diff --git a/etc/tempest.conf.sample b/etc/tempest.conf.sample
index 234273b..88a56be 100644
--- a/etc/tempest.conf.sample
+++ b/etc/tempest.conf.sample
@@ -135,6 +135,9 @@
 # concurrent test processes. (boolean value)
 #locking_credentials_provider = false
 
+# Roles to assign to all users created by tempest (list value)
+#tempest_roles =
+
 
 [baremetal]
 
@@ -582,9 +585,6 @@
 # applies to user and project (string value)
 #admin_domain_name = <None>
 
-# Roles to assign to all users created by tempest (list value)
-#tempest_roles =
-
 
 [identity-feature-enabled]
 
diff --git a/tempest/common/isolated_creds.py b/tempest/common/isolated_creds.py
index e7590b7..a663931 100644
--- a/tempest/common/isolated_creds.py
+++ b/tempest/common/isolated_creds.py
@@ -124,7 +124,7 @@
             self._assign_user_role(tenant, user, swift_operator_role)
         if admin:
             self._assign_user_role(tenant, user, CONF.identity.admin_role)
-        for role in CONF.identity.tempest_roles:
+        for role in CONF.auth.tempest_roles:
             self._assign_user_role(tenant, user, role)
         return self._get_credentials(user, tenant)
 
diff --git a/tempest/config.py b/tempest/config.py
index 4858fda..d42a805 100644
--- a/tempest/config.py
+++ b/tempest/config.py
@@ -59,6 +59,9 @@
                      "It requires at least `2 * CONC` distinct accounts "
                      "configured in `test_accounts_file`, with CONC == the "
                      "number of concurrent test processes."),
+    cfg.ListOpt('tempest_roles',
+                help="Roles to assign to all users created by tempest",
+                default=[])
 ]
 
 identity_group = cfg.OptGroup(name='identity',
@@ -131,9 +134,6 @@
     cfg.StrOpt('admin_domain_name',
                help="Admin domain name for authentication (Keystone V3)."
                     "The same domain applies to user and project"),
-    cfg.ListOpt('tempest_roles',
-                help="Roles to assign to all users created by tempest",
-                default=[])
 ]
 
 identity_feature_group = cfg.OptGroup(name='identity-feature-enabled',