These might be able to be added simply as extra files in the apache config directories.  The assumption here is that the keystone image includes all the required module rpms already installed.  There is a mechanism in the keystone-operator called DefaultConfigOverwrite which we might be able to use - although the comment says that this functionality still needs to be implemented.  The apache changes can be seen in puppet, although we may not need all the things in that template file.  There is also a redirect file that needs to be added -  [file|https://github.com/openstack/keystone/blob/master/etc/sso_callback_template.html]