diff --git a/puppet/services/heat-base.yaml b/puppet/services/heat-base.yaml
index 226d2a5100..7eb58f5658 100644
--- a/puppet/services/heat-base.yaml
+++ b/puppet/services/heat-base.yaml
@@ -32,6 +32,10 @@ parameters:
                  via parameter_defaults in the resource registry.  This
                  mapping overrides those in ServiceNetMapDefaults.
     type: json
+  HeatPassword:
+    description: The password for the Heat service and db account, used by the Heat services.
+    type: string
+    hidden: true
   DefaultPasswords:
     default: {}
     type: json
@@ -60,11 +64,13 @@ outputs:
             key: 'context_is_admin'
             value: 'role:admin'
         heat::rabbit_heartbeat_timeout_threshold: 60
-        heat::keystone_tenant: 'service'
+        heat::keystone::authtoken::project_name: 'service'
+        heat::keystone::authtoken::auth_uri: {get_param: [EndpointMap, KeystoneInternal, uri] }
+        heat::keystone::authtoken::auth_url: {get_param: [EndpointMap, KeystoneAdmin, uri_no_suffix] }
+        heat::keystone::authtoken::password: {get_param: HeatPassword}
         heat::keystone::domain::domain_name: 'heat_stack'
         heat::keystone::domain::domain_admin: 'heat_stack_domain_admin'
         heat::keystone::domain::domain_admin_email: 'heat_stack_domain_admin@localhost'
-        heat::auth_plugin: 'password'
         heat::cron::purge_deleted::age: 30
         heat::cron::purge_deleted::age_type: 'days'
         heat::cron::purge_deleted::maxdelay: 3600
diff --git a/puppet/services/heat-engine.yaml b/puppet/services/heat-engine.yaml
index b230ec1d92..1b4f8e7f0d 100644
--- a/puppet/services/heat-engine.yaml
+++ b/puppet/services/heat-engine.yaml
@@ -71,8 +71,6 @@ outputs:
                   - {get_param: [EndpointMap, MysqlInternal, host]}
                   - '/heat'
             heat::keystone_ec2_uri: {get_param: [EndpointMap, KeystoneEC2, uri]}
-            heat::identity_uri: {get_param: [EndpointMap, KeystoneAdmin, uri_no_suffix]}
-            heat::keystone_password: {get_param: HeatPassword}
             heat::db::mysql::password: {get_param: HeatPassword}
             heat::keystone::domain::domain_password: {get_param: HeatStackDomainAdminPassword}
             heat::db::mysql::user: heat