diff --git a/heat/files/mitaka/heat.conf.Debian b/heat/files/mitaka/heat.conf.Debian
index 0bf626e..7cdb2e5 100644
--- a/heat/files/mitaka/heat.conf.Debian
+++ b/heat/files/mitaka/heat.conf.Debian
@@ -773,11 +773,11 @@
 endpoint_type = {{ server.identity.get('endpoint_type_heat',
                                        server.identity.get('endpoint_type_default', 'publicURL')) }}
 [clients_keystone]
-{%- if server.clients.keystone is defined %}
-auth_uri= {{ server.clients.keystone.protocol }}://{{ server.clients.keystone.host }}:{{ server.clients.keystone.port }}
+{%- if server.get('clients',{}).keystone is defined %}
+auth_uri = {{ server.clients.keystone.get('protocol', 'http') }}://{{ server.clients.keystone.host }}:{{ server.clients.keystone.port }}
 insecure = {{ server.clients.keystone.get('insecure', false) }}
 {%- else %}
-auth_uri=http://{{ server.identity.host }}:35357
+auth_uri = {{ server.identity.get('protocol', 'http') }}://{{ server.identity.host }}:35357
 {%- endif %}
 
 
diff --git a/heat/files/newton/heat.conf.Debian b/heat/files/newton/heat.conf.Debian
index ca160e4..4f80c51 100644
--- a/heat/files/newton/heat.conf.Debian
+++ b/heat/files/newton/heat.conf.Debian
@@ -771,11 +771,11 @@
 endpoint_type = {{ server.identity.get('endpoint_type_heat',
                                        server.identity.get('endpoint_type_default', 'publicURL')) }}
 [clients_keystone]
-{%- if server.clients.keystone is defined %}
-auth_uri= {{ server.clients.keystone.protocol }}://{{ server.clients.keystone.host }}:{{ server.clients.keystone.port }}
+{%- if server.get('clients',{}).keystone is defined %}
+auth_uri = {{ server.clients.keystone.get('protocol', 'http') }}://{{ server.clients.keystone.host }}:{{ server.clients.keystone.port }}
 insecure = {{ server.clients.keystone.get('insecure', false) }}
 {%- else %}
-auth_uri=http://{{ server.identity.host }}:35357
+auth_uri = {{ server.identity.get('protocol', 'http') }}://{{ server.identity.host }}:35357
 {%- endif %}
 
 
diff --git a/heat/files/ocata/heat.conf.Debian b/heat/files/ocata/heat.conf.Debian
index f2d78ab..4d276f8 100644
--- a/heat/files/ocata/heat.conf.Debian
+++ b/heat/files/ocata/heat.conf.Debian
@@ -1341,12 +1341,12 @@
 {%- endif %}
 
 [clients_keystone]
-{%- if server.clients is defined %}
-{%- if server.clients.keystone is defined %}
+{%- if server.get('clients',{}).keystone is defined %}
 insecure = {{ server.clients.keystone.get('insecure', false) }}
+auth_uri = {{ server.clients.keystone.get('protocol', 'http') }}://{{ server.clients.keystone.host }}:{{ server.clients.keystone.port }}
+{%- else %}
+auth_uri = {{ server.identity.get('protocol', 'http') }}://{{ server.identity.host }}:35357
 {%- endif %}
-{%- endif %}
-auth_uri={{ server.identity.get('protocol', 'http') }}://{{ server.identity.host }}:35357
 {%- if server.identity.get('protocol', 'http') == 'https' %}
 ca_file={{ server.identity.get('cacert_file', server.cacert_file) }}
 {%- endif %}
diff --git a/heat/files/pike/heat.conf.Debian b/heat/files/pike/heat.conf.Debian
index 0ddef86..cbac037 100644
--- a/heat/files/pike/heat.conf.Debian
+++ b/heat/files/pike/heat.conf.Debian
@@ -1349,12 +1349,12 @@
 {%- endif %}
 
 [clients_keystone]
-{%- if server.clients is defined %}
-{%- if server.clients.keystone is defined %}
+{%- if server.get('clients',{}).keystone is defined %}
 insecure = {{ server.clients.keystone.get('insecure', false) }}
+auth_uri = {{ server.clients.keystone.get('protocol', 'http') }}://{{ server.clients.keystone.host }}:{{ server.clients.keystone.port }}
+{%- else %}
+auth_uri = {{ server.identity.get('protocol', 'http') }}://{{ server.identity.host }}:35357
 {%- endif %}
-{%- endif %}
-auth_uri={{ server.identity.get('protocol', 'http') }}://{{ server.identity.host }}:35357
 {%- if server.identity.get('protocol', 'http') == 'https' %}
 ca_file={{ server.identity.get('cacert_file', server.cacert_file) }}
 {%- endif %}
diff --git a/heat/files/queens/heat.conf.Debian b/heat/files/queens/heat.conf.Debian
index 68f07de..ec84f36 100644
--- a/heat/files/queens/heat.conf.Debian
+++ b/heat/files/queens/heat.conf.Debian
@@ -548,16 +548,16 @@
 # From heat.common.config
 #
 
-{%- if server.clients is defined %}
-{%- if server.clients.keystone is defined %}
+{%- if server.get('clients',{}).keystone is defined %}
 # If set, then the server's certificate will not be verified. (boolean value)
 #insecure = <None>
 insecure = {{ server.clients.keystone.get('insecure', false) }}
-{%- endif %}
-{%- endif %}
+auth_uri = {{ server.clients.keystone.get('protocol', 'http') }}://{{ server.clients.keystone.host }}:{{ server.clients.keystone.port }}
+{%- else %}
 # Unversioned keystone url in format like http://0.0.0.0:5000. (string value)
 #auth_uri =
-auth_uri={{ server.identity.get('protocol', 'http') }}://{{ server.identity.host }}:35357
+auth_uri = {{ server.identity.get('protocol', 'http') }}://{{ server.identity.host }}:35357
+{%- endif %}
 {%- if server.identity.get('protocol', 'http') == 'https' %}
 # Optional CA cert file to use in SSL connections. (string value)
 #ca_file = <None>