KeystoneProjectConstraint(constraints.BaseCustomConstraint):
+
+    expected_exceptions = (exception.KeystoneProjectNotFound,)
+
+    def validate_with_client(self, client, project):
+        client.client_plugin('keystone').get_project_id(project)
+
+
+class KeystoneGroupConstraint(constraints.BaseCustomConstraint):
+
+    expected_exceptions = (exception.KeystoneGroupNotFound,)
+
+    def validate_with_client(self, client, group):
+        client.client_plugin('keystone').get_group_id(group)
+
+
+class KeystoneServiceConstraint(constraints.BaseCustomConstraint):
+
+    expected_exceptions = (exception.KeystoneServiceNotFound,
+                           exception.KeystoneServiceNameConflict,)
+
+    def validate_with_client(self, client, service):
+        client.client_plugin('keystone').get_service_id(service)
diff --git a/contrib/heat_keystone/heat_keystone/__init__.py b/heat/engine/resources/openstack/keystone/__init__.py
similarity index 100%
rename from contrib/heat_keystone/heat_keystone/__init__.py
rename to heat/engine/resources/openstack/keystone/__init__.py
diff --git a/contrib/heat_keystone/heat_keystone/resources/endpoint.py b/heat/engine/resources/openstack/keystone/endpoint.py
similarity index 100%
rename from contrib/heat_keystone/heat_keystone/resources/endpoint.py
rename to heat/engine/resources/openstack/keystone/endpoint.py
diff --git a/contrib/heat_keystone/heat_keystone/resources/group.py b/heat/engine/resources/openstack/keystone/group.py
similarity index 100%
rename from contrib/heat_keystone/heat_keystone/resources/group.py
rename to heat/engine/resources/openstack/keystone/group.py
diff --git a/contrib/heat_keystone/heat_keystone/resources/project.py b/heat/engine/resources/openstack/keystone/project.py
similarity index 100%
rename from contrib/heat_keystone/heat_keystone/resources/project.py
rename to heat/engine/resources/openstack/keystone/project.py
diff --git a/contrib/heat_keystone/heat_keystone/resources/role.py b/heat/engine/resources/openstack/keystone/role.py
similarity index 100%
rename from contrib/heat_keystone/heat_keystone/resources/role.py
rename to heat/engine/resources/openstack/keystone/role.py
diff --git a/contrib/heat_keystone/heat_keystone/resources/role_assignments.py b/heat/engine/resources/openstack/keystone/role_assignments.py
similarity index 100%
rename from contrib/heat_keystone/heat_keystone/resources/role_assignments.py
rename to heat/engine/resources/openstack/keystone/role_assignments.py
diff --git a/contrib/heat_keystone/heat_keystone/resources/service.py b/heat/engine/resources/openstack/keystone/service.py
similarity index 100%
rename from contrib/heat_keystone/heat_keystone/resources/service.py
rename to heat/engine/resources/openstack/keystone/service.py
diff --git a/contrib/heat_keystone/heat_keystone/resources/user.py b/heat/engine/resources/openstack/keystone/user.py
similarity index 100%
rename from contrib/heat_keystone/heat_keystone/resources/user.py
rename to heat/engine/resources/openstack/keystone/user.py
diff --git a/contrib/heat_keystone/heat_keystone/resources/__init__.py b/heat/tests/keystone/__init__.py
similarity index 100%
rename from contrib/heat_keystone/heat_keystone/resources/__init__.py
rename to heat/tests/keystone/__init__.py
diff --git a/contrib/heat_keystone/heat_keystone/tests/test_client.py b/heat/tests/keystone/test_client.py
similarity index 92%
rename from contrib/heat_keystone/heat_keystone/tests/test_client.py
rename to heat/tests/keystone/test_client.py
index 814986d127..b30016625e 100644
--- a/contrib/heat_keystone/heat_keystone/tests/test_client.py
+++ b/heat/tests/keystone/test_client.py
@@ -16,15 +16,15 @@ import six
 
 from keystoneclient import exceptions as keystone_exceptions
 
-from .. import client  # noqa
-from .. import exceptions  # noqa
+from heat.common import exception
+from heat.engine.clients.os import keystone as client
 from heat.tests import common
 
 
 class KeystoneRoleConstraintTest(common.HeatTestCase):
 
     def test_expected_exceptions(self):
-        self.assertEqual((exceptions.KeystoneRoleNotFound,),
+        self.assertEqual((exception.KeystoneRoleNotFound,),
                          client.KeystoneRoleConstraint.expected_exceptions,
                          "KeystoneRoleConstraint expected exceptions error")
 
