diff --git a/fixtures/scenario003.pp b/fixtures/scenario003.pp
index 9831c603a..77b311ab8 100644
--- a/fixtures/scenario003.pp
+++ b/fixtures/scenario003.pp
@@ -105,7 +105,9 @@ class { 'openstack_integration::tempest':
   sahara         => $sahara_integration_enable,
   horizon        => true,
   murano         => $murano_enabled,
-  heat           => true,
+  # NOTE(tkajinam): The scenario job we enable requires cinder, which is not
+  #                 enabled in this scenario.
+  heat           => false,
   # NOTE(tobias-urdin): We have tempest disabled because we cannot
   # run it when instances does not have internet acces to
   # deploy for example Docker.
diff --git a/manifests/keystone.pp b/manifests/keystone.pp
index 395ff5f70..f453122a2 100644
--- a/manifests/keystone.pp
+++ b/manifests/keystone.pp
@@ -98,15 +98,30 @@ class openstack_integration::keystone (
     public_url => $::openstack_integration::config::keystone_auth_uri,
     admin_url  => $::openstack_integration::config::keystone_admin_uri,
   }
+
   keystone_tenant { 'openstack':
-    ensure  => 'present',
+    ensure  => present,
     enabled => true,
   }
   keystone_user_role { "${::keystone::bootstrap::username}@openstack":
-    ensure => 'present',
+    ensure => present,
     roles  => [$::keystone::bootstrap::role_name],
   }
 
+  keystone_user { 'demo':
+    ensure   => present,
+    enabled  => true,
+    password => 'secrete'
+  }
+  keystone_tenant { 'demo':
+    ensure  => present,
+    enabled => true,
+  }
+  keystone_user_role { 'demo@demo':
+    ensure => 'present',
+    roles  => ['member'],
+  }
+
   class { 'openstack_extras::auth_file':
     password            => 'a_big_secret',
     project_domain_name => 'Default',
diff --git a/manifests/tempest.pp b/manifests/tempest.pp
index 59dc84632..d71bfb677 100644
--- a/manifests/tempest.pp
+++ b/manifests/tempest.pp
@@ -282,6 +282,11 @@ class openstack_integration::tempest (
     admin_project_name                 => 'openstack',
     admin_password                     => 'a_big_secret',
     admin_domain_name                  => 'Default',
+    username                           => 'demo',
+    password                           => 'secrete',
+    project_name                       => 'demo',
+    user_domain_name                   => 'Default',
+    project_domain_name                => 'Default',
     auth_version                       => 'v3',
     tempest_roles                      => ['member', 'creator'], # needed to use barbican.
     image_name                         => 'cirros',
@@ -337,9 +342,11 @@ class openstack_integration::tempest (
     ssh_key_type                       => 'ecdsa',
     l2gw_switch                        => $l2gw_switch,
     disable_dashboard_ssl_validation   => true,
+    ec2api_tester_roles                => ['member'],
+    heat_image_name                    => 'cirros',
+    heat_flavor_ref                    => '84',
     baremetal_driver                   => 'fake-hardware',
     baremetal_enabled_hardware_types   => 'ipmi,fake-hardware',
-    ec2api_tester_roles                => ['member'],
     load_balancer_member_role          => 'member',
     load_balancer_admin_role           => 'admin',
     load_balancer_observer_role        => 'member',
diff --git a/run_tests.sh b/run_tests.sh
index 044c93987..9fe202ce1 100755
--- a/run_tests.sh
+++ b/run_tests.sh
@@ -317,6 +317,9 @@ echo "test_create_bgpvpn" >> /tmp/openstack/tempest/test-include-list.txt
 # L2GW
 echo "test_create_show_list_update_delete_l2gateway" >> /tmp/openstack/tempest/test-include-list.txt
 
+# Heat
+echo "heat_tempest_plugin.tests.scenario.test_base_resources" >> /tmp/openstack/tempest/test-include-list.txt
+
 # Octavia
 # We have to enable additional tests because no smoke tests will be run with
 # noop drivers.