diff --git a/manifests/federation/identity_provider.pp b/manifests/federation/identity_provider.pp
index 3205d7e97..b7f918292 100644
--- a/manifests/federation/identity_provider.pp
+++ b/manifests/federation/identity_provider.pp
@@ -82,19 +82,19 @@ class keystone::federation::identity_provider (
   $idp_entity_id,
   $idp_sso_endpoint,
   Stdlib::Absolutepath $idp_metadata_path,
-  $certfile                      = $facts['os_service_default'],
-  $keyfile                       = $facts['os_service_default'],
-  $user                          = $keystone::params::user,
-  $idp_organization_name         = $facts['os_service_default'],
-  $idp_organization_display_name = $facts['os_service_default'],
-  $idp_organization_url          = $facts['os_service_default'],
-  $idp_contact_company           = $facts['os_service_default'],
-  $idp_contact_name              = $facts['os_service_default'],
-  $idp_contact_surname           = $facts['os_service_default'],
-  $idp_contact_email             = $facts['os_service_default'],
-  $idp_contact_telephone         = $facts['os_service_default'],
-  $idp_contact_type              = $facts['os_service_default'],
-  $package_ensure                = present,
+  $certfile                               = $facts['os_service_default'],
+  $keyfile                                = $facts['os_service_default'],
+  $user                                   = $keystone::params::user,
+  $idp_organization_name                  = $facts['os_service_default'],
+  $idp_organization_display_name          = $facts['os_service_default'],
+  $idp_organization_url                   = $facts['os_service_default'],
+  $idp_contact_company                    = $facts['os_service_default'],
+  $idp_contact_name                       = $facts['os_service_default'],
+  $idp_contact_surname                    = $facts['os_service_default'],
+  $idp_contact_email                      = $facts['os_service_default'],
+  $idp_contact_telephone                  = $facts['os_service_default'],
+  $idp_contact_type                       = $facts['os_service_default'],
+  Stdlib::Ensure::Package $package_ensure = present,
 ) inherits keystone::params {
   include keystone::deps
 
diff --git a/manifests/init.pp b/manifests/init.pp
index cd6eaaab2..dd493700f 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -388,7 +388,7 @@
 #
 class keystone (
   Boolean $manage_package                         = true,
-  $package_ensure                                 = 'present',
+  Stdlib::Ensure::Package $package_ensure         = present,
   $catalog_driver                                 = $facts['os_service_default'],
   $token_provider                                 = 'fernet',
   $token_expiration                               = 3600,
diff --git a/manifests/ldap.pp b/manifests/ldap.pp
index de5c8672e..8a595cf83 100644
--- a/manifests/ldap.pp
+++ b/manifests/ldap.pp
@@ -220,16 +220,16 @@
 #   End user auth connection lifetime in seconds. (integer value)
 #   Defaults to $facts['os_service_default']
 #
-# [*package_ensure*]
-#   (optional) Desired ensure state of packages.
-#   accepts latest or specific versions.
-#   Defaults to present.
-#
 # [*manage_packages*]
 #   (optional) Whether or not this module should manage
 #   LDAP support packages.
 #   Defaults to true.
 #
+# [*package_ensure*]
+#   (optional) Desired ensure state of packages.
+#   accepts latest or specific versions.
+#   Defaults to present.
