diff --git a/manifests/cache.pp b/manifests/cache.pp
index 6e878b19..2ed8f887 100644
--- a/manifests/cache.pp
+++ b/manifests/cache.pp
@@ -108,9 +108,17 @@
 #   (oslo_cache.memcache_pool backend only)
 #   Defaults to $facts['os_service_default']
 #
-# [*manage_backend_package*]
-#   (Optional) Whether to install the backend package for the cache.
-#   Defaults to true
+# [*memcache_sasl_enabled*]
+#   (Optional) Whether SASL is enabled in memcached
+#   Defaults to $facts['os_service_default']
+#
+# [*memcache_username*]
+#   (Optional) The user name for the memcached with SASL enabled
+#   Defaults to $facts['os_service_default']
+#
+# [*memcache_password*]
+#   (Optional) The password for the memcached with SASL enabled
+#   Defaults to $facts['os_service_default']
 #
 # [*constraint_validation_caching*]
 #   (Optional) Enable caching in constraint validation. Global caching should
@@ -203,6 +211,10 @@
 #   back in the pool in the HashClient's internal mechanisms.
 #   Default to $facts['os_service_default']
 #
+# [*manage_backend_package*]
+#   (Optional) Whether to install the backend package for the cache.
+#   Defaults to true
+#
 class heat::cache (
   $config_prefix                         = $facts['os_service_default'],
   $expiration_time                       = $facts['os_service_default'],
@@ -222,7 +234,9 @@ class heat::cache (
   $memcache_pool_unused_timeout          = $facts['os_service_default'],
   $memcache_pool_connection_get_timeout  = $facts['os_service_default'],
   $memcache_pool_flush_on_reconnect      = $facts['os_service_default'],
-  $manage_backend_package                = true,
+  $memcache_sasl_enabled                 = $facts['os_service_default'],
+  $memcache_username                     = $facts['os_service_default'],
+  $memcache_password                     = $facts['os_service_default'],
   $constraint_validation_caching         = $facts['os_service_default'],
   $constraint_validation_expiration_time = $facts['os_service_default'],
   $service_extension_caching             = $facts['os_service_default'],
@@ -240,6 +254,7 @@ class heat::cache (
   $hashclient_retry_attempts             = $facts['os_service_default'],
   $hashclient_retry_delay                = $facts['os_service_default'],
   $dead_timeout                          = $facts['os_service_default'],
+  Boolean $manage_backend_package        = true,
 ) {
 
   include heat::deps
@@ -263,7 +278,9 @@ class heat::cache (
     memcache_pool_unused_timeout         => $memcache_pool_unused_timeout,
     memcache_pool_connection_get_timeout => $memcache_pool_connection_get_timeout,
     memcache_pool_flush_on_reconnect     => $memcache_pool_flush_on_reconnect,
-    manage_backend_package               => $manage_backend_package,
+    memcache_sasl_enabled                => $memcache_sasl_enabled,
+    memcache_username                    => $memcache_username,
+    memcache_password                    => $memcache_password,
     tls_enabled                          => $tls_enabled,
     tls_cafile                           => $tls_cafile,
     tls_certfile                         => $tls_certfile,
@@ -275,6 +292,7 @@ class heat::cache (
     hashclient_retry_attempts            => $hashclient_retry_attempts,
     hashclient_retry_delay               => $hashclient_retry_delay,
     dead_timeout                         => $dead_timeout,
+    manage_backend_package               => $manage_backend_package,
   }
 
   heat_config {
diff --git a/releasenotes/notes/cache-memcache-sasl-fe1b7183e96ec070.yaml b/releasenotes/notes/cache-memcache-sasl-fe1b7183e96ec070.yaml
new file mode 100644
index 00000000..12cc07f0
--- /dev/null
+++ b/releasenotes/notes/cache-memcache-sasl-fe1b7183e96ec070.yaml
@@ -0,0 +1,5 @@
+---
+features:
+  - |
+    The ``heat::cache`` class now supports options to allow memcached with
+    SASL enabled.
diff --git a/spec/classes/heat_cache_spec.rb b/spec/classes/heat_cache_spec.rb
index ff37e420..a3732cad 100644
--- a/spec/classes/heat_cache_spec.rb
+++ b/spec/classes/heat_cache_spec.rb
@@ -29,6 +29,9 @@ describe 'heat::cache' do
           :memcache_pool_unused_timeout         => '<SERVICE DEFAULT>',
           :memcache_pool_connection_get_timeout => '<SERVICE DEFAULT>',
           :memcache_pool_flush_on_reconnect     => '<SERVICE DEFAULT>',
+          :memcache_sasl_enabled                => '<SERVICE DEFAULT>',
+          :memcache_username                    => '<SERVICE DEFAULT>',
+          :memcache_password                    => '<SERVICE DEFAULT>',
           :tls_enabled                          => '<SERVICE DEFAULT>',
           :tls_cafile                           => '<SERVICE DEFAULT>',
           :tls_certfile                         => '<SERVICE DEFAULT>',
@@ -71,6 +74,9 @@ describe 'heat::cache' do
           :memcache_pool_unused_timeout          => '120',
           :memcache_pool_connection_get_timeout  => '360',
           :memcache_pool_flush_on_reconnect      => false,
+          :memcache_sasl_enabled                 => false,
+          :memcache_username                     => 'sasluser',
+          :memcache_password                     => 'saslpass',
           :tls_enabled                           => false,
           :enable_retry_client                   => false,
           :retry_attempts                        => 2,
@@ -108,6 +114,9 @@ describe 'heat::cache' do
           :memcache_pool_unused_timeout         => '120',
           :memcache_pool_connection_get_timeout => '360',
           :memcache_pool_flush_on_reconnect     => false,
+          :memcache_sasl_enabled                => false,
+          :memcache_username                    => 'sasluser',
+          :memcache_password                    => 'saslpass',
           :tls_enabled                          => false,
           :tls_cafile                           => '<SERVICE DEFAULT>',
           :tls_certfile                         => '<SERVICE DEFAULT>',