There are number of manual steps included in configuring foreman with keycloak as per https://www.theforeman.org/2018/06/using-saml-for-single-sign-on-to-foreman-through-keycloak.html

This configuration should not be expected to do by user manually. Nice approach would be to have it automated using foreman installer ( ex: foreman-installer --keycloak-authentication true --keycloak-url example.com --keycloak-realm Example --keycloak-user admin --keycloak password changeme). Using installer way may also help to inform puppet not to wipe out settings after upgrade rather than adding again manually apache::purge_configs: false in custom-hiera.yaml.