diff --git a/oslo_templates/files/queens/keystonemiddleware/_auth_token.conf b/oslo_templates/files/queens/keystonemiddleware/_auth_token.conf
index 755a991..57276bc 100644
--- a/oslo_templates/files/queens/keystonemiddleware/_auth_token.conf
+++ b/oslo_templates/files/queens/keystonemiddleware/_auth_token.conf
@@ -197,12 +197,18 @@
 # For backwards compatibility reasons this currently only affects the
 # allow_expired check. (list value)
 #service_token_roles = service
+{%- if _data.service_token_roles is defined %}
+service_token_roles = {{ _data.service_token_roles }}
+{%- endif %}
 
 # For backwards compatibility reasons we must let valid service tokens pass
 # that don't pass the service_token_roles check as valid. Setting this true
 # will become the default in a future release and should be enabled if
 # possible. (boolean value)
 #service_token_roles_required = false
+{%- if _data.service_token_roles_required is defined %}
+service_token_roles_required = {{ _data.service_token_roles_required }}
+{%- endif %}
 
 # Authentication type to load (string value)
 # Deprecated group/name - [keystone_authtoken]/auth_plugin