diff --git a/manifests/keystone/domain.pp b/manifests/keystone/domain.pp
index 474dec9..4679050 100644
--- a/manifests/keystone/domain.pp
+++ b/manifests/keystone/domain.pp
@@ -126,7 +126,7 @@ class magnum::keystone::domain (
     'trust/trustee_domain_admin_domain_name':  value => $domain_admin_domain_name;
     'trust/trustee_domain_admin_domain_id':    value => $domain_admin_domain_id;
     'trust/trustee_domain_admin_password':     value => $domain_password_real, secret => true;
-    'trust/roles':                             value => $roles;
+    'trust/roles':                             value => join(any2array($roles), ',');
     'trust/trustee_keystone_interface':        value => $keystone_interface;
     'trust/trustee_keystone_region_name':      value => $keystone_region_name;
   }
diff --git a/spec/classes/magnum_keystone_domain_spec.rb b/spec/classes/magnum_keystone_domain_spec.rb
index a761f1d..7b76068 100644
--- a/spec/classes/magnum_keystone_domain_spec.rb
+++ b/spec/classes/magnum_keystone_domain_spec.rb
@@ -12,7 +12,7 @@ describe 'magnum::keystone::domain' do
     :domain_admin_domain_id   => '16264508d9b6476da952a3971ca9d4b4',
     :domain_admin_email       => 'magnum_admin@localhost',
     :domain_password          => 'domain_passwd',
-    :roles                    => 'admin,',
+    :roles                    => 'admin',
     :keystone_interface       => 'public',
     :keystone_region_name     => 'RegionOne'
     }
@@ -52,6 +52,16 @@ describe 'magnum::keystone::domain' do
       )
     end
 
+    context 'when an array is used for roles' do
+      before do
+        params.merge!(
+          :roles => ['admin', 'manager'],
+        )
+      end
+
+      it { is_expected.to contain_magnum_config('trust/roles').with_value('admin,manager') }
+    end
+
     context 'when not managing the domain creation' do
       before do
         params.merge!(