Puppet module changes are needed to allow Keystone to be set up in httpd/mod_wsgi.
One scenario that will definitely require work in the puppet modules is to allow Keystone to share a single httpd instance with Horizon when both services are installed together (as done on a controller or an all-in-one setup). We will need to ensure that the core httpd configuration and the mod_wsgi configurations do not step on each other.
This is already fixed and included in the following package:
This bug has been closed as a part of the RHEL-OSP 6 general availability release. For details, see https://rhn.redhat.com/errata/rhel7-rhos-6-errata.html