diff --git a/README.rst b/README.rst
index bf5ceeb..6a247c8 100644
--- a/README.rst
+++ b/README.rst
@@ -319,6 +319,7 @@
           protocol: saml2
           remote_id_attribute: Shib-Identity-Provider
           federation_driver: keystone.contrib.federation.backends.sql.Federation
+          federated_domain_name: Federated
           trusted_dashboard:
             - http://${_param:proxy_vip_address_public}/horizon/auth/websso/
           shib_url_scheme: https
diff --git a/keystone/files/mitaka/keystone.conf.Debian b/keystone/files/mitaka/keystone.conf.Debian
index 2834cea..d639719 100644
--- a/keystone/files/mitaka/keystone.conf.Debian
+++ b/keystone/files/mitaka/keystone.conf.Debian
@@ -859,6 +859,9 @@
 # this name or update an existing domain to this name. You are not advised to
 # change this value unless you really have to. (string value)
 #federated_domain_name = Federated
+{%- if server.get('websso', {}).federated_domain_name is defined %}
+federated_domain_name = {{ server.websso.federated_domain_name }}
+{%- endif %}
 
 # A list of trusted dashboard hosts. Before accepting a Single Sign-On request
 # to return a token, the origin host must be a member of the trusted_dashboard