diff --git a/README.rst b/README.rst
index 7f7668b..8c882e6 100644
--- a/README.rst
+++ b/README.rst
@@ -67,6 +67,19 @@
           virtual_host: '/openstack'
           ha_queues: True
 
+Define server clients keystone parameter
+
+.. code-block:: yaml
+
+    heat:
+      server:
+        clients:
+          keystone:
+            protocol: https
+            host: 10.0.106.10
+            port: 5000
+            insecure: false
+
 Enable CORS parameters
 
 .. code-block:: yaml
diff --git a/heat/files/mitaka/heat.conf.Debian b/heat/files/mitaka/heat.conf.Debian
index 56d2466..bf1ed85 100644
--- a/heat/files/mitaka/heat.conf.Debian
+++ b/heat/files/mitaka/heat.conf.Debian
@@ -749,7 +749,13 @@
 endpoint_type = {{ server.identity.get('endpoint_type_heat',
                                        server.identity.get('endpoint_type_default', 'publicURL')) }}
 [clients_keystone]
+{%- if server.clients.keystone is defined %}
+auth_uri= {{ server.clients.keystone.protocol }}://{{ server.clients.keystone.host }}:{{ server.clients.keystone.port }}
+insecure = {{ server.clients.keystone.get('insecure', false) }}
+{%- else %}
 auth_uri=http://{{ server.identity.host }}:35357
+{%- endif %}
+
 
 {%- if pillar.get('opencontrail', {}).get('client', {}).get('enabled', False) %}
 
diff --git a/heat/files/newton/heat.conf.Debian b/heat/files/newton/heat.conf.Debian
index 3250b4e..266c516 100644
--- a/heat/files/newton/heat.conf.Debian
+++ b/heat/files/newton/heat.conf.Debian
@@ -747,7 +747,13 @@
 endpoint_type = {{ server.identity.get('endpoint_type_heat',
                                        server.identity.get('endpoint_type_default', 'publicURL')) }}
 [clients_keystone]
+{%- if server.clients.keystone is defined %}
+auth_uri= {{ server.clients.keystone.protocol }}://{{ server.clients.keystone.host }}:{{ server.clients.keystone.port }}
+insecure = {{ server.clients.keystone.get('insecure', false) }}
+{%- else %}
 auth_uri=http://{{ server.identity.host }}:35357
+{%- endif %}
+
 
 {%- if pillar.get('opencontrail', {}).get('client', {}).get('enabled', False) %}
 
diff --git a/heat/files/ocata/heat.conf.Debian b/heat/files/ocata/heat.conf.Debian
index f970701..b2b382b 100644
--- a/heat/files/ocata/heat.conf.Debian
+++ b/heat/files/ocata/heat.conf.Debian
@@ -860,9 +860,15 @@
 
 # If set, then the server's certificate will not be verified. (boolean value)
 #insecure = <None>
+{%- if server.clients.keystone is defined %}
+insecure = {{ server.clients.keystone.get('insecure', false) }}
+{%- endif %}
 
 # Unversioned keystone url in format like http://0.0.0.0:5000. (string value)
 #auth_uri =
+{%- if server.clients.keystone is defined %}
+auth_uri= {{ server.clients.keystone.protocol }}://{{ server.clients.keystone.host }}:{{ server.clients.keystone.port }}
+{%- endif %}
 
 
 [clients_magnum]
diff --git a/heat/map.jinja b/heat/map.jinja
index f6c7a9f..075605e 100644
--- a/heat/map.jinja
+++ b/heat/map.jinja
@@ -4,13 +4,15 @@
         'pkgs': ['heat-api', 'heat-api-cfn', 'heat-api-cloudwatch', 'heat-engine', 'heat-common','python-heatclient', 'gettext-base'],
         'services': ['heat-api', 'heat-api-cfn', 'heat-api-cloudwatch', 'heat-engine'],
         'notification': False,
-        'cors': {}
+        'cors': {},
+        'clients': {}
     },
     'RedHat': {
         'pkgs': ['openstack-heat-api', 'openstack-heat-api-cfn', 'openstack-heat-api-cloudwatch', 'openstack-heat-engine', 'openstack-heat-common'],
         'services': ['openstack-heat-api', 'openstack-heat-api-cfn', 'openstack-heat-api-cloudwatch', 'openstack-heat-engine'],
         'notification': False,
-        'cors': {}
+        'cors': {},
+        'clients': {}
     },
 }, merge=pillar.heat.get('server', {})) %}