Manage domains

You can manage Identity service (keystone) domains to create isolated administrative boundaries for users and projects. Domains let you partition tenants across different organizations without interference.

Note
The Identity service includes a built-in domain called Default. It is suggested you reserve this domain only for service accounts, and create a separate domain for user accounts.

List available domains
Copy link

View the list of available domains to verify that the correct administrative boundaries exist for your users and projects. Auditing domains helps you confirm proper tenant isolation across your environment.

Procedure
Copy link

View a list of the domains: 
$ openstack domain list

For example:

+----------------------------------+------------------+---------+--------------------+
| ID                               | Name             | Enabled | Description        |
+----------------------------------+------------------+---------+--------------------+
| 3abefa6f32c14db9a9703bf5ce6863e1 | TestDomain       | True    |                    |
| 69436408fdcb44ab9e111691f8e9216d | corp             | True    |                    |
| a4f61a8feb8d4253b260054c6aa41adb | federated_domain | True    |                    |
| default                          | Default          | True    | The default domain |
+----------------------------------+------------------+---------+--------------------+

Create a new domain
Copy link

Create a new domain to define a separate administrative boundary for a specific organization. Isolating users and projects into their own domain prevents interference with the default domain and other tenants.

Procedure
Copy link

Create a new domain: 
$ openstack domain create TestDomain

For example:

+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description |                                  |
| enabled     | True                             |
| id          | 3abefa6f32c14db9a9703bf5ce6863e1 |
| name        | TestDomain                       |
+-------------+----------------------------------+

Inspect domain configuration details
Copy link

View the details of a specific domain to verify its configuration. Checking attributes such as the domain name, ID, and enabled status helps you confirm that the administrative boundary is correctly configured.

Procedure
Copy link

View the details of a domain: 
$ openstack domain show TestDomain

For example:

+-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description |                                  |
| enabled     | True                             |
| id          | 3abefa6f32c14db9a9703bf5ce6863e1 |
| name        | TestDomain                       |
+-------------+----------------------------------+

Disable a domain
Copy link

Disable a domain to immediately prevent users from authenticating and accessing APIs. Suspending a domain secures the environment during security audits, organizational changes, or when you decommission a tenant.

About this task
Copy link

Note
You can disable and enable domains according to your requirements.

Procedure
Copy link

  1. Disable a domain using the --disable option: 
    $ openstack domain set TestDomain --disable
  2. Confirm that the domain has been disabled: 
    $ openstack domain show TestDomain

    For example:

    +-------------+----------------------------------+
| Field       | Value                            |
+-------------+----------------------------------+
| description |                                  |
| enabled     | False                            |
| id          | 3abefa6f32c14db9a9703bf5ce6863e1 |
| name        | TestDomain                       |
+-------------+----------------------------------+
  3. Use the --enable option to re-enable the domain, if required: 
    $ openstack domain set TestDomain --enable