AFAICS, auth_host/auth_port/auth_protocol don't have any meaning anymore, only "auth_uri" is checked in heat/common/auth_password.py and heat/common/heat_keystoneclient.py. For that, it should look the same as for ec2token:

auth_uri = <%= @keystone_protocol %>://<%= @keystone_host %>:<%= @keystone_service_port %>/v2.0