diff --git a/defaults/main.yml b/defaults/main.yml
index 351dc7a..8587130 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -44,6 +44,10 @@ trove_service_description: "OpenStack DBaaS (Trove)"
 trove_service_project_name: service
 trove_service_admin_role_names:
   - admin
+  - service
+trove_service_token_roles:
+  - service
+trove_service_token_roles_required: "{{ openstack_service_token_roles_required | default(True) }}"
 trove_service_region: "{{ service_region | default('RegionOne') }}"
 trove_service_endpoint_type: internal
 trove_service_host: "{{ openstack_service_bind_address | default('0.0.0.0') }}"
diff --git a/tasks/main.yml b/tasks/main.yml
index 09a63c2..ab80ce0 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -174,12 +174,10 @@
     _service_in_ldap: "{{ trove_service_in_ldap }}"
     _service_project_name: "{{ trove_service_project_name }}"
     _service_region: "{{ trove_service_region }}"
-    _service_users: |-
-      {% set users = [{'name': trove_service_user_name, 'password': trove_service_password}] %}
-      {% for role in trove_service_admin_role_names %}
-      {%   set _ = users.append({'name': trove_service_user_name, 'role': role}) %}
-      {% endfor %}
-      {{ users }}
+    _service_users:
+      - name: "{{ trove_service_user_name }}"
+        password: "{{ trove_service_password }}"
+        role: "{{ trove_service_admin_role_names }}"
     _service_endpoints:
       - service: "{{ trove_service_name }}"
         interface: "public"
diff --git a/templates/trove.conf.j2 b/templates/trove.conf.j2
index 6ca48f1..b634f82 100644
--- a/templates/trove.conf.j2
+++ b/templates/trove.conf.j2
@@ -87,6 +87,10 @@ password = {{ trove_service_password }}
 region_name = {{ keystone_service_region }}
 interface = {{ trove_service_endpoint_type }}
 
+service_token_roles_required = {{ trove_service_token_roles_required | bool }}
+service_token_roles = {{ trove_service_token_roles | join(',') }}
+service_type = {{ trove_service_type }}
+
 memcached_servers = {{ trove_memcached_servers }}
 token_cache_time = 300