diff --git a/ansible/roles/keystone/templates/wsgi-keystone.conf.j2 b/ansible/roles/keystone/templates/wsgi-keystone.conf.j2
index 124ea2ce691b8d192ca40b448f193364165e976a..3fad8cbb3fe6b22cf3093efde42a4f7b5da48157 100644
--- a/ansible/roles/keystone/templates/wsgi-keystone.conf.j2
+++ b/ansible/roles/keystone/templates/wsgi-keystone.conf.j2
@@ -79,6 +79,7 @@ LogLevel info
 {% for idp in keystone_identity_providers %}
 {% if idp.protocol == 'openid' %}
     <LocationMatch /v3/auth/OS-FEDERATION/identity_providers/{{ idp.name }}/protocols/{{ idp.protocol }}/websso>
+      OIDCDiscoverURL {{ keystone_public_url }}/redirect_uri?iss={{ idp.identifier | urlencode }}
       Require valid-user
       AuthType openid-connect
     </LocationMatch>
diff --git a/releasenotes/notes/add-oidc-discover-url-83edb9f43f73a97f.yaml b/releasenotes/notes/add-oidc-discover-url-83edb9f43f73a97f.yaml
new file mode 100644
index 0000000000000000000000000000000000000000..fd8bf8d5280e6fc68de510946d6cf90b81e3b5ea
--- /dev/null
+++ b/releasenotes/notes/add-oidc-discover-url-83edb9f43f73a97f.yaml
@@ -0,0 +1,7 @@
+---
+fixes:
+  - |
+    Fixes an issue with an OIDC authentication flow requiring unnecessary
+    action from the user. Redirecting to the target IdP page now happens
+    automatically.
+    `LP#930055 <https://bugs.launchpad.net/kolla-ansible/+bug/1930055>`__