I've done a first pass of setting up a puppet module to configure Keystone to use ipsilon for federation, using https://github.com/richm/puppet-apache-auth-mods, and a version of ipsilon-client-install with patches https://fedorahosted.org/ipsilon/ticket/141 and https://fedorahosted.org/ipsilon/ticket/142, and a heavily modified version of the ipa/rdo federation setup scripts - https://github.com/richm/rdo-vm-factory. I would like some feedback from the Keystone and puppet folks about this approach.