+#
 # == Authors
 #
 #   Dan Bode dan@puppetlabs.com
@@ -240,57 +240,57 @@
 # Copyright 2012 Puppetlabs Inc, unless otherwise noted.
 #
 class keystone::ldap (
-  $url                                  = $facts['os_service_default'],
-  $user                                 = $facts['os_service_default'],
-  $password                             = $facts['os_service_default'],
-  $suffix                               = $facts['os_service_default'],
-  $query_scope                          = $facts['os_service_default'],
-  $page_size                            = $facts['os_service_default'],
-  $user_tree_dn                         = $facts['os_service_default'],
-  $user_filter                          = $facts['os_service_default'],
-  $user_objectclass                     = $facts['os_service_default'],
-  $user_id_attribute                    = $facts['os_service_default'],
-  $user_name_attribute                  = $facts['os_service_default'],
-  $user_description_attribute           = $facts['os_service_default'],
-  $user_mail_attribute                  = $facts['os_service_default'],
-  $user_enabled_attribute               = $facts['os_service_default'],
-  $user_enabled_mask                    = $facts['os_service_default'],
-  $user_enabled_default                 = $facts['os_service_default'],
-  $user_enabled_invert                  = $facts['os_service_default'],
-  $user_attribute_ignore                = $facts['os_service_default'],
-  $user_default_project_id_attribute    = $facts['os_service_default'],
-  $user_pass_attribute                  = $facts['os_service_default'],
-  $user_enabled_emulation               = $facts['os_service_default'],
-  $user_enabled_emulation_dn            = $facts['os_service_default'],
-  $user_additional_attribute_mapping    = $facts['os_service_default'],
-  $group_tree_dn                        = $facts['os_service_default'],
-  $group_filter                         = $facts['os_service_default'],
-  $group_objectclass                    = $facts['os_service_default'],
-  $group_id_attribute                   = $facts['os_service_default'],
-  $group_name_attribute                 = $facts['os_service_default'],
-  $group_member_attribute               = $facts['os_service_default'],
-  $group_members_are_ids                = $facts['os_service_default'],
-  $group_desc_attribute                 = $facts['os_service_default'],
-  $group_attribute_ignore               = $facts['os_service_default'],
-  $group_additional_attribute_mapping   = $facts['os_service_default'],
-  $chase_referrals                      = $facts['os_service_default'],
-  $use_tls                              = $facts['os_service_default'],
+  $url                                    = $facts['os_service_default'],
+  $user                                   = $facts['os_service_default'],
+  $password                               = $facts['os_service_default'],
+  $suffix                                 = $facts['os_service_default'],
+  $query_scope                            = $facts['os_service_default'],
+  $page_size                              = $facts['os_service_default'],
+  $user_tree_dn                           = $facts['os_service_default'],
+  $user_filter                            = $facts['os_service_default'],
+  $user_objectclass                       = $facts['os_service_default'],
+  $user_id_attribute                      = $facts['os_service_default'],
+  $user_name_attribute                    = $facts['os_service_default'],
+  $user_description_attribute             = $facts['os_service_default'],
+  $user_mail_attribute                    = $facts['os_service_default'],
+  $user_enabled_attribute                 = $facts['os_service_default'],
+  $user_enabled_mask                      = $facts['os_service_default'],
+  $user_enabled_default                   = $facts['os_service_default'],
+  $user_enabled_invert                    = $facts['os_service_default'],
+  $user_attribute_ignore                  = $facts['os_service_default'],
+  $user_default_project_id_attribute      = $facts['os_service_default'],
+  $user_pass_attribute                    = $facts['os_service_default'],
+  $user_enabled_emulation                 = $facts['os_service_default'],
+  $user_enabled_emulation_dn              = $facts['os_service_default'],
+  $user_additional_attribute_mapping      = $facts['os_service_default'],
+  $group_tree_dn                          = $facts['os_service_default'],
+  $group_filter                           = $facts['os_service_default'],
+  $group_objectclass                      = $facts['os_service_default'],
+  $group_id_attribute                     = $facts['os_service_default'],
+  $group_name_attribute                   = $facts['os_service_default'],
+  $group_member_attribute                 = $facts['os_service_default'],
+  $group_members_are_ids                  = $facts['os_service_default'],
+  $group_desc_attribute                   = $facts['os_service_default'],
+  $group_attribute_ignore                 = $facts['os_service_default'],
+  $group_additional_attribute_mapping     = $facts['os_service_default'],
+  $chase_referrals                        = $facts['os_service_default'],
+  $use_tls                                = $facts['os_service_default'],
   Variant[Openstacklib::ServiceDefault, Stdlib::Absolutepath] $tls_cacertdir
