diff --git a/metadata/service/client/cluster.yml b/metadata/service/client/cluster.yml
index fabf22c..8d0595f 100644
--- a/metadata/service/client/cluster.yml
+++ b/metadata/service/client/cluster.yml
@@ -3,6 +3,8 @@
 parameters:
   _param:
     opencontrail_version: 3.0
+    opencontrail_identity_port: 35357
+    opencontrail_identity_version: '2.0'
   opencontrail:
     client:
       enabled: True
@@ -10,7 +12,8 @@
       identity:
         engine: keystone
         host: ${_param:openstack_control_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
+        version: ${_param:opencontrail_identity_version}
         tenant: admin
         user: admin
         password: ${_param:keystone_admin_password}
diff --git a/metadata/service/client/single.yml b/metadata/service/client/single.yml
index 67038c2..19f73eb 100644
--- a/metadata/service/client/single.yml
+++ b/metadata/service/client/single.yml
@@ -3,6 +3,8 @@
 parameters:
   _param:
     opencontrail_version: 3.0
+    opencontrail_identity_port: 35357
+    opencontrail_identity_version: '2.0'
   opencontrail:
     client:
       enabled: True
@@ -10,7 +12,8 @@
       identity:
         engine: keystone
         host: ${_param:cluster_local_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
+        version: ${_param:opencontrail_identity_version}
         tenant: admin
         user: admin
         password: ${_param:keystone_admin_password}
diff --git a/metadata/service/control/analytics.yml b/metadata/service/control/analytics.yml
index fcc7ddd..3a1d78c 100644
--- a/metadata/service/control/analytics.yml
+++ b/metadata/service/control/analytics.yml
@@ -5,13 +5,15 @@
 parameters:
   _param:
     opencontrail_version: 2.2
+    opencontrail_identity_port: 35357
+    opencontrail_identity_version: '2.0'
   opencontrail:
     common:
       version: ${_param:opencontrail_version}
       identity:
         engine: keystone
         host: ${_param:cluster_vip_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         token: '${_param:keystone_service_token}'
         password: '${_param:keystone_admin_password}'
       network:
@@ -40,10 +42,10 @@
           port: 9160
       identity:
         engine: keystone
-        version: '2.0'
+        version: ${_param:opencontrail_identity_version}
         region: RegionOne
         host: ${_param:cluster_vip_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         user: admin
         password: '${_param:keystone_admin_password}'
         token: '${_param:keystone_service_token}'
diff --git a/metadata/service/control/cluster.yml b/metadata/service/control/cluster.yml
index 93a5acd..749ccfa 100644
--- a/metadata/service/control/cluster.yml
+++ b/metadata/service/control/cluster.yml
@@ -5,13 +5,15 @@
 parameters:
   _param:
     opencontrail_version: 2.2
+    opencontrail_identity_port: 35357
+    opencontrail_identity_version: '2.0'
   opencontrail:
     common:
       version: ${_param:opencontrail_version}
       identity:
         engine: keystone
         host: ${_param:cluster_vip_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         token: '${_param:keystone_service_token}'
         password: '${_param:keystone_admin_password}'
       network:
@@ -48,10 +50,10 @@
           port: 9160
       identity:
         engine: keystone
-        version: '2.0'
+        version: ${_param:opencontrail_identity_version}
         region: RegionOne
         host: ${_param:cluster_vip_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         user: admin
         password: '${_param:keystone_admin_password}'
         token: '${_param:keystone_service_token}'
@@ -102,10 +104,10 @@
           port: 9160
       identity:
         engine: keystone
-        version: '2.0'
+        version: ${_param:opencontrail_identity_version}
         region: RegionOne
         host: ${_param:cluster_vip_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         user: admin
         password: '${_param:keystone_admin_password}'
         token: '${_param:keystone_service_token}'
@@ -162,9 +164,9 @@
         port: 9160
       identity:
         engine: keystone
-        version: '2.0'
+        version: ${_param:opencontrail_identity_version}
         host: ${_param:cluster_vip_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         user: admin
         password: '${_param:keystone_admin_password}'
         token: '${_param:keystone_service_token}'
diff --git a/metadata/service/control/control.yml b/metadata/service/control/control.yml
index fe522cc..a29f7dd 100644
--- a/metadata/service/control/control.yml
