diff --git a/rally/plugins/openstack/verification/tempest/config.ini b/rally/plugins/openstack/verification/tempest/config.ini
index 061c306f..4d64e8f6 100644
--- a/rally/plugins/openstack/verification/tempest/config.ini
+++ b/rally/plugins/openstack/verification/tempest/config.ini
@@ -23,6 +23,8 @@ attach_encrypted_volume = False
 
 [identity]
 
+[identity-feature-enabled]
+
 [image-feature-enabled]
 deactivate_image = True
 
diff --git a/rally/plugins/openstack/verification/tempest/config.py b/rally/plugins/openstack/verification/tempest/config.py
index 83df12f5..19ed0e58 100644
--- a/rally/plugins/openstack/verification/tempest/config.py
+++ b/rally/plugins/openstack/verification/tempest/config.py
@@ -19,7 +19,6 @@ import os
 from oslo_config import cfg
 import six
 from six.moves import configparser
-from six.moves.urllib import parse
 
 from rally.common import logging
 from rally import exceptions
@@ -95,17 +94,19 @@ class TempestConfigfileManager(object):
                 uri_v3 = versions[3]
                 target_version = 3
             elif set(versions.keys()) == {2} or set(versions.keys()) == {3}:
-                # only one version is available while discovering, let's just
-                # guess the second auth_url (it should not be used)
+                # only one version is available while discovering
 
                 # get the most recent version
                 target_version = sorted(versions.keys())[-1]
                 if target_version == 2:
-                    uri = self.credential.auth_url
-                    uri_v3 = parse.urljoin(uri, "/v3")
+                    uri = versions[2]
+                    uri_v3 = os.path.join(cropped_auth_url, "v3")
                 else:
-                    uri_v3 = self.credential.auth_url
-                    uri = parse.urljoin(uri_v3, "/v2.0")
+                    # keystone v2 is disabled. let's do it explicitly
+                    self.conf.set("identity-feature-enabled", "api_v2",
+                                  "False")
+                    uri_v3 = versions[3]
+                    uri = os.path.join(cropped_auth_url, "v2.0")
             else:
                 # Does Keystone released new version of API ?!
                 LOG.debug("Discovered keystone versions: %s", versions)
diff --git a/tests/ci/rally_verify.py b/tests/ci/rally_verify.py
index 6ebff976..49f13b0e 100755
--- a/tests/ci/rally_verify.py
+++ b/tests/ci/rally_verify.py
@@ -325,7 +325,7 @@ class RunVerification(Step):
 
     def run(self):
         super(RunVerification, self).run()
-        if False and "Success: 0" in self.result["output"]:
+        if "Success: 0" in self.result["output"]:
             self.result["status"] = Status.FAILURE
 
 
diff --git a/tests/unit/plugins/openstack/verification/tempest/test_config.py b/tests/unit/plugins/openstack/verification/tempest/test_config.py
index 24b7924b..b478ae5e 100644
--- a/tests/unit/plugins/openstack/verification/tempest/test_config.py
+++ b/tests/unit/plugins/openstack/verification/tempest/test_config.py
@@ -105,18 +105,20 @@ class TempestConfigfileManagerTestCase(test.TestCase):
         # case #5: only one version is discoverable;
         {"auth_url": "http://example.com",
          "data": [{"version": (2, 0), "url": "foo2.com"}],
-         "ex_uri": "http://example.com", "ex_auth_version": "v2",
+         "ex_uri": "foo2.com", "ex_auth_version": "v2",
          "ex_uri_v3": "http://example.com/v3"},
         # case #6: the same case, but keystone v3 is discoverable
         {"auth_url": "http://example.com",
          "data": [{"version": (3, 0), "url": "foo3.com"}],
          "ex_uri": "http://example.com/v2.0", "ex_auth_version": "v3",
-         "ex_uri_v3": "http://example.com"}
+         "ex_uri_v3": "foo3.com",
+         "ex_v2_off": True}
     )
     @ddt.unpack
     def test__configure_identity(self, auth_url, data, ex_uri,
-                                 ex_uri_v3, ex_auth_version):
+                                 ex_uri_v3, ex_auth_version, ex_v2_off=False):
         self.tempest.conf.add_section("identity")
+        self.tempest.conf.add_section("identity-feature-enabled")
         self.tempest.credential.auth_url = auth_url
         process_url = osclients.Keystone(
             self.tempest.credential, 0, 0)._remove_url_version
@@ -141,6 +143,10 @@ class TempestConfigfileManagerTestCase(test.TestCase):
                         CRED["https_insecure"]),
                     "ca_certificates_file": CRED["https_cacert"]}
         self.assertEqual(expected, dict(self.tempest.conf.items("identity")))
+        if ex_v2_off:
+            self.assertEqual(
+                "False",
+                self.tempest.conf.get("identity-feature-enabled", "api_v2"))
 
     def test__configure_network_if_neutron(self):
         self.tempest.available_services = ["neutron"]