diff --git a/installers/charm/keystone/config.yaml b/installers/charm/keystone/config.yaml
index 2a54a3d..2758d1c 100644
--- a/installers/charm/keystone/config.yaml
+++ b/installers/charm/keystone/config.yaml
@@ -191,7 +191,7 @@
       enablement. However, some schemas might use an integer value in an
       attribute. In this situation, set user_enabled_default to the integer
       value that represents a user being enabled.
-    default: true
+    default: "true"
   ldap_user_enabled_invert:
     type: boolean
     description: |
diff --git a/installers/charm/keystone/src/charm.py b/installers/charm/keystone/src/charm.py
index a8c69fe..5d8d317 100755
--- a/installers/charm/keystone/src/charm.py
+++ b/installers/charm/keystone/src/charm.py
@@ -118,7 +118,7 @@
     ldap_user_filter: Optional[str]
     ldap_user_enabled_attribute: Optional[str]
     ldap_user_enabled_mask: Optional[int]
-    ldap_user_enabled_default: Optional[bool]
+    ldap_user_enabled_default: Optional[str]
     ldap_user_enabled_invert: Optional[bool]
     ldap_group_objectclass: Optional[str]
     ldap_group_tree_dn: Optional[str]
@@ -126,6 +126,13 @@
     ldap_tls_cacert_base64: Optional[str]
     ldap_tls_req_cert: Optional[str]
 
+    @validator
+    def validate_ldap_user_enabled_default(cls, v):
+        if v:
+            if v not in ["true", "false"]:
+                raise ValueError('must be equal to "true" or "false"')
+        return v
+
 
 class KeystoneCharm(CharmedOsmBase):
     def __init__(self, *args) -> NoReturn: