Domain Management

Overview

Domains provide administrative isolation between organizations, business units, or customers. Each domain has its own user namespace, and users in one domain cannot see users in another. A single domain can be configured with its own authentication backend (SQL, LDAP, or federation), making domains the fundamental multi-tenancy boundary in Polystack Identity.

Administrator Access Required — This operation requires the admin role. Contact your Polystack administrator if you do not have sufficient permissions.

Domain Concepts

Concept	Description
Default domain	Created automatically during deployment. Contains all initial admin users and projects. Cannot be deleted.
Custom domain	Administrator-created domain for a business unit, customer, or organizational boundary.
Domain admin	A user with the `admin` role scoped to the domain. Can manage users and projects within that domain only.
Domain backend	Each domain can use a different authentication driver — one domain uses SQL, another uses LDAP.

Create a Domain

Dashboard
CLI

Navigate to Domains

Configure the domain

Field	Description
Name	Unique identifier for the domain
Description	Purpose or owner of the domain
Enabled	Toggle on to allow user authentication

Confirm creation

Click Confirm.

The domain appears in Identity > Domains (admin view) with status Enabled.

Create a domain

openstack domain create \
  --description "Customer A organization" \
  customer-a

List all domains

openstack domain list

Show domain details

openstack domain show customer-a

Assign Domain Administrators

As a domain administrator, you can manage users, projects, and groups within your domain without platform-level admin access.

Dashboard
CLI

On the domain row, click the More dropdown and select Manage User. Add a user and assign the admin role to grant domain-level administration privileges.

The domain administrator can now manage users and projects within that domain.

Create a domain administrator user

openstack user create \
  --domain customer-a \
  --password-prompt \
  customer-a-admin

Grant domain admin role

openstack role add \
  --domain customer-a \
  --user customer-a-admin \
  admin

Verify the domain admin assignment

openstack role assignment list \
  --user customer-a-admin \
  --domain customer-a \
  --names

The admin role assignment is visible for the domain scope.

Disable and Delete Domains

Dashboard
CLI

Navigate to Identity > Domains (admin view), open the domain, and click Edit. Toggle Enabled off to disable the domain. Disabled domains block all authentication for every user in that domain.

Disable a domain (blocks all authentication for domain users)

openstack domain set --disable customer-a

Delete a domain

openstack domain delete customer-a

Disabling a domain immediately blocks all authentication for every user in that domain. All running instances and active sessions are unaffected until their tokens expire. Deleting a domain permanently removes all users, projects, and resources within it — this action cannot be undone.

Per-Domain Authentication Backends

Each domain can be assigned its own authentication driver. This enables a deployment where the Default domain uses SQL while a corporate domain uses LDAP:

the deployment console globals: per-domain LDAP backend

keystone_domain_config:
  corporate:
    identity:
      driver: ldap
    ldap:
      url: ldap://ldap.corp.example.com
      user_tree_dn: ou=Users,dc=corp,dc=example,dc=com
      user_id_attribute: sAMAccountName

Deploy after configuring:

Apply domain configuration

ironcore-ansible deploy --tags keystone

Next Steps

Authentication Backends

Configure LDAP and federation backends for domain authentication.

Service Catalog

Manage endpoint registration across regions for all Polystack services.

Policy Management

Customize RBAC policies for domain-scoped administrative operations.

Security Hardening

Apply security best practices for domain isolation and access controls.

Core Services

Other Services

Overview

Domain Concepts

Create a Domain

Navigate to Domains

Configure the domain

Confirm creation

Assign Domain Administrators

Disable and Delete Domains

Per-Domain Authentication Backends

Next Steps

Authentication Backends

Service Catalog

Policy Management

Security Hardening

​Overview

​Domain Concepts

​Create a Domain

Navigate to Domains

Configure the domain

Confirm creation

​Assign Domain Administrators

​Disable and Delete Domains

​Per-Domain Authentication Backends

​Next Steps

Authentication Backends

Service Catalog

Policy Management

Security Hardening

Overview

Domain Concepts

Create a Domain

Assign Domain Administrators

Disable and Delete Domains

Per-Domain Authentication Backends

Next Steps