validation on keystone side