diff --git a/puppet/services/heat-api-cfn.yaml b/puppet/services/heat-api-cfn.yaml
index 1a86ec718c..12d4a6a197 100644
--- a/puppet/services/heat-api-cfn.yaml
+++ b/puppet/services/heat-api-cfn.yaml
@@ -76,9 +76,11 @@ outputs:
         include ::tripleo::profile::base::heat::api_cfn
       service_config_settings:
         keystone:
-          heat::keystone::auth_cfn::tenant: 'service'
-          heat::keystone::auth_cfn::public_url: {get_param: [EndpointMap, HeatCfnPublic, uri]}
-          heat::keystone::auth_cfn::internal_url: {get_param: [EndpointMap, HeatCfnInternal, uri]}
-          heat::keystone::auth_cfn::admin_url: {get_param: [EndpointMap, HeatCfnAdmin, uri]}
-          heat::keystone::auth_cfn::password: {get_param: HeatPassword}
-          heat::keystone::auth_cfn::region: {get_param: KeystoneRegion}
+          map_merge:
+            - get_attr: [HeatBase, role_data, service_config_settings, keystone]
+            - heat::keystone::auth_cfn::tenant: 'service'
+              heat::keystone::auth_cfn::public_url: {get_param: [EndpointMap, HeatCfnPublic, uri]}
+              heat::keystone::auth_cfn::internal_url: {get_param: [EndpointMap, HeatCfnInternal, uri]}
+              heat::keystone::auth_cfn::admin_url: {get_param: [EndpointMap, HeatCfnAdmin, uri]}
+              heat::keystone::auth_cfn::password: {get_param: HeatPassword}
+              heat::keystone::auth_cfn::region: {get_param: KeystoneRegion}
diff --git a/puppet/services/heat-api.yaml b/puppet/services/heat-api.yaml
index 2ea96fc002..b0cd16ddd1 100644
--- a/puppet/services/heat-api.yaml
+++ b/puppet/services/heat-api.yaml
@@ -76,9 +76,11 @@ outputs:
         include ::tripleo::profile::base::heat::api
       service_config_settings:
         keystone:
-          heat::keystone::auth::tenant: 'service'
-          heat::keystone::auth::public_url: {get_param: [EndpointMap, HeatPublic, uri]}
-          heat::keystone::auth::internal_url: {get_param: [EndpointMap, HeatInternal, uri]}
-          heat::keystone::auth::admin_url: {get_param: [EndpointMap, HeatAdmin, uri]}
-          heat::keystone::auth::password: {get_param: HeatPassword}
-          heat::keystone::auth::region: {get_param: KeystoneRegion}
+          map_merge:
+            - get_attr: [HeatBase, role_data, service_config_settings, keystone]
+            - heat::keystone::auth::tenant: 'service'
+              heat::keystone::auth::public_url: {get_param: [EndpointMap, HeatPublic, uri]}
+              heat::keystone::auth::internal_url: {get_param: [EndpointMap, HeatInternal, uri]}
+              heat::keystone::auth::admin_url: {get_param: [EndpointMap, HeatAdmin, uri]}
+              heat::keystone::auth::password: {get_param: HeatPassword}
+              heat::keystone::auth::region: {get_param: KeystoneRegion}
diff --git a/puppet/services/heat-base.yaml b/puppet/services/heat-base.yaml
index 7eb58f5658..a2a65d7daa 100644
--- a/puppet/services/heat-base.yaml
+++ b/puppet/services/heat-base.yaml
@@ -77,3 +77,8 @@ outputs:
         heat::cron::purge_deleted::destination: '/dev/null'
         heat::db::database_db_max_retries: -1
         heat::db::database_max_retries: -1
+      service_config_settings:
+        keystone:
+          tripleo::profile::base::keystone::heat_admin_domain: 'heat_stack'
+          tripleo::profile::base::keystone::heat_admin_user: 'heat_stack_domain_admin'
+          tripleo::profile::base::keystone::heat_admin_email: 'heat_stack_domain_admin@localhost'