diff --git a/defaults/main.yml b/defaults/main.yml
index 47023f0..e8aa4dc 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -127,7 +127,8 @@ trove_rabbitmq_port: 5672
 trove_rabbitmq_servers: "{{ rabbitmq_servers }}"
 
 # Keystone AuthToken/Middleware
-trove_keystone_auth_plugin: password
+trove_keystone_auth_plugin: "{{ trove_keystone_auth_type }}"
+trove_keystone_auth_type: password
 trove_service_project_domain_name: Default
 trove_service_user_domain_name: default
 trove_service_project_domain_id: default
diff --git a/releasenotes/notes/deprecate_auth_plugin-451832a71b967e27.yaml b/releasenotes/notes/deprecate_auth_plugin-451832a71b967e27.yaml
new file mode 100644
index 0000000..025ae78
--- /dev/null
+++ b/releasenotes/notes/deprecate_auth_plugin-451832a71b967e27.yaml
@@ -0,0 +1,5 @@
+---
+deprecations:
+  - The ``trove_keystone_auth_plugin`` variable has been deprecated.
+    ``trove_keystone_auth_type`` should be used instead to configure
+    authentication type.
diff --git a/templates/trove.conf.j2 b/templates/trove.conf.j2
index 334543b..f4bc351 100644
--- a/templates/trove.conf.j2
+++ b/templates/trove.conf.j2
@@ -76,7 +76,7 @@ api_paste_config = api-paste.ini
 
 [keystone_authtoken]
 insecure = {{ keystone_service_internaluri_insecure | bool }}
-auth_plugin = {{ trove_keystone_auth_plugin }}
+auth_type = {{ trove_keystone_auth_plugin }}
 auth_url = {{ keystone_service_adminuri }}
 auth_uri = {{ keystone_service_internaluri }}
 project_domain_id = {{ trove_service_project_domain_id }}