diff --git a/manifests/ldap_backend.pp b/manifests/ldap_backend.pp
index bd9a7e65c..999e1603c 100644
--- a/manifests/ldap_backend.pp
+++ b/manifests/ldap_backend.pp
@@ -312,7 +312,7 @@
 #
 # [*identity_driver*]
 #   Identity backend driver. (string value)
-#   Defaults to 'undef'
+#   Defaults to 'ldap'
 #
 # [*credential_driver*]
 #   Credential backend driver. (string value)
@@ -442,7 +442,7 @@ define keystone::ldap_backend(
   $tls_cacertdir                       = undef,
   $tls_cacertfile                      = undef,
   $tls_req_cert                        = undef,
-  $identity_driver                     = undef,
+  $identity_driver                     = 'ldap',
   $assignment_driver                   = undef,
   $credential_driver                   = undef,
   $use_pool                            = false,
@@ -570,9 +570,8 @@ define keystone::ldap_backend(
     "${domain}::ldap/use_auth_pool":                        value => $use_auth_pool;
     "${domain}::ldap/auth_pool_size":                       value => $auth_pool_size;
     "${domain}::ldap/auth_pool_connection_lifetime":        value => $auth_pool_connection_lifetime;
+    "${domain}::identity/driver":                           value => $identity_driver;
+    "${domain}::credential/driver":                         value => $credential_driver;
+    "${domain}::assignment/driver":                         value => $assignment_driver;
   }
-
-  ensure_resource('keystone_config', 'identity/driver',   {value => $identity_driver})
-  ensure_resource('keystone_config', 'credential/driver', {value => $credential_driver})
-  ensure_resource('keystone_config', 'assignment/driver', {value => $assignment_driver})
 }
diff --git a/spec/defines/keystone_ldap_backend_spec.rb b/spec/defines/keystone_ldap_backend_spec.rb
index cb209dd85..ddd0d9683 100644
--- a/spec/defines/keystone_ldap_backend_spec.rb
+++ b/spec/defines/keystone_ldap_backend_spec.rb
@@ -189,7 +189,7 @@ describe 'keystone::ldap_backend' do
         is_expected.to contain_keystone_domain_config('Default::ldap/auth_pool_connection_lifetime').with_value('200')
 
         # drivers
-        is_expected.to contain_keystone_config('identity/driver').with_value('ldap')
+        is_expected.to contain_keystone_domain_config('Default::identity/driver').with_value('ldap')
       end
     end
   end