---
features:
  - |
    Adds knobs for the Keystone mod_auth_openidc integration: tune the timeout
    manager via ``OIDCStateTimeout`` and provide a custom error page at
    ``{{ node_custom_config }}/keystone/federation/modoidc-error-page.html``.

upgrade:
  - |
    Deployments now ship a default template at
    ``ansible/roles/keystone/templates/modoidc-error-page.html.j2`` to handle
    federated authentication errors. Operators can override the full template
    or just adjust the redirect delay via
    ``keystone_federation_oidc_error_page_retry_login_delay_milliseconds``.
    The default redirect delay is 5 seconds.