In https://github.com/openstack/keystone/blob/stable/stein/keystone/api/auth.py#L108 the token is not decoded and therefore is rendered in the SSO callback template as bytes. See example below for how to recreate.
>>> import string
>>> template = string.Template("""<!DOCTYPE html>
... <html xmlns="http://www.w3.org/1999/xhtml">
... <head>
... <title>Keystone WebSSO redirect</title>
... </head>
... <body>
... <form id="sso" name="sso" action="$host" method="post">
... Please wait...
... <br/>
... <input type="hidden" name="token" id="token" value="$token"/>
... <noscript>
... <input type="submit" name="submit_no_javascript" id="submit_no_javascript"
... value="If your JavaScript is disabled, please click to continue"/>
... </noscript>
... </form>
... <script type="text/javascript">
... window.onload = function() {
... document.forms['sso'].submit();
... }
... </script>
... </body>
... </html>""")
>>> subs = {"host": b"myhost", "token": b"mytoken"}
>>> template.substitute(subs)
'<!DOCTYPE html>\n<html xmlns="http://www.w3.org/1999/xhtml">\n <head>\n <title>Keystone WebSSO redirect</title>\n </head>\n <body>\n <form id="sso" name="sso" action="b\'myhost\'" method="post">\n Please wait...\n <br/>\n <input type="hidden" name="token" id="token" value="b\'mytoken\'"/>\n <noscript>\n <input type="submit" name="submit_no_javascript" id="submit_no_javascript"\n value="If your JavaScript is disabled, please click to continue"/>\n </noscript>\n </form>\n <script type="text/javascript">\n window.onload = function() {\n document.forms[\'sso\'].submit();\n }\n </script>\n </body>\n</html>'
Can you explain the negative consequences this has had on your deployment? Are you unable to authenticate because of this?