diff --git a/doc/config-reference/ch_identityconfigure.xml b/doc/config-reference/ch_identityconfigure.xml
index 3112f9af43..7812fd4798 100644
--- a/doc/config-reference/ch_identityconfigure.xml
+++ b/doc/config-reference/ch_identityconfigure.xml
@@ -90,7 +90,84 @@ options. For installation prerequisites and step-by-step walkthroughs, see the
-
+
+ Domain-specific configuration
+ The Identity service supports domain-specific
+ Identity drivers which allow a domain to have its
+ own LDAP or SQL back end. By default, domain-specific
+ drivers are disabled.
+ Domain-specific Identity configuration options can be stored in
+ domain-specific configuration files, or in the Identity SQL database
+ using API REST calls.
+
+ Storing and managing configuration options in
+ a SQL database is experimental in Kilo.
+
+
+ Enable drivers for domain-specific configuration files
+ To enable domain-specific drivers,
+ set these options in the /etc/keystone/keystone.conf
+ file:
+ [identity]
+domain_specific_drivers_enabled = True
+domain_config_dir = /etc/keystone/domains
+ When you enable domain-specific drivers, Identity looks
+ in the directory for
+ configuration files that are named as
+ keystone.DOMAIN_NAME.conf.
+ Any domain without a domain-specific configuration
+ file uses options in the primary configuration file.
+
+
+ Domain-specific configuration file
+ Any options that you define in the domain-specific
+ configuration file override options in the /etc/keystone/keystone.conf
+ configuration file.
+ Domains configured for the service user or project
+ use the Identity API v3 to retrieve the service token.
+ To configure the domain for the service user, set the
+ following options in the [DEFAULT] section of the
+ /etc/keystone/domains/keystone.DOMAIN_NAME.conf
+ file:
+ admin_user_domain_id = USER_DOMAIN_ID
+admin_user_domain_name = USER_DOMAIN_NAME
+ Replace USER_DOMAIN_ID with
+ the Identity service account user domain ID, and
+ USER_DOMAIN_NAME with the Identity
+ service account user domain name.
+ To configure the domain for the project, set the
+ following options in the [DEFAULT] section of the
+ /etc/keystone/domains/keystone.DOMAIN_NAME.conf
+ file:
+ admin_project_domain_id = PROJECT_DOMAIN_ID
+admin_project_domain_name = PROJECT_DOMAIN_NAME
+ Replace PROJECT_DOMAIN_ID with
+ the Identity service account project domain ID, and
+ PROJECT_DOMAIN_NAME with the
+ Identity service account project domain name.
+
+
+ Enable drivers for storing configuration options in SQL database
+ To enable domain-specific drivers, set these options in
+ the /etc/keystone/keystone.conf file:
+ [identity]
+domain_specific_drivers_enabled = True
+domain_configurations_from_database = True
+ Any domain-specific configuration options specified through
+ the Identity v3 API will override domain-specific configuration files
+ in the /etc/keystone/domains directory.
+
+
+ Migrate domain-specific configuration files to the SQL database
+ You can use the keystone-manage command
+ to migrate configuration options in domain-specific configuration
+ files to the SQL database:
+ $ keystone-manage domain_config_upload --all
+ To upload options from a specific domain-configuration
+ file, specify the domain name:
+ $ keystone-manage domain_config_upload --domain-name DOMAIN_NAME
+
+
diff --git a/doc/config-reference/identity/section_keystone-sample-conf-files.xml b/doc/config-reference/identity/section_keystone-sample-conf-files.xml
index 4ecb6c4761..b481315b4e 100644
--- a/doc/config-reference/identity/section_keystone-sample-conf-files.xml
+++ b/doc/config-reference/identity/section_keystone-sample-conf-files.xml
@@ -41,54 +41,4 @@
service.
-
- Domain-specific configuration
- Identity enables you to configure domain-specific
- authentication drivers which allows a domain to have its
- own LDAP or SQL server.
-
- Enable domain-specific drivers
- By default, the option to configure domain-specific
- drivers is disabled. To enable domain-specific drivers,
- set these options in the keystone.conf
- file:
- [identity]
-domain_specific_drivers_enabled = True
-domain_config_dir = /etc/keystone/domains
- When you enable domain-specific drivers, Identity looks
- in the directory for
- configuration files that are named as
- keystone.DOMAIN_NAME.conf.
- Any domain without a domain-specific configuration
- file uses options in the primary configuration file.
-
-
- Domain-specific configuration file options
- Any options that you define in the domain-specific
- configuration file override options in the primary
- configuration file for the specified domain.
- Domains configured for the service user or project
- use the Identity API v3 to retrieve the service token.
- To configure the domain for the service user, set the
- following options in the [DEFAULT] section of the
- /etc/keystone/domains/keystone.DOMAIN_NAME.conf
- file:
- admin_user_domain_id = USER_DOMAIN_ID
-admin_user_domain_name = USER_DOMAIN_NAME
- Replace USER_DOMAIN_ID with
- the Identity service account user domain ID, and
- USER_DOMAIN_NAME with the Identity
- service account user domain name.
- To configure the domain for the project, set the
- following options in the [DEFAULT] section of the
- /etc/keystone/domains/keystone.DOMAIN_NAME.conf
- file:
- admin_project_domain_id = PROJECT_DOMAIN_ID
-admin_project_domain_name = PROJECT_DOMAIN_NAME
- Replace PROJECT_DOMAIN_ID with
- the Identity service account project domain ID, and
- PROJECT_DOMAIN_NAME with the
- Identity service account project domain name.
-
-