     = $facts['os_service_default'],
-  $tls_cacertfile                       = $facts['os_service_default'],
-  $tls_req_cert                         = $facts['os_service_default'],
-  $connection_timeout                   = $facts['os_service_default'],
-  $use_pool                             = $facts['os_service_default'],
-  $pool_size                            = $facts['os_service_default'],
-  $pool_retry_max                       = $facts['os_service_default'],
-  $pool_retry_delay                     = $facts['os_service_default'],
-  $pool_connection_timeout              = $facts['os_service_default'],
-  $pool_connection_lifetime             = $facts['os_service_default'],
-  $use_auth_pool                        = $facts['os_service_default'],
-  $auth_pool_size                       = $facts['os_service_default'],
-  $auth_pool_connection_lifetime        = $facts['os_service_default'],
-  $package_ensure                       = present,
-  Boolean $manage_packages              = true,
+  $tls_cacertfile                         = $facts['os_service_default'],
+  $tls_req_cert                           = $facts['os_service_default'],
+  $connection_timeout                     = $facts['os_service_default'],
+  $use_pool                               = $facts['os_service_default'],
+  $pool_size                              = $facts['os_service_default'],
+  $pool_retry_max                         = $facts['os_service_default'],
+  $pool_retry_delay                       = $facts['os_service_default'],
+  $pool_connection_timeout                = $facts['os_service_default'],
+  $pool_connection_lifetime               = $facts['os_service_default'],
+  $use_auth_pool                          = $facts['os_service_default'],
+  $auth_pool_size                         = $facts['os_service_default'],
+  $auth_pool_connection_lifetime          = $facts['os_service_default'],
+  Boolean $manage_packages                = true,
+  Stdlib::Ensure::Package $package_ensure = present,
 ) inherits keystone::params {
   include keystone::deps
 
diff --git a/manifests/ldap_backend.pp b/manifests/ldap_backend.pp
index 831f7bfa5..6cfb4af20 100644
--- a/manifests/ldap_backend.pp
+++ b/manifests/ldap_backend.pp
@@ -231,16 +231,16 @@
 #   End user auth connection lifetime in seconds. (integer value)
 #   Defaults to $facts['os_service_default']
 #
-# [*package_ensure*]
-#   (optional) Desired ensure state of packages.
-#   accepts latest or specific versions.
-#   Defaults to present.
-#
 # [*manage_packages*]
 #   (optional) Whether or not this module should manage
 #   LDAP support packages.
 #   Defaults to true.
 #
+# [*package_ensure*]
+#   (optional) Desired ensure state of packages.
+#   accepts latest or specific versions.
+#   Defaults to present.
+#
 # [*create_domain_entry*]
 #   (optional) Creates the domain in keystone via a keystone_domain resource
 #   and attempts to refresh the keystone service.
@@ -249,59 +249,59 @@
 # == Dependencies
 # == Examples
 define keystone::ldap_backend (
-  $url                                  = $facts['os_service_default'],
-  $user                                 = $facts['os_service_default'],
-  $password                             = $facts['os_service_default'],
-  $suffix                               = $facts['os_service_default'],
-  $query_scope                          = $facts['os_service_default'],
-  $page_size                            = $facts['os_service_default'],
-  $user_tree_dn                         = $facts['os_service_default'],
-  $user_filter                          = $facts['os_service_default'],
-  $user_objectclass                     = $facts['os_service_default'],
-  $user_id_attribute                    = $facts['os_service_default'],
-  $user_name_attribute                  = $facts['os_service_default'],
-  $user_description_attribute           = $facts['os_service_default'],
-  $user_mail_attribute                  = $facts['os_service_default'],
-  $user_enabled_attribute               = $facts['os_service_default'],
-  $user_enabled_mask                    = $facts['os_service_default'],
-  $user_enabled_default                 = $facts['os_service_default'],
-  $user_enabled_invert                  = $facts['os_service_default'],
-  $user_attribute_ignore                = $facts['os_service_default'],
-  $user_default_project_id_attribute    = $facts['os_service_default'],
-  $user_pass_attribute                  = $facts['os_service_default'],
-  $user_enabled_emulation               = $facts['os_service_default'],
-  $user_enabled_emulation_dn            = $facts['os_service_default'],
-  $user_additional_attribute_mapping    = $facts['os_service_default'],
-  $group_tree_dn                        = $facts['os_service_default'],
-  $group_filter                         = $facts['os_service_default'],
-  $group_objectclass                    = $facts['os_service_default'],
-  $group_id_attribute                   = $facts['os_service_default'],
-  $group_name_attribute                 = $facts['os_service_default'],
-  $group_member_attribute               = $facts['os_service_default'],
-  $group_members_are_ids                = $facts['os_service_default'],
-  $group_desc_attribute                 = $facts['os_service_default'],
-  $group_attribute_ignore               = $facts['os_service_default'],
