Per https://docs.openstack.org/ocata/config-reference/dashboard/config-options.html , OPENSTACK_KEYSTONE_DEFAULT_ROLE should match the member_role_name defined in keystone.conf , and it appears that _member_ is the standard/default name (https://docs.openstack.org/ocata/config-reference/identity/api.html), so that's what I use.