@@ -44,7 +44,7 @@ class KeystoneRoleConstraintTest(common.HeatTestCase):
 class KeystoneProjectConstraintTest(common.HeatTestCase):
 
     def test_expected_exceptions(self):
-        self.assertEqual((exceptions.KeystoneProjectNotFound,),
+        self.assertEqual((exception.KeystoneProjectNotFound,),
                          client.KeystoneProjectConstraint.expected_exceptions,
                          "KeystoneProjectConstraint expected exceptions error")
 
@@ -64,7 +64,7 @@ class KeystoneProjectConstraintTest(common.HeatTestCase):
 class KeystoneGroupConstraintTest(common.HeatTestCase):
 
     def test_expected_exceptions(self):
-        self.assertEqual((exceptions.KeystoneGroupNotFound,),
+        self.assertEqual((exception.KeystoneGroupNotFound,),
                          client.KeystoneGroupConstraint.expected_exceptions,
                          "KeystoneGroupConstraint expected exceptions error")
 
@@ -84,7 +84,7 @@ class KeystoneGroupConstraintTest(common.HeatTestCase):
 class KeystoneDomainConstraintTest(common.HeatTestCase):
 
     def test_expected_exceptions(self):
-        self.assertEqual((exceptions.KeystoneDomainNotFound,),
+        self.assertEqual((exception.KeystoneDomainNotFound,),
                          client.KeystoneDomainConstraint.expected_exceptions,
                          "KeystoneDomainConstraint expected exceptions error")
 
@@ -106,8 +106,8 @@ class KeystoneServiceConstraintTest(common.HeatTestCase):
     sample_uuid = '477e8273-60a7-4c41-b683-fdb0bc7cd151'
 
     def test_expected_exceptions(self):
-        self.assertEqual((exceptions.KeystoneServiceNotFound,
-                          exceptions.KeystoneServiceNameConflict,),
+        self.assertEqual((exception.KeystoneServiceNotFound,
+                          exception.KeystoneServiceNameConflict,),
                          client.KeystoneServiceConstraint.expected_exceptions,
                          "KeystoneServiceConstraint expected exceptions error")
 
@@ -187,7 +187,7 @@ class KeystoneClientPluginServiceTest(common.HeatTestCase):
             context=mock.MagicMock()
         )
 
-        ex = self.assertRaises(exceptions.KeystoneServiceNameConflict,
+        ex = self.assertRaises(exception.KeystoneServiceNameConflict,
                                client_plugin.get_service_id,
                                self.sample_name)
         msg = ("Keystone has more than one service with same name "
@@ -207,9 +207,9 @@ class KeystoneClientPluginServiceTest(common.HeatTestCase):
             context=mock.MagicMock()
         )
 
-        ex = self.assertRaises(exceptions.KeystoneServiceNotFound,
+        ex = self.assertRaises(exception.KeystoneServiceNotFound,
                                client_plugin.get_service_id,
                                self.sample_name)
-        msg = ("Keystone service %s does not found" %
+        msg = ("Keystone service %s not found" %
                self.sample_name)
         self.assertEqual(msg, six.text_type(ex))
diff --git a/contrib/heat_keystone/heat_keystone/tests/test_endpoint.py b/heat/tests/keystone/test_endpoint.py
similarity index 97%
rename from contrib/heat_keystone/heat_keystone/tests/test_endpoint.py
rename to heat/tests/keystone/test_endpoint.py
index 77e8f34231..918fc005cd 100644
--- a/contrib/heat_keystone/heat_keystone/tests/test_endpoint.py
+++ b/heat/tests/keystone/test_endpoint.py
@@ -15,14 +15,12 @@ import mock
 
 from heat.engine import constraints
 from heat.engine import properties
-from heat.engine import resource
+from heat.engine.resources.openstack.keystone import endpoint
 from heat.engine import stack
 from heat.engine import template
 from heat.tests import common
 from heat.tests import utils
 
-from ..resources import endpoint  # noqa
-
 keystone_endpoint_template = {
     'heat_template_version': '2015-04-30',
     'resources': {
@@ -48,10 +46,6 @@ class KeystoneEndpointTest(common.HeatTestCase):
 
         self.ctx = utils.dummy_context()
 
