diff --git a/metadata/service/client/cluster.yml b/metadata/service/client/cluster.yml
index fabf22c..8d0595f 100644
--- a/metadata/service/client/cluster.yml
+++ b/metadata/service/client/cluster.yml
@@ -3,6 +3,8 @@
 parameters:
   _param:
     opencontrail_version: 3.0
+    opencontrail_identity_port: 35357
+    opencontrail_identity_version: '2.0'
   opencontrail:
     client:
       enabled: True
@@ -10,7 +12,8 @@
       identity:
         engine: keystone
         host: ${_param:openstack_control_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
+        version: ${_param:opencontrail_identity_version}
         tenant: admin
         user: admin
         password: ${_param:keystone_admin_password}
diff --git a/metadata/service/client/single.yml b/metadata/service/client/single.yml
index 67038c2..19f73eb 100644
--- a/metadata/service/client/single.yml
+++ b/metadata/service/client/single.yml
@@ -3,6 +3,8 @@
 parameters:
   _param:
     opencontrail_version: 3.0
+    opencontrail_identity_port: 35357
+    opencontrail_identity_version: '2.0'
   opencontrail:
     client:
       enabled: True
@@ -10,7 +12,8 @@
       identity:
         engine: keystone
         host: ${_param:cluster_local_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
+        version: ${_param:opencontrail_identity_version}
         tenant: admin
         user: admin
         password: ${_param:keystone_admin_password}
diff --git a/metadata/service/control/analytics.yml b/metadata/service/control/analytics.yml
index fcc7ddd..3a1d78c 100644
--- a/metadata/service/control/analytics.yml
+++ b/metadata/service/control/analytics.yml
@@ -5,13 +5,15 @@
 parameters:
   _param:
     opencontrail_version: 2.2
+    opencontrail_identity_port: 35357
+    opencontrail_identity_version: '2.0'
   opencontrail:
     common:
       version: ${_param:opencontrail_version}
       identity:
         engine: keystone
         host: ${_param:cluster_vip_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         token: '${_param:keystone_service_token}'
         password: '${_param:keystone_admin_password}'
       network:
@@ -40,10 +42,10 @@
           port: 9160
       identity:
         engine: keystone
-        version: '2.0'
+        version: ${_param:opencontrail_identity_version}
         region: RegionOne
         host: ${_param:cluster_vip_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         user: admin
         password: '${_param:keystone_admin_password}'
         token: '${_param:keystone_service_token}'
diff --git a/metadata/service/control/cluster.yml b/metadata/service/control/cluster.yml
index 93a5acd..749ccfa 100644
--- a/metadata/service/control/cluster.yml
+++ b/metadata/service/control/cluster.yml
@@ -5,13 +5,15 @@
 parameters:
   _param:
     opencontrail_version: 2.2
+    opencontrail_identity_port: 35357
+    opencontrail_identity_version: '2.0'
   opencontrail:
     common:
       version: ${_param:opencontrail_version}
       identity:
         engine: keystone
         host: ${_param:cluster_vip_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         token: '${_param:keystone_service_token}'
         password: '${_param:keystone_admin_password}'
       network:
@@ -48,10 +50,10 @@
           port: 9160
       identity:
         engine: keystone
-        version: '2.0'
+        version: ${_param:opencontrail_identity_version}
         region: RegionOne
         host: ${_param:cluster_vip_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         user: admin
         password: '${_param:keystone_admin_password}'
         token: '${_param:keystone_service_token}'
@@ -102,10 +104,10 @@
           port: 9160
       identity:
         engine: keystone
-        version: '2.0'
+        version: ${_param:opencontrail_identity_version}
         region: RegionOne
         host: ${_param:cluster_vip_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         user: admin
         password: '${_param:keystone_admin_password}'
         token: '${_param:keystone_service_token}'
@@ -162,9 +164,9 @@
         port: 9160
       identity:
         engine: keystone
-        version: '2.0'
+        version: ${_param:opencontrail_identity_version}
         host: ${_param:cluster_vip_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         user: admin
         password: '${_param:keystone_admin_password}'
         token: '${_param:keystone_service_token}'
diff --git a/metadata/service/control/control.yml b/metadata/service/control/control.yml
index fe522cc..a29f7dd 100644
--- a/metadata/service/control/control.yml
+++ b/metadata/service/control/control.yml
@@ -5,13 +5,15 @@
 parameters:
   _param:
     opencontrail_version: 2.2
+    opencontrail_identity_port: 35357
+    opencontrail_identity_version: '2.0'
   opencontrail:
     common:
       version: ${_param:opencontrail_version}
       identity:
         engine: keystone
         host: ${_param:cluster_vip_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         token: '${_param:keystone_service_token}'
         password: '${_param:keystone_admin_password}'
       network:
@@ -48,10 +50,10 @@
           port: 9160
       identity:
         engine: keystone
-        version: '2.0'
+        version: ${_param:opencontrail_identity_version}
         region: RegionOne
         host: ${_param:cluster_vip_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         user: admin
         password: '${_param:keystone_admin_password}'
         token: '${_param:keystone_service_token}'
@@ -129,9 +131,10 @@
         port: 9160
       identity:
         engine: keystone
-        version: '2.0'
+        version: ${_param:opencontrail_identity_version}
+        region: RegionOne
         host: ${_param:cluster_vip_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         user: admin
         password: '${_param:keystone_admin_password}'
         token: '${_param:keystone_service_token}'
diff --git a/metadata/service/control/single.yml b/metadata/service/control/single.yml
index ae20c5e..ee4d19e 100644
--- a/metadata/service/control/single.yml
+++ b/metadata/service/control/single.yml
@@ -5,13 +5,15 @@
 parameters:
   _param:
     opencontrail_version: 2.2
+    opencontrail_identity_port: 35357
+    opencontrail_identity_version: '2.0'
   opencontrail:
     common:
       version: ${_param:opencontrail_version}
       identity:
         engine: keystone
         host: ${_param:single_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         token: '${_param:keystone_service_token}'
         password: '${_param:keystone_admin_password}'
       network:
@@ -48,10 +50,10 @@
           port: 11211
       identity:
         engine: keystone
-        version: '2.0'
+        version: ${_param:opencontrail_identity_version}
         region: RegionOne
         host: ${_param:single_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         user: admin
         password: '${_param:keystone_admin_password}'
         token: '${_param:keystone_service_token}'
@@ -89,10 +91,10 @@
           port: 9160
       identity:
         engine: keystone
-        version: '2.0'
+        version: ${_param:opencontrail_identity_version}
         region: RegionOne
         host: ${_param:single_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         user: admin
         password: '${_param:keystone_admin_password}'
         token: '${_param:keystone_service_token}'
@@ -141,9 +143,9 @@
         port: 9160
       identity:
         engine: keystone
-        version: '2.0'
+        version: ${_param:opencontrail_identity_version}
         host: ${_param:single_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         user: admin
         password: '${_param:keystone_admin_password}'
         token: '${_param:keystone_service_token}'
diff --git a/metadata/service/test/single.yml b/metadata/service/test/single.yml
index efb8d59..dcd37d9 100644
--- a/metadata/service/test/single.yml
+++ b/metadata/service/test/single.yml
@@ -1,6 +1,8 @@
 applications:
 - opencontrail
 parameters:
+  _param:
+    opencontrail_identity_port: 35357
   opencontrail:
     test:
       enabled: True
@@ -38,7 +40,7 @@
         bind:
           address: 0.0.0.0
           private_address: ${_param:keystone_service_host}
-          private_port: 35357
+          private_port: ${_param:opencontrail_identity_port}
           public_address: ${_param:keystone_service_host}
           public_port: 5000
         region: RegionOne
diff --git a/opencontrail/config.sls b/opencontrail/config.sls
index d580a1e..3aa7378 100644
--- a/opencontrail/config.sls
+++ b/opencontrail/config.sls
@@ -117,7 +117,7 @@
   - source: salt://opencontrail/files/{{ config.version }}/contrail-api.ini
   - template: jinja
   - makedirs: true
-{%- if config.get('config_only', False) %}
+{%- if not config.get('config_only', False) %}
   - watch_in:
     - service: opencontrail_config_services
 {%- endif %}
@@ -148,13 +148,10 @@
   - source: salt://opencontrail/files/{{ config.version }}/contrail-config-nodemgr.conf
   - template: jinja
 
