Description of problem:

Supporting openid federation requires setting a number of parameters in keystone's httpd configuration, such as:

  LoadModule auth_openidc_module modules/mod_auth_openidc.so
  OIDCClaimPrefix "OIDC-"
  OIDCResponseType "id_token"
  OIDCScope "openid email profile"
  OIDCProviderMetadataURL "https://sso.massopen.cloud/auth/realms/moc/.well-known/openid-configuration"
  OIDCClientID "kaizen"
  OIDCClientSecret "..."
  OIDCCryptoPassphrase "..."

  OIDCCacheType memcache
  OIDCMemCacheServers "172.16.32.10:11211 172.16.32.11:11211 172.16.32.28:11211"

  # The following directives are necessary to support websso from Horizon
  # (Per https://docs.openstack.org/keystone/pike/advanced-topics/federation/websso.html)
  OIDCRedirectURI "https://kaizen.massopen.cloud:13000/v3/auth/OS-FEDERATION/identity_providers/moc/protocols/openid/websso"
  OIDCRedirectURI "https://kaizen.massopen.cloud:13000/v3/auth/OS-FEDERATION/websso/openid"

  <LocationMatch "/v3/auth/OS-FEDERATION/websso/openid">
      AuthType "openid-connect"
      Require valid-user
  </LocationMatch>

  <LocationMatch "/v3/auth/OS-FEDERATION/identity_providers/moc/protocols/openid/websso">
      AuthType "openid-connect"
      Require valid-user
  </LocationMatch>

  OIDCOAuthClientID "kaizen"
  OIDCOAuthClientSecret "..."
  OIDCOAuthIntrospectionEndpoint "https://sso.massopen.cloud/auth/realms/moc/protocol/openid-connect/token/introspect"

  <Location ~ "/v3/OS-FEDERATION/identity_providers/moc/protocols/openid/auth">
      AuthType oauth20
      Require valid-user
  </Location>

The puppet-keystone module does not provide any way to inject custom configuration into keystone's apache configuration files (10-keystone_wsgi_admin.conf and 10-keystone_wsgi_main.conf).

These changes can be made via some sort of post-deploy
script/playbook/etc, but that means that authentication is broken for
the duration of the deploy. It would be preferable if there was a
mechanism that would permit an operator to apply this configuration
during the deploy process.

Version-Release number of selected component (if applicable):

puppet-keystone-12.4.0-6.el7ost.noarch