Keystone OpenID Connect + Authorization Code Flow

keystone_apache.conf

<VirtualHost *:5000>
    ...

    OIDCClaimPrefix "OIDC-"

    OIDCResponseType "code"
    OIDCScope "openid email profile"
    OIDCProviderMetadataURL http://<keycloak_host>:8080/auth/realms/master/.well-known/openid-configuration
    OIDCClientID <client_id>
    OIDCClientSecret <client_secret>
    OIDCCryptoPassphrase openstack
    OIDCRedirectURI http://<openstack_host>:5000/v3/OS-FEDERATION/identity_providers/keycloak/protocols/oidc/auth/redirect

    <LocationMatch /v3/OS-FEDERATION/identity_providers/.*?/protocols/oidc/auth>
        AuthType oauth20
        Require valid-user
        LogLevel debug
    </LocationMatch>
</VirtualHost>