+++ b/metadata/service/control/control.yml
@@ -5,13 +5,15 @@
 parameters:
   _param:
     opencontrail_version: 2.2
+    opencontrail_identity_port: 35357
+    opencontrail_identity_version: '2.0'
   opencontrail:
     common:
       version: ${_param:opencontrail_version}
       identity:
         engine: keystone
         host: ${_param:cluster_vip_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         token: '${_param:keystone_service_token}'
         password: '${_param:keystone_admin_password}'
       network:
@@ -48,10 +50,10 @@
           port: 9160
       identity:
         engine: keystone
-        version: '2.0'
+        version: ${_param:opencontrail_identity_version}
         region: RegionOne
         host: ${_param:cluster_vip_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         user: admin
         password: '${_param:keystone_admin_password}'
         token: '${_param:keystone_service_token}'
@@ -129,9 +131,10 @@
         port: 9160
       identity:
         engine: keystone
-        version: '2.0'
+        version: ${_param:opencontrail_identity_version}
+        region: RegionOne
         host: ${_param:cluster_vip_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         user: admin
         password: '${_param:keystone_admin_password}'
         token: '${_param:keystone_service_token}'
diff --git a/metadata/service/control/single.yml b/metadata/service/control/single.yml
index ae20c5e..ee4d19e 100644
--- a/metadata/service/control/single.yml
+++ b/metadata/service/control/single.yml
@@ -5,13 +5,15 @@
 parameters:
   _param:
     opencontrail_version: 2.2
+    opencontrail_identity_port: 35357
+    opencontrail_identity_version: '2.0'
   opencontrail:
     common:
       version: ${_param:opencontrail_version}
       identity:
         engine: keystone
         host: ${_param:single_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         token: '${_param:keystone_service_token}'
         password: '${_param:keystone_admin_password}'
       network:
@@ -48,10 +50,10 @@
           port: 11211
       identity:
         engine: keystone
-        version: '2.0'
+        version: ${_param:opencontrail_identity_version}
         region: RegionOne
         host: ${_param:single_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         user: admin
         password: '${_param:keystone_admin_password}'
         token: '${_param:keystone_service_token}'
@@ -89,10 +91,10 @@
           port: 9160
       identity:
         engine: keystone
-        version: '2.0'
+        version: ${_param:opencontrail_identity_version}
         region: RegionOne
         host: ${_param:single_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         user: admin
         password: '${_param:keystone_admin_password}'
         token: '${_param:keystone_service_token}'
@@ -141,9 +143,9 @@
         port: 9160
       identity:
         engine: keystone
-        version: '2.0'
+        version: ${_param:opencontrail_identity_version}
         host: ${_param:single_address}
-        port: 35357
+        port: ${_param:opencontrail_identity_port}
         user: admin
         password: '${_param:keystone_admin_password}'
         token: '${_param:keystone_service_token}'
diff --git a/metadata/service/test/single.yml b/metadata/service/test/single.yml
index efb8d59..dcd37d9 100644
--- a/metadata/service/test/single.yml
+++ b/metadata/service/test/single.yml
@@ -1,6 +1,8 @@
 applications:
 - opencontrail
 parameters:
+  _param:
+    opencontrail_identity_port: 35357
   opencontrail:
     test:
       enabled: True
@@ -38,7 +40,7 @@
         bind:
           address: 0.0.0.0
           private_address: ${_param:keystone_service_host}
-          private_port: 35357
+          private_port: ${_param:opencontrail_identity_port}
           public_address: ${_param:keystone_service_host}
           public_port: 5000
         region: RegionOne
diff --git a/opencontrail/files/4.0/client_vnc_api_lib.ini b/opencontrail/files/4.0/client_vnc_api_lib.ini
index fac3c79..e193fdb 100644
--- a/opencontrail/files/4.0/client_vnc_api_lib.ini
+++ b/opencontrail/files/4.0/client_vnc_api_lib.ini
@@ -1,4 +1,5 @@
 {%- from "opencontrail/map.jinja" import client with context %}
+
 [global]
 ;WEB_SERVER = 127.0.0.1
 ;WEB_PORT = 9696  ; connection through quantum plugin
@@ -18,5 +19,8 @@
 AUTHN_TENANT = {{ client.identity.tenant }}
 AUTHN_USER = {{ client.identity.user }}
 AUTHN_PASSWORD = {{ client.identity.password }}
+{%- if client.identity.version == "3" %}
+AUTHN_URL = /v3/auth/tokens
+{%- else %}
 AUTHN_URL = /v2.0/tokens
 {%- endif %}