-        # For unit testing purpose. Register resource provider explicitly.
-        resource._register_class(RESOURCE_TYPE,
-                                 endpoint.KeystoneEndpoint)
-
         self.stack = stack.Stack(
             self.ctx, 'test_stack_keystone',
             template.Template(keystone_endpoint_template)
diff --git a/contrib/heat_keystone/heat_keystone/tests/test_group.py b/heat/tests/keystone/test_group.py
similarity index 98%
rename from contrib/heat_keystone/heat_keystone/tests/test_group.py
rename to heat/tests/keystone/test_group.py
index 77e1b165f7..8e6a2876d5 100644
--- a/contrib/heat_keystone/heat_keystone/tests/test_group.py
+++ b/heat/tests/keystone/test_group.py
@@ -15,14 +15,12 @@ import mock
 
 from heat.engine import constraints
 from heat.engine import properties
-from heat.engine import resource
+from heat.engine.resources.openstack.keystone import group
 from heat.engine import stack
 from heat.engine import template
 from heat.tests import common
 from heat.tests import utils
 
-from ..resources import group  # noqa
-
 keystone_group_template = {
     'heat_template_version': '2013-05-23',
     'resources': {
@@ -46,9 +44,6 @@ class KeystoneGroupTest(common.HeatTestCase):
 
         self.ctx = utils.dummy_context()
 
-        # For unit testing purpose. Register resource provider explicitly.
-        resource._register_class(RESOURCE_TYPE, group.KeystoneGroup)
-
         self.stack = stack.Stack(
             self.ctx, 'test_stack_keystone',
             template.Template(keystone_group_template)
diff --git a/contrib/heat_keystone/heat_keystone/tests/test_project.py b/heat/tests/keystone/test_project.py
similarity index 98%
rename from contrib/heat_keystone/heat_keystone/tests/test_project.py
rename to heat/tests/keystone/test_project.py
index f898c6ce80..7957e450ba 100644
--- a/contrib/heat_keystone/heat_keystone/tests/test_project.py
+++ b/heat/tests/keystone/test_project.py
@@ -15,14 +15,12 @@ import mock
 
 from heat.engine import constraints
 from heat.engine import properties
-from heat.engine import resource
+from heat.engine.resources.openstack.keystone import project
 from heat.engine import stack
 from heat.engine import template
 from heat.tests import common
 from heat.tests import utils
 
-from ..resources import project  # noqa
-
 keystone_project_template = {
     'heat_template_version': '2013-05-23',
     'resources': {
@@ -47,9 +45,6 @@ class KeystoneProjectTest(common.HeatTestCase):
 
         self.ctx = utils.dummy_context()
 
-        # For unit testing purpose. Register resource provider explicitly.
-        resource._register_class(RESOURCE_TYPE, project.KeystoneProject)
-
         self.stack = stack.Stack(
             self.ctx, 'test_stack_keystone',
             template.Template(keystone_project_template)
diff --git a/contrib/heat_keystone/heat_keystone/tests/test_role.py b/heat/tests/keystone/test_role.py
similarity index 95%
rename from contrib/heat_keystone/heat_keystone/tests/test_role.py
rename to heat/tests/keystone/test_role.py
index a2e7b557b8..8d4d479afe 100644
--- a/contrib/heat_keystone/heat_keystone/tests/test_role.py
+++ b/heat/tests/keystone/test_role.py
@@ -13,14 +13,12 @@
 
 import mock
 
-from heat.engine import resource
+from heat.engine.resources.openstack.keystone import role
 from heat.engine import stack
 from heat.engine import template
 from heat.tests import common
 from heat.tests import utils
 
-from ..resources import role  # noqa
-
 keystone_role_template = {
     'heat_template_version': '2013-05-23',
     'resources': {
@@ -42,9 +40,6 @@ class KeystoneRoleTest(common.HeatTestCase):
 
         self.ctx = utils.dummy_context()
 
