diff --git a/docker/common/heat/heat-base/config-heat.sh b/docker/common/heat/heat-base/config-heat.sh
index 9275e5645a..843221ccdd 100755
--- a/docker/common/heat/heat-base/config-heat.sh
+++ b/docker/common/heat/heat-base/config-heat.sh
@@ -17,14 +17,17 @@ set -e
 check_required_vars HEAT_DB_PASSWORD HEAT_KEYSTONE_PASSWORD \
                     HEAT_API_CFN_URL_HOST HEAT_API_CFN_SERVICE_PORT \
                     KEYSTONE_PUBLIC_SERVICE_HOST KEYSTONE_PUBLIC_SERVICE_PORT \
-                    RABBITMQ_SERVICE_HOST MARIADB_SERVICE_HOST \
-                    HEAT_DOMAIN_PASS
+                    KEYSTONE_PUBLIC_SERVICE_PORT RABBITMQ_SERVICE_HOST \
+                    MARIADB_SERVICE_HOST HEAT_DOMAIN_PASS
 
 fail_unless_db
 dump_vars
 
+# this should use the keystone admin port
+# https://bugs.launchpad.net/kolla/+bug/1469209
 cat > /openrc <<EOF
-export OS_AUTH_URL="http://${KEYSTONE_PUBLIC_SERVICE_HOST}:5000/v2.0"
+export OS_AUTH_URL="http://${KEYSTONE_PUBLIC_SERVICE_HOST}:\
+${KEYSTONE_PUBLIC_SERVICE_PORT}/v2.0"
 export OS_USERNAME="${HEAT_KEYSTONE_USER}"
 export OS_PASSWORD="${HEAT_KEYSTONE_PASSWORD}"
 export OS_TENANT_NAME="${ADMIN_TENANT_NAME}"
diff --git a/docker/common/heat/heat-engine/start.sh b/docker/common/heat/heat-engine/start.sh
index 16453a3bed..0cafbc480c 100755
--- a/docker/common/heat/heat-engine/start.sh
+++ b/docker/common/heat/heat-engine/start.sh
@@ -2,6 +2,7 @@
 
 . /opt/kolla/kolla-common.sh
 . /opt/kolla/config-heat.sh
+. /openrc
 
 check_required_vars HEAT_DB_NAME HEAT_DB_USER HEAT_DB_PASSWORD \
                     INIT_HEAT_DB HEAT_DOMAIN_PASS
diff --git a/docs/integration-guide.md b/docs/integration-guide.md
index c2bfe3c612..47ce2ad545 100755
--- a/docs/integration-guide.md
+++ b/docs/integration-guide.md
@@ -70,11 +70,12 @@ all containers.  This allows a simple method of ensuring every type of node
     GLANCE_REGISTRY_SERVICE_HOST=<glance IP> Glance registry service host
     KEYSTONE_ADMIN_PASSWORD=<password>
     KEYSTONE_ADMIN_SERVICE_HOST=<IP> - IP Address of Keystone Host
-    KEYSTONE_ADMIN_SERVICE_PORT=<5000> - Port where Keystone operates
+    KEYSTONE_ADMIN_SERVICE_PORT=<35357> - Port where Keystone admin endpoint operates.
     KEYSTONE_ADMIN_TOKEN=<keystone-secret> - A token used to access Keystone
     KEYSTONE_AUTH_PROTOCOL=<http> - The keystone authentication protocol
     KEYSTONE_DB_PASSWORD=<password> - The password used to access Keystone in the DB
     KEYSTONE_PUBLIC_SERVICE_HOST=<IP> - The IP address where Keystone is running
+    KEYSTONE_PUBLIC_SERVICE_PORT=<5000> - Port which keystone uses for public service.
     MARIADB_ROOT_PASSWORD=<mariadb root password> - defines the MariaDB root password
     MARIADB_SERVICE_HOST=<IP> - The IP Address where Mariadb is running
     MARIADB_MAX_CONNECTIONS=<151> - The maximum number of connections to the MariaDB server
diff --git a/tools/genenv b/tools/genenv
index 535d7356cc..e4cf50195b 100755
--- a/tools/genenv
+++ b/tools/genenv
@@ -102,7 +102,9 @@ KEYSTONE_ADMIN_TOKEN=$PASSWORD
 KEYSTONE_DB_PASSWORD=kolla
 KEYSTONE_ADMIN_PASSWORD=$PASSWORD
 KEYSTONE_PUBLIC_SERVICE_HOST=$HOST_IP
+KEYSTONE_PUBLIC_SERVICE_PORT=5000
 KEYSTONE_ADMIN_SERVICE_HOST=$HOST_IP
+KEYSTONE_ADMIN_SERVICE_PORT=35357
 KEYSTONE_AUTH_PROTOCOL=http
 
 # Glance
@@ -229,8 +231,10 @@ CINDER_ENABLED_BACKEND=lvm57
 # Here we define pairs hostname:priority. Priorities have to be unique
 KEEPALIVED_HOST_PRIORITIES=host1:100,host2:99
 
+# this should use the keystone admin port
+# https://bugs.launchpad.net/kolla/+bug/1469209
 cat > ./openrc <<EOF
-export OS_AUTH_URL="http://${KEYSTONE_PUBLIC_SERVICE_HOST}:5000/v2.0"
+export OS_AUTH_URL="http://${KEYSTONE_PUBLIC_SERVICE_HOST}:${KEYSTONE_PUBLIC_SERVICE_PORT}/v2.0"
 export OS_USERNAME=$ADMIN_TENANT_NAME
 export OS_PASSWORD=$ADMIN_USER_PASSWORD
 export OS_TENANT_NAME=$ADMIN_TENANT_NAME
@@ -270,11 +274,12 @@ GLANCE_KEYSTONE_USER=$GLANCE_KEYSTONE_USER
 GLANCE_REGISTRY_SERVICE_HOST=$GLANCE_REGISTRY_SERVICE_HOST
 KEYSTONE_ADMIN_PASSWORD=$KEYSTONE_ADMIN_PASSWORD
 KEYSTONE_ADMIN_SERVICE_HOST=$KEYSTONE_ADMIN_SERVICE_HOST
-KEYSTONE_ADMIN_SERVICE_PORT=35357
+KEYSTONE_ADMIN_SERVICE_PORT=$KEYSTONE_ADMIN_SERVICE_PORT
 KEYSTONE_ADMIN_TOKEN=$KEYSTONE_ADMIN_TOKEN
 KEYSTONE_AUTH_PROTOCOL=$KEYSTONE_AUTH_PROTOCOL
 KEYSTONE_DB_PASSWORD=$KEYSTONE_DB_PASSWORD
 KEYSTONE_PUBLIC_SERVICE_HOST=$KEYSTONE_PUBLIC_SERVICE_HOST
+KEYSTONE_PUBLIC_SERVICE_PORT=$KEYSTONE_PUBLIC_SERVICE_PORT
 MARIADB_SERVICE_HOST=$HOST_IP
 MARIADB_ROOT_PASSWORD=$MARIADB_ROOT_PASSWORD
 MARIADB_MAX_CONNECTIONS=$MARIADB_MAX_CONNECTIONS