diff --git a/doc/config-reference/identity/section_keystone-sample-conf-files.xml b/doc/config-reference/identity/section_keystone-sample-conf-files.xml
index 71b40a5656..4ecb6c4761 100644
--- a/doc/config-reference/identity/section_keystone-sample-conf-files.xml
+++ b/doc/config-reference/identity/section_keystone-sample-conf-files.xml
@@ -44,26 +44,51 @@
     <section xml:id="section_keystone-domain-configs">
         <title>Domain-specific configuration</title>
         <para>Identity enables you to configure domain-specific
-            authentication drivers. For example, you can configure a
-            domain to have its own LDAP or SQL server.</para>
-        <para>By default, the option to configure domain-specific
-            drivers is disabled.</para>
-        <para>To enable domain-specific drivers, set these options in
-                <literal>[identity]</literal> section in the
-                <filename>keystone.conf</filename> file:</para>
+            authentication drivers which allows a domain to have its
+            own LDAP or SQL server.</para>
+        <section xml:id="section_keystone-domain-configs-enable">
+            <title>Enable domain-specific drivers</title>
+          <para>By default, the option to configure domain-specific
+            drivers is disabled. To enable domain-specific drivers,
+            set these options in the <filename>keystone.conf</filename>
+            file:</para>
         <programlisting language="ini">[identity]
 domain_specific_drivers_enabled = True
 domain_config_dir = /etc/keystone/domains</programlisting>
         <para>When you enable domain-specific drivers, Identity looks
             in the <option>domain_config_dir</option> directory for
-            configuration files that are named as follows:
-                    <filename>keystone.<replaceable>DOMAIN_NAME</replaceable>.conf</filename>,
-            where <replaceable>DOMAIN_NAME</replaceable> is the domain
-            name.</para>
-        <para>Any options that you define in the domain-specific
+            configuration files that are named as
+            <filename>keystone.<replaceable>DOMAIN_NAME</replaceable>.conf</filename>.
+            Any domain without a domain-specific configuration
+            file uses options in the primary configuration file.</para>
+         </section>
+         <section xml:id="section_keystone-domain-config-options">
+            <title>Domain-specific configuration file options</title>
+          <para>Any options that you define in the domain-specific
             configuration file override options in the primary
-            configuration file for the specified domain. Any domain
-            without a domain-specific configuration file uses only the
-            options in the primary configuration file.</para>
+            configuration file for the specified domain.</para>
+          <para>Domains configured for the service user or project
+            use the Identity API v3 to retrieve the service token.</para>
+          <para>To configure the domain for the service user, set the
+            following options in the [DEFAULT] section of the
+            <filename>/etc/keystone/domains/keystone.<replaceable>DOMAIN_NAME</replaceable>.conf</filename>
+            file:</para>
+          <programlisting>admin_user_domain_id = <replaceable>USER_DOMAIN_ID</replaceable>
+admin_user_domain_name = <replaceable>USER_DOMAIN_NAME</replaceable></programlisting>
+          <para>Replace <replaceable>USER_DOMAIN_ID</replaceable> with
+            the Identity service account user domain ID, and
+            <replaceable>USER_DOMAIN_NAME</replaceable> with the Identity
+            service account user domain name.</para>
+          <para>To configure the domain for the project, set the
+            following options in the [DEFAULT] section of the
+            <filename>/etc/keystone/domains/keystone.<replaceable>DOMAIN_NAME</replaceable>.conf</filename>
+            file:</para>
+          <programlisting>admin_project_domain_id = <replaceable>PROJECT_DOMAIN_ID</replaceable>
+admin_project_domain_name = <replaceable>PROJECT_DOMAIN_NAME</replaceable></programlisting>
+          <para>Replace <replaceable>PROJECT_DOMAIN_ID</replaceable> with
+            the Identity service account project domain ID, and
+            <replaceable>PROJECT_DOMAIN_NAME</replaceable> with the
+            Identity service account project domain name.</para>
+        </section>
     </section>
 </section>