diff --git a/defaults/main.yml b/defaults/main.yml
index c95c390..db3a378 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -130,7 +130,12 @@ heat_profiler_trace_sqlalchemy: false
 heat_service_region: "{{ service_region | default('RegionOne') }}"
 heat_service_project_name: "service"
 heat_service_user_name: "heat"
-heat_service_role_name: admin
+heat_service_role_names:
+  - admin
+  - service
+heat_service_token_roles:
+  - service
+heat_service_token_roles_required: "{{ openstack_service_token_roles_required | default(True) }}"
 heat_service_project_domain_id: default
 heat_service_user_domain_id: default
 heat_keystone_auth_plugin: password
diff --git a/tasks/heat_service_setup.yml b/tasks/heat_service_setup.yml
index e7e244e..9b32504 100644
--- a/tasks/heat_service_setup.yml
+++ b/tasks/heat_service_setup.yml
@@ -41,7 +41,7 @@
         password: "{{ heat_service_password }}"
         domain: default
         project: "{{ heat_service_project_name }}"
-        role: "{{ heat_service_role_name }}"
+        role: "{{ heat_service_role_names }}"
         # We add the keystone role used by heat to delegate to the heat service user
         # for performing deferred operations via trusts.
       - name: "{{ heat_service_user_name }}"
diff --git a/templates/heat.conf.j2 b/templates/heat.conf.j2
index 4e1e00c..da0caa0 100644
--- a/templates/heat.conf.j2
+++ b/templates/heat.conf.j2
@@ -94,6 +94,10 @@ username = {{ heat_service_user_name }}
 password = {{ heat_service_password }}
 region_name = {{ keystone_service_region }}
 
+service_token_roles_required = {{ heat_service_token_roles_required | bool }}
+service_token_roles = {{ heat_service_token_roles | join(',') }}
+service_type = {{ heat_service_type }}
+
 memcached_servers = {{ heat_memcached_servers }}
 
 token_cache_time = 300