diff --git a/manifests/keystone/trust.pp b/manifests/keystone/trust.pp
index ebed742..844da2b 100644
--- a/manifests/keystone/trust.pp
+++ b/manifests/keystone/trust.pp
@@ -4,14 +4,13 @@
 #
 # === Parameters
 #
+# [*password*]
+#   (Required) Password of the trust user
+#
 # [*username*]
 #   (Optional) The name of the trust user
 #   Defaults to 'zaqar'
 #
-# [*password*]
-#   (Optional) Password to create for the trust user
-#   Defaults to $facts['os_service_default']
-#
 # [*auth_url*]
 #   (Optional) The URL to use for authentication.
 #   Defaults to 'http://localhost:5000'
@@ -29,12 +28,12 @@
 #   Defaults to 'password'
 #
 class zaqar::keystone::trust(
-  $username                       = 'zaqar',
-  $password                       = $facts['os_service_default'],
-  $auth_url                       = 'http://localhost:5000',
-  $user_domain_name               = 'Default',
-  $auth_section                   = $facts['os_service_default'],
-  $auth_type                      = 'password',
+  $password,
+  $username         = 'zaqar',
+  $auth_url         = 'http://localhost:5000',
+  $user_domain_name = 'Default',
+  $auth_section     = $facts['os_service_default'],
+  $auth_type        = 'password',
 ) {
 
   include zaqar::deps
diff --git a/spec/classes/zaqar_init_spec.rb b/spec/classes/zaqar_init_spec.rb
index 8dd978f..ed879d2 100644
--- a/spec/classes/zaqar_init_spec.rb
+++ b/spec/classes/zaqar_init_spec.rb
@@ -3,7 +3,10 @@ describe 'zaqar' do
   shared_examples 'zaqar' do
     let :pre_condition do
       "class { 'zaqar::keystone::authtoken':
-         password =>'password',
+         password => 'password',
+       }
+       class { 'zaqar::keystone::trust':
+         password => 'password',
        }"
     end
     let :req_params do
diff --git a/spec/classes/zaqar_keystone_trust_spec.rb b/spec/classes/zaqar_keystone_trust_spec.rb
index 22d482e..75a241b 100644
--- a/spec/classes/zaqar_keystone_trust_spec.rb
+++ b/spec/classes/zaqar_keystone_trust_spec.rb
@@ -3,16 +3,31 @@ require 'spec_helper'
 describe 'zaqar::keystone::trust' do
 
   shared_examples_for 'zaqar::keystone::trust' do
-    describe 'with custom values' do
-      let :params do
-        {
+    let :params do
+      { :password => 'secret' }
+    end
+
+    context 'with default values' do
+      it 'configures default values' do
+        is_expected.to contain_zaqar_config('trustee/username').with_value('zaqar')
+        is_expected.to contain_zaqar_config('trustee/password').with_value('secret').with_secret(true)
+        is_expected.to contain_zaqar_config('trustee/auth_url').with_value('http://localhost:5000')
+        is_expected.to contain_zaqar_config('trustee/user_domain_name').with_value('Default')
+        is_expected.to contain_zaqar_config('trustee/auth_section').with_value('<SERVICE DEFAULT>')
+        is_expected.to contain_zaqar_config('trustee/auth_type').with_value('password')
+      end
+    end
+
+    context 'with custom values' do
+      before :each do
+        params.merge!({
           :username         => 'user',
           :password         => 'secret',
           :auth_url         => 'http://there',
           :user_domain_name => 'domain',
           :auth_section     => 'keystone',
           :auth_type        => 'token',
-        }
+        })
       end
 
