diff --git a/attributes/default.rb b/attributes/default.rb
index 18909b8..4275f4d 100644
--- a/attributes/default.rb
+++ b/attributes/default.rb
@@ -147,6 +147,9 @@ default['openstack']['orchestration']['stack_user_domain_name'] = nil
 # users and projects in the stack_user_domain. (string value)
 default['openstack']['orchestration']['stack_domain_admin'] = nil
 
+# Select deferred auth method, stored password or trusts.
+default['openstack']['orchestration']['deferred_auth_method'] = 'trusts'
+
 # If set, heat API service will bind to the address on this interface,
 # otherwise it will bind to the API endpoint's host.
 default['openstack']['orchestration']['api']['bind_interface'] = nil
diff --git a/spec/spec_helper.rb b/spec/spec_helper.rb
index c23b5de..cc027ac 100644
--- a/spec/spec_helper.rb
+++ b/spec/spec_helper.rb
@@ -331,6 +331,7 @@ shared_examples 'expects to create heat conf' do
           /^admin_user=heat$/,
           /^admin_password=heat-pass$/,
           /^admin_tenant_name=service$/,
+          /^deferred_auth_method=trusts$/,
           %r{^signing_dir=/var/cache/heat$},
           /^region_name_for_services=RegionOne$/
         ].each do |line|
diff --git a/templates/default/heat.conf.erb b/templates/default/heat.conf.erb
index c074243..34793f5 100644
--- a/templates/default/heat.conf.erb
+++ b/templates/default/heat.conf.erb
@@ -35,7 +35,9 @@
 
 # Select deferred auth method, stored password or trusts.
 # (string value)
-#deferred_auth_method=password
+<% if node['openstack']['orchestration']['deferred_auth_method'] -%>
+deferred_auth_method=<%= node['openstack']['orchestration']['deferred_auth_method'] %>
+<% end -%>
 
 # Subset of trustor roles to be delegated to heat. (list
 # value)