-  $group_additional_attribute_mapping   = $facts['os_service_default'],
-  $group_ad_nesting                     = $facts['os_service_default'],
-  $chase_referrals                      = $facts['os_service_default'],
-  $use_tls                              = $facts['os_service_default'],
-  $tls_cacertdir                        = $facts['os_service_default'],
-  $tls_cacertfile                       = $facts['os_service_default'],
-  $tls_req_cert                         = $facts['os_service_default'],
-  $identity_driver                      = 'ldap',
-  $connection_timeout                   = $facts['os_service_default'],
-  $use_pool                             = $facts['os_service_default'],
-  $pool_size                            = $facts['os_service_default'],
-  $pool_retry_max                       = $facts['os_service_default'],
-  $pool_retry_delay                     = $facts['os_service_default'],
-  $pool_connection_timeout              = $facts['os_service_default'],
-  $pool_connection_lifetime             = $facts['os_service_default'],
-  $use_auth_pool                        = $facts['os_service_default'],
-  $auth_pool_size                       = $facts['os_service_default'],
-  $auth_pool_connection_lifetime        = $facts['os_service_default'],
-  $package_ensure                       = present,
-  Boolean $manage_packages              = true,
-  Boolean $create_domain_entry          = false,
+  $url                                    = $facts['os_service_default'],
+  $user                                   = $facts['os_service_default'],
+  $password                               = $facts['os_service_default'],
+  $suffix                                 = $facts['os_service_default'],
+  $query_scope                            = $facts['os_service_default'],
+  $page_size                              = $facts['os_service_default'],
+  $user_tree_dn                           = $facts['os_service_default'],
+  $user_filter                            = $facts['os_service_default'],
+  $user_objectclass                       = $facts['os_service_default'],
+  $user_id_attribute                      = $facts['os_service_default'],
+  $user_name_attribute                    = $facts['os_service_default'],
+  $user_description_attribute             = $facts['os_service_default'],
+  $user_mail_attribute                    = $facts['os_service_default'],
+  $user_enabled_attribute                 = $facts['os_service_default'],
+  $user_enabled_mask                      = $facts['os_service_default'],
+  $user_enabled_default                   = $facts['os_service_default'],
+  $user_enabled_invert                    = $facts['os_service_default'],
+  $user_attribute_ignore                  = $facts['os_service_default'],
+  $user_default_project_id_attribute      = $facts['os_service_default'],
+  $user_pass_attribute                    = $facts['os_service_default'],
+  $user_enabled_emulation                 = $facts['os_service_default'],
+  $user_enabled_emulation_dn              = $facts['os_service_default'],
+  $user_additional_attribute_mapping      = $facts['os_service_default'],
+  $group_tree_dn                          = $facts['os_service_default'],
+  $group_filter                           = $facts['os_service_default'],
+  $group_objectclass                      = $facts['os_service_default'],
+  $group_id_attribute                     = $facts['os_service_default'],
+  $group_name_attribute                   = $facts['os_service_default'],
+  $group_member_attribute                 = $facts['os_service_default'],
+  $group_members_are_ids                  = $facts['os_service_default'],
+  $group_desc_attribute                   = $facts['os_service_default'],
+  $group_attribute_ignore                 = $facts['os_service_default'],
+  $group_additional_attribute_mapping     = $facts['os_service_default'],
+  $group_ad_nesting                       = $facts['os_service_default'],
+  $chase_referrals                        = $facts['os_service_default'],
+  $use_tls                                = $facts['os_service_default'],
+  $tls_cacertdir                          = $facts['os_service_default'],
+  $tls_cacertfile                         = $facts['os_service_default'],
+  $tls_req_cert                           = $facts['os_service_default'],
+  $identity_driver                        = 'ldap',
+  $connection_timeout                     = $facts['os_service_default'],
+  $use_pool                               = $facts['os_service_default'],
+  $pool_size                              = $facts['os_service_default'],
+  $pool_retry_max                         = $facts['os_service_default'],
+  $pool_retry_delay                       = $facts['os_service_default'],
+  $pool_connection_timeout                = $facts['os_service_default'],
+  $pool_connection_lifetime               = $facts['os_service_default'],
+  $use_auth_pool                          = $facts['os_service_default'],
+  $auth_pool_size                         = $facts['os_service_default'],
+  $auth_pool_connection_lifetime          = $facts['os_service_default'],
+  Boolean $manage_packages                = true,
+  Stdlib::Ensure::Package $package_ensure = present,
+  Boolean $create_domain_entry            = false,
 ) {
   include keystone::deps
   include keystone::params