       it 'configures custom values' do
diff --git a/spec/classes/zaqar_management_mongodb_spec.rb b/spec/classes/zaqar_management_mongodb_spec.rb
index ae03292..8a0c64b 100644
--- a/spec/classes/zaqar_management_mongodb_spec.rb
+++ b/spec/classes/zaqar_management_mongodb_spec.rb
@@ -5,7 +5,10 @@ describe 'zaqar::management::mongodb' do
   shared_examples_for 'zaqar::management::mongodb' do
     let :pre_condition do
       "class { 'zaqar::keystone::authtoken':
-         password =>'foo',
+         password => 'foo',
+       }
+       class { 'zaqar::keystone::trust':
+         password => 'foo',
        }
        class { 'zaqar':
          management_store => 'mongodb',
diff --git a/spec/classes/zaqar_management_redis_spec.rb b/spec/classes/zaqar_management_redis_spec.rb
index 09a6a92..c21fcf6 100644
--- a/spec/classes/zaqar_management_redis_spec.rb
+++ b/spec/classes/zaqar_management_redis_spec.rb
@@ -5,7 +5,10 @@ describe 'zaqar::management::redis' do
   shared_examples_for 'zaqar::management::redis' do
     let :pre_condition do
       "class { 'zaqar::keystone::authtoken':
-         password =>'foo',
+         password => 'foo',
+       }
+       class { 'zaqar::keystone::trust':
+         password => 'foo',
        }
        class { 'zaqar':
          management_store =>'redis',
diff --git a/spec/classes/zaqar_management_sqlalchemy_spec.rb b/spec/classes/zaqar_management_sqlalchemy_spec.rb
index ecea5ef..9bade93 100644
--- a/spec/classes/zaqar_management_sqlalchemy_spec.rb
+++ b/spec/classes/zaqar_management_sqlalchemy_spec.rb
@@ -5,7 +5,10 @@ describe 'zaqar::management::sqlalchemy' do
   shared_examples_for 'zaqar::management::sqlalchemy' do
     let :pre_condition do
       "class { 'zaqar::keystone::authtoken':
-         password =>'foo',
+         password => 'foo',
+       }
+       class { 'zaqar::keystone::trust':
+         password => 'foo',
        }
        class { 'zaqar':
          management_store =>'sqlalchemy',
diff --git a/spec/classes/zaqar_messaging_mongodb_spec.rb b/spec/classes/zaqar_messaging_mongodb_spec.rb
index b44974d..0b9ca52 100644
--- a/spec/classes/zaqar_messaging_mongodb_spec.rb
+++ b/spec/classes/zaqar_messaging_mongodb_spec.rb
@@ -5,7 +5,10 @@ describe 'zaqar::messaging::mongodb' do
   shared_examples_for 'zaqar::messaging::mongodb' do
     let :pre_condition do
       "class { 'zaqar::keystone::authtoken':
-         password =>'foo',
+         password => 'foo',
+       }
+       class { 'zaqar::keystone::trust':
+         password => 'foo',
        }
        class { 'zaqar':
          message_store => 'mongodb'
diff --git a/spec/classes/zaqar_messaging_redis_spec.rb b/spec/classes/zaqar_messaging_redis_spec.rb
index 4dfac76..d083525 100644
--- a/spec/classes/zaqar_messaging_redis_spec.rb
+++ b/spec/classes/zaqar_messaging_redis_spec.rb
@@ -5,13 +5,16 @@ describe 'zaqar::messaging::redis' do
   shared_examples_for 'zaqar::messaging::redis' do
     let :pre_condition do
       "class { 'zaqar::keystone::authtoken':
-         password =>'foo',
+         password => 'foo',
+       }
+       class { 'zaqar::keystone::trust':
+         password => 'foo',
        }
        class { 'zaqar':
          message_store =>'redis',
        }"
-
     end
+
     let :req_params do
       {
         :uri   => 'redis://127.0.0.1:6379',
diff --git a/spec/classes/zaqar_messaging_swift_spec.rb b/spec/classes/zaqar_messaging_swift_spec.rb
index 48ed9fe..2caddf1 100644
--- a/spec/classes/zaqar_messaging_swift_spec.rb
+++ b/spec/classes/zaqar_messaging_swift_spec.rb
@@ -5,7 +5,10 @@ describe 'zaqar::messaging::swift' do
   shared_examples_for 'zaqar::messaging::swift' do
     let :pre_condition do
       "class { 'zaqar::keystone::authtoken':
-         password =>'foo',
+         password => 'foo',
+       }
+       class { 'zaqar::keystone::trust':
+         password => 'foo',
        }
        class { 'zaqar':
          message_store =>'swift',
diff --git a/spec/classes/zaqar_server_spec.rb b/spec/classes/zaqar_server_spec.rb
index b869a03..d3642fa 100644
--- a/spec/classes/zaqar_server_spec.rb
+++ b/spec/classes/zaqar_server_spec.rb
@@ -5,9 +5,12 @@ describe 'zaqar::server' do
     describe 'with a zaqar server enabled' do
       let :pre_condition do
         "class { 'zaqar::keystone::authtoken':
-           password =>'foo',
+           password => 'foo',
          }
-         class {'::zaqar': }"
+        class { 'zaqar::keystone::trust':
+           password => 'foo',
+         }
+         class { 'zaqar': }"
       end
 
       it { is_expected.to contain_service(platform_params[:zaqar_service_name]).with(
diff --git a/spec/defines/zaqar_server_instance_spec.rb b/spec/defines/zaqar_server_instance_spec.rb
index 575731e..f76a24f 100644
--- a/spec/defines/zaqar_server_instance_spec.rb
+++ b/spec/defines/zaqar_server_instance_spec.rb
@@ -9,9 +9,12 @@ describe 'zaqar::server_instance' do
 
       let :pre_condition do
         "class { 'zaqar::keystone::authtoken':
-           password =>'foo',
+           password => 'foo',
          }
-         class {'::zaqar': }"
+         class { 'zaqar::keystone::trust':
+           password => 'foo',
+         }
+         class { 'zaqar': }"
       end
 
       let :params do