If I correctly understand the it, I have to use a default configuration file for the default domain with SQL? Then I create other domains with specific configuration files. That means one employee-domain and one trainee-domain. Is that right?

Not absolutely required, but a clean solution. You could put the trainees (for example) in the default domain, but once you start using domains, it's good practice to only keep the service users and the cloud admin in the default domain.

Here is an old (Juno version) blog entry about the same subject: https://adam.younglogic.com/2015/02/a....

Start reading at "Add a domain for the LDAP backed"

Thanks for your help. I've got two questions. First: I created the domains folder in /etc/keystone and set rights to keystone user and group. Is that right? Second: I created two domains and want to give trainees permission to a VM. I crated a role but I don't get it how to set the rights.