Identity Service (keystone) domains are additional namespaces you can create in keystone. You would use keystone domains to partition users, groups, and projects. These separate domains can also be configured to authenticate users in different LDAP or Active Directory environments. For more information see Integrate with Identity Service .
Identity Service includes a built-in domain called Default. It is suggested you reserve this domain only for service accounts, and create a separate domain for user accounts.
You can view a list of domains using openstack domain list. For example:
openstack domain list
+----------------------------------+------------------+---------+--------------------+
| ID | Name | Enabled | Description |
+----------------------------------+------------------+---------+--------------------+
| 3abefa6f32c14db9a9703bf5ce6863e1 | TestDomain | True | |
| 69436408fdcb44ab9e111691f8e9216d | corp | True | |
| a4f61a8feb8d4253b260054c6aa41adb | federated_domain | True | |
| default | Default | True | The default domain |
+----------------------------------+------------------+---------+--------------------+
$ openstack domain list
+----------------------------------+------------------+---------+--------------------+
| ID | Name | Enabled | Description |
+----------------------------------+------------------+---------+--------------------+
| 3abefa6f32c14db9a9703bf5ce6863e1 | TestDomain | True | |
| 69436408fdcb44ab9e111691f8e9216d | corp | True | |
| a4f61a8feb8d4253b260054c6aa41adb | federated_domain | True | |
| default | Default | True | The default domain |
+----------------------------------+------------------+---------+--------------------+
Copy to Clipboard
Copied!
Toggle word wrap
Toggle overflow
If this command is not available, check you have enabled keystone v3 for your command line session.
You can create a new domain using openstack domain create. For example:
openstack domain create TestDomain
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | |
| enabled | True |
| id | 3abefa6f32c14db9a9703bf5ce6863e1 |
| name | TestDomain |
+-------------+----------------------------------+
$ openstack domain create TestDomain
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | |
| enabled | True |
| id | 3abefa6f32c14db9a9703bf5ce6863e1 |
| name | TestDomain |
+-------------+----------------------------------+
Copy to Clipboard
Copied!
Toggle word wrap
Toggle overflow
You can view the details of a domain using openstack domain show. For example:
openstack domain show TestDomain
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | |
| enabled | True |
| id | 3abefa6f32c14db9a9703bf5ce6863e1 |
| name | TestDomain |
+-------------+----------------------------------+
$ openstack domain show TestDomain
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | |
| enabled | True |
| id | 3abefa6f32c14db9a9703bf5ce6863e1 |
| name | TestDomain |
+-------------+----------------------------------+
Copy to Clipboard
Copied!
Toggle word wrap
Toggle overflow
You can disable a domain using --disable. For example:
openstack domain set TestDomain --disable
$ openstack domain set TestDomain --disable
Copy to Clipboard
Copied!
Toggle word wrap
Toggle overflow
Confirm the domain has been disabled:
openstack domain show TestDomain
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | |
| enabled | False |
| id | 3abefa6f32c14db9a9703bf5ce6863e1 |
| name | TestDomain |
+-------------+----------------------------------+
$ openstack domain show TestDomain
+-------------+----------------------------------+
| Field | Value |
+-------------+----------------------------------+
| description | |
| enabled | False |
| id | 3abefa6f32c14db9a9703bf5ce6863e1 |
| name | TestDomain |
+-------------+----------------------------------+
Copy to Clipboard
Copied!
Toggle word wrap
Toggle overflow
You can then re-enable the domain, if required:
openstack domain set TestDomain --enable
$ openstack domain set TestDomain --enable
Copy to Clipboard
Copied!
Toggle word wrap
Toggle overflow