diff --git a/manifests/agent/auth.pp b/manifests/agent/auth.pp
index a512fba8..db14d557 100644
--- a/manifests/agent/auth.pp
+++ b/manifests/agent/auth.pp
@@ -7,7 +7,7 @@
 #
 # [*auth_url*]
 #   (Optional) the keystone public endpoint
-#   Defaults to 'http://localhost:5000/v2.0'.
+#   Defaults to 'http://localhost:5000'.
 #
 # [*auth_region*]
 #   (Optional) the keystone region of this node
@@ -39,28 +39,28 @@
 #
 # [*auth_user_domain_name*]
 #   (Optional) domain name for auth user.
-#   Defaults to $::os_service_default.
+#   Defaults to 'Default'.
 #
 # [*auth_project_domain_name*]
 #   (Optional) domain name for auth project.
-#   Defaults to $::os_service_default.
+#   Defaults to 'Default'.
 #
 # [*auth_type*]
 #   (Optional) Authentication type to load.
-#   Defaults to $::os_service_default.
+#   Defaults to 'password'.
 #
 class ceilometer::agent::auth (
   $auth_password,
-  $auth_url                 = 'http://localhost:5000/v2.0',
+  $auth_url                 = 'http://localhost:5000',
   $auth_region              = $::os_service_default,
   $auth_user                = 'ceilometer',
   $auth_tenant_name         = 'services',
   $auth_tenant_id           = undef,
   $auth_cacert              = undef,
   $auth_endpoint_type       = undef,
-  $auth_user_domain_name    = $::os_service_default,
-  $auth_project_domain_name = $::os_service_default,
-  $auth_type                = $::os_service_default,
+  $auth_user_domain_name    = 'Default',
+  $auth_project_domain_name = 'Default',
+  $auth_type                = 'password',
 ) {
 
   if ! $auth_cacert {
diff --git a/releasenotes/notes/password_auth_type-810a86921a846b2f.yaml b/releasenotes/notes/password_auth_type-810a86921a846b2f.yaml
new file mode 100644
index 00000000..c580c332
--- /dev/null
+++ b/releasenotes/notes/password_auth_type-810a86921a846b2f.yaml
@@ -0,0 +1,5 @@
+---
+upgrade:
+  - Update auth_type value to 'password' to use keystone auth
+    plugin by default instead of ceilometer legacy keystone loader.
+  - Remove hard-coded API version from auth url
diff --git a/spec/classes/ceilometer_agent_auth_spec.rb b/spec/classes/ceilometer_agent_auth_spec.rb
index 8d940154..72a4d81a 100644
--- a/spec/classes/ceilometer_agent_auth_spec.rb
+++ b/spec/classes/ceilometer_agent_auth_spec.rb
@@ -7,7 +7,7 @@ describe 'ceilometer::agent::auth' do
   end
 
   let :params do
-    { :auth_url         => 'http://localhost:5000/v2.0',
+    { :auth_url         => 'http://localhost:5000',
       :auth_region      => '<SERVICE DEFAULT>',
       :auth_user        => 'ceilometer',
       :auth_password    => 'password',
@@ -18,16 +18,16 @@ describe 'ceilometer::agent::auth' do
   shared_examples_for 'ceilometer-agent-auth' do
 
     it 'configures authentication' do
-      is_expected.to contain_ceilometer_config('service_credentials/auth_url').with_value('http://localhost:5000/v2.0')
+      is_expected.to contain_ceilometer_config('service_credentials/auth_url').with_value('http://localhost:5000')
       is_expected.to contain_ceilometer_config('service_credentials/region_name').with_value('<SERVICE DEFAULT>')
       is_expected.to contain_ceilometer_config('service_credentials/username').with_value('ceilometer')
       is_expected.to contain_ceilometer_config('service_credentials/password').with_value('password')
       is_expected.to contain_ceilometer_config('service_credentials/password').with_value(params[:auth_password]).with_secret(true)
       is_expected.to contain_ceilometer_config('service_credentials/project_name').with_value('services')
       is_expected.to contain_ceilometer_config('service_credentials/ca_file').with(:ensure => 'absent')
-      is_expected.to contain_ceilometer_config('service_credentials/user_domain_name').with_value('<SERVICE DEFAULT>')
-      is_expected.to contain_ceilometer_config('service_credentials/project_domain_name').with_value('<SERVICE DEFAULT>')
-      is_expected.to contain_ceilometer_config('service_credentials/auth_type').with_value('<SERVICE DEFAULT>')
+      is_expected.to contain_ceilometer_config('service_credentials/user_domain_name').with_value('Default')
+      is_expected.to contain_ceilometer_config('service_credentials/project_domain_name').with_value('Default')
+      is_expected.to contain_ceilometer_config('service_credentials/auth_type').with_value('password')
     end
 
     context 'when overriding parameters' do