diff --git a/defaults/main.yml b/defaults/main.yml
index 40021045..a7143b60 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -138,7 +138,8 @@ cinder_service_v3_internaluri: "{{ cinder_service_internaluri_proto }}://{{ inte
 cinder_service_v3_internalurl: "{{ cinder_service_internaluri }}/v3/%(tenant_id)s"
 
 ## Keystone authentication middleware
-cinder_keystone_auth_plugin: password
+cinder_keystone_auth_plugin: "{{ cinder_keystone_auth_type }}"
+cinder_keystone_auth_type: password
 
 ## In order to enable the cinder backup you MUST set ``cinder_service_backup_program_enabled`` to "true"
 cinder_service_backup_program_enabled: false
diff --git a/releasenotes/notes/deprecate_auth_plugin-1a78326719d67f23.yaml b/releasenotes/notes/deprecate_auth_plugin-1a78326719d67f23.yaml
new file mode 100644
index 00000000..4e70fe1f
--- /dev/null
+++ b/releasenotes/notes/deprecate_auth_plugin-1a78326719d67f23.yaml
@@ -0,0 +1,5 @@
+---
+deprecations:
+  - The ``cinder_keystone_auth_plugin`` variable has been deprecated.
+    ``cinder_keystone_auth_type`` should be used instead to configure
+    authentication type.
diff --git a/templates/cinder.conf.j2 b/templates/cinder.conf.j2
index edc9abd7..b2169358 100644
--- a/templates/cinder.conf.j2
+++ b/templates/cinder.conf.j2
@@ -134,7 +134,7 @@ api_class = castellan.key_manager.barbican_key_manager.BarbicanKeyManager
 
 [keystone_authtoken]
 insecure = {{ keystone_service_internaluri_insecure | bool }}
-auth_plugin = {{ cinder_keystone_auth_plugin }}
+auth_type = {{ cinder_keystone_auth_plugin }}
 auth_url = {{ keystone_service_adminurl }}
 auth_uri = {{ keystone_service_internaluri }}
 project_domain_id = {{ cinder_service_project_domain_id }}