-
-{%- if config.identity.engine == "keystone" %}
 /etc/contrail/contrail-keystone-auth.conf:
   file.managed:
   - source: salt://opencontrail/files/{{ config.version }}/contrail-keystone-auth.conf
   - template: jinja
-{%- endif %}
 
 /etc/contrail/contrail-schema.conf:
   file.managed:
diff --git a/opencontrail/files/4.0/client_vnc_api_lib.ini b/opencontrail/files/4.0/client_vnc_api_lib.ini
index fac3c79..e193fdb 100644
--- a/opencontrail/files/4.0/client_vnc_api_lib.ini
+++ b/opencontrail/files/4.0/client_vnc_api_lib.ini
@@ -1,4 +1,5 @@
 {%- from "opencontrail/map.jinja" import client with context %}
+
 [global]
 ;WEB_SERVER = 127.0.0.1
 ;WEB_PORT = 9696  ; connection through quantum plugin
@@ -18,5 +19,8 @@
 AUTHN_TENANT = {{ client.identity.tenant }}
 AUTHN_USER = {{ client.identity.user }}
 AUTHN_PASSWORD = {{ client.identity.password }}
+{%- if client.identity.version == "3" %}
+AUTHN_URL = /v3/auth/tokens
+{%- else %}
 AUTHN_URL = /v2.0/tokens
 {%- endif %}
diff --git a/opencontrail/files/4.0/contrail-keystone-auth.conf b/opencontrail/files/4.0/contrail-keystone-auth.conf
index 4c32311..f3aeb94 100644
--- a/opencontrail/files/4.0/contrail-keystone-auth.conf
+++ b/opencontrail/files/4.0/contrail-keystone-auth.conf
@@ -1,7 +1,9 @@
 {%- from "opencontrail/map.jinja" import config with context -%}
-{%- if config.identity.engine != "none" %}
 
 [KEYSTONE]
+
+{%- if config.identity.engine != "none" %}
+
 auth_host={{ config.identity.host }}
 auth_protocol=http
 auth_port={{ config.identity.port }}
diff --git a/tests/pillar/repo_cassandra.sls b/tests/pillar/repo_cassandra.sls
index d6c454d..0be66f8 100644
--- a/tests/pillar/repo_cassandra.sls
+++ b/tests/pillar/repo_cassandra.sls
@@ -5,6 +5,6 @@
       cassandra-21x:
         source: "deb [arch=amd64] http://www.apache.org/dist/cassandra/debian 21x main"
         architectures: amd64
-        key_server: hkp://p80.pool.sks-keyservers.net:80
+        key_server: keyserver.ubuntu.com
         key_id: A278B781FE4B2BDA