Module sets invalid OIDCRedirectURI when using openidc

Hi everyone,

I am trying to configure OpenStack to use Keycloak as an Identity Provider so we can use Single Sign-On on Horizon.

I am petty much following the official docs: https://docs.openstack.org/keystone/latest/admin/federation/configure_federation.html

One of the issues I encountered is that the puppet module sets the wrong OIDCRedirectURI values:

https://opendev.org/openstack/puppet-keystone/src/branch/master/templates/openidc.conf.erb#L49

According to mod_auth_openidc docs: https://github.com/zmartzone/mod_auth_openidc/blob/master/auth_openidc.conf#L8

# The redirect_uri for this OpenID Connect client; this is a vanity URL
# that must ONLY point to a path on your server protected by this module
# but it must NOT point to any actual content that needs to be served.

However the module configures 2 OIDCRedirectURI that point to actual content. This breaks the authentication flow.

My proposal: only configure ONE OIDCRedirectURI that points to a vanity URL, for example: .../protocols/openid/websso/redirect_url

If there are no objections, I will open a change to address this issue.

Thank you,
Daniel.