-        # For unit testing purpose. Register resource provider explicitly.
-        resource._register_class(RESOURCE_TYPE, role.KeystoneRole)
-
         self.stack = stack.Stack(
             self.ctx, 'test_stack_keystone',
             template.Template(keystone_role_template)
diff --git a/contrib/heat_keystone/heat_keystone/tests/test_role_assignments.py b/heat/tests/keystone/test_role_assignments.py
similarity index 99%
rename from contrib/heat_keystone/heat_keystone/tests/test_role_assignments.py
rename to heat/tests/keystone/test_role_assignments.py
index 8b3b086c58..7320ca91a5 100644
--- a/contrib/heat_keystone/heat_keystone/tests/test_role_assignments.py
+++ b/heat/tests/keystone/test_role_assignments.py
@@ -16,13 +16,12 @@ import mock
 from heat.common import exception
 from heat.engine import properties
 from heat.engine import resource
+from heat.engine.resources.openstack.keystone import role_assignments
 from heat.engine import stack
 from heat.engine import template
 from heat.tests import common
 from heat.tests import utils
 
-from ..resources import role_assignments  # noqa
-
 RESOURCE_TYPE = 'OS::Keystone::DummyRoleAssignment'
 
 keystone_role_assignment_template = {
diff --git a/contrib/heat_keystone/heat_keystone/tests/test_service.py b/heat/tests/keystone/test_service.py
similarity index 97%
rename from contrib/heat_keystone/heat_keystone/tests/test_service.py
rename to heat/tests/keystone/test_service.py
index 5ceb115387..fb23489440 100644
--- a/contrib/heat_keystone/heat_keystone/tests/test_service.py
+++ b/heat/tests/keystone/test_service.py
@@ -14,14 +14,12 @@
 import mock
 
 from heat.engine import properties
-from heat.engine import resource
+from heat.engine.resources.openstack.keystone import service
 from heat.engine import stack
 from heat.engine import template
 from heat.tests import common
 from heat.tests import utils
 
-from ..resources import service  # noqa
-
 keystone_service_template = {
     'heat_template_version': '2015-04-30',
     'resources': {
@@ -45,10 +43,6 @@ class KeystoneServiceTest(common.HeatTestCase):
 
         self.ctx = utils.dummy_context()
 
-        # For unit testing purpose. Register resource provider explicitly.
-        resource._register_class(RESOURCE_TYPE,
-                                 service.KeystoneService)
-
         self.stack = stack.Stack(
             self.ctx, 'test_stack_keystone',
             template.Template(keystone_service_template)
diff --git a/contrib/heat_keystone/heat_keystone/tests/test_user.py b/heat/tests/keystone/test_user.py
similarity index 97%
rename from contrib/heat_keystone/heat_keystone/tests/test_user.py
rename to heat/tests/keystone/test_user.py
index 7cd6a42728..c7bb5d7eff 100644
--- a/contrib/heat_keystone/heat_keystone/tests/test_user.py
+++ b/heat/tests/keystone/test_user.py
@@ -13,14 +13,12 @@
 
 import mock
 
-from heat.engine import resource
+from heat.engine.resources.openstack.keystone import user
 from heat.engine import stack
 from heat.engine import template
 from heat.tests import common
 from heat.tests import utils
 
-from ..resources import user  # noqa
-
 keystone_user_template = {
     'heat_template_version': '2013-05-23',
     'resources': {
@@ -50,9 +48,6 @@ class KeystoneUserTest(common.HeatTestCase):
 
         self.ctx = utils.dummy_context()
 
-        # For unit testing purpose. Register resource provider explicitly.
-        resource._register_class(RESOURCE_TYPE, user.KeystoneUser)
-
         self.stack = stack.Stack(
             self.ctx, 'test_stack_keystone',
             template.Template(keystone_user_template)
diff --git a/setup.cfg b/setup.cfg
index e8c29d1a9c..8ccbc8d8b0 100644
--- a/setup.cfg
+++ b/setup.cfg
@@ -76,6 +76,11 @@ heat.constraints =
     ip_addr = heat.engine.clients.os.neutron:IPConstraint
     mac_addr = heat.engine.clients.os.neutron:MACConstraint
     net_cidr = heat.engine.clients.os.neutron:CIDRConstraint
+    keystone.role = heat.engine.clients.os.keystone:KeystoneRoleConstraint
+    keystone.domain = heat.engine.clients.os.keystone:KeystoneDomainConstraint
+    keystone.project = heat.engine.clients.os.keystone:KeystoneProjectConstraint
+    keystone.group = heat.engine.clients.os.keystone:KeystoneGroupConstraint
+    keystone.service = heat.engine.clients.os.keystone:KeystoneServiceConstraint
 
 heat.stack_lifecycle_plugins =