)]}'
{"id":"openstack%2Fkeystoneauth~1005708","triplet_id":"openstack%2Fkeystoneauth~master~I99610b837675fc0e3e39fc26ccd8b90381e2d91c","project":"openstack/keystoneauth","branch":"master","topic":"fix/oauth2-mtls-thumbprint","attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-09-15 13:12:12.000000000","reason":"\u003cGERRIT_ACCOUNT_15334\u003e replied on the change","reason_account":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"}}},"removed_from_attention_set":{},"hashtags":[],"change_id":"I99610b837675fc0e3e39fc26ccd8b90381e2d91c","subject":"Validate OAuth2 mTLS token thumbprint at auth time","status":"NEW","created":"2026-09-15 10:23:56.000000000","updated":"2026-09-15 13:12:12.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":3,"unresolved_comment_count":2,"has_review_started":true,"meta_rev_id":"cc2204564a8ef8ac31155e79dd593e19f396035f","_number":1005708,"virtual_id_number":1005708,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},{"tag":"autogenerated:zuul:check","value":1,"date":"2026-09-15 12:00:03.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"disliked":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"all":[{"value":-1,"date":"2026-09-15 13:12:12.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","value":-1,"default_value":0,"optional":true},"Workflow":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-09-15 12:00:03.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-09-15 13:12:12.000000000","updated_by":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"reviewer":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"state":"REVIEWER"}],"messages":[{"id":"50ddf1b81f02c8281aa266183ffb668c9253b1a6","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-09-15 10:23:56.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"f226a03c039db75c7143c0d08050751cdbbd1dac","tag":"autogenerated:gerrit:setReadyForReview","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-09-15 11:11:47.000000000","message":"Set Ready For Review","accounts_in_message":[],"_revision_number":1},{"id":"6f98d1ddbc57de97a4f7bd1b11756e8b025856a6","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-15 12:00:03.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/f6699852bf9940438901c570ec0b5482\n\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/3a7922ac4f8e4a2997effa0f73989773 : SUCCESS in 1h 30m 30s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/42a8e43457a3406b990b9919345e3028 : SUCCESS in 8m 17s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/0f6ee9314e8649f6809bc79e186ad665 : SUCCESS in 7m 20s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/08e197bc20e84538bbf8a0af88bfb7e6 : SUCCESS in 7m 17s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/d28fb23216384374baa24d9149bb8d3c : SUCCESS in 10m 03s\n- openstack-tox-py315 https://zuul.opendev.org/t/openstack/build/c857f4c764234f79bc66a61035ad7dc0 : SUCCESS in 14m 41s (non-voting)\n- openstacksdk-functional-devstack-tips https://zuul.opendev.org/t/openstack/build/58196c91707c462793d8ca14f9be90ef : SUCCESS in 50m 37s\n- osc-tox-py311-tips https://zuul.opendev.org/t/openstack/build/0eb2b892789d48858c4cf00f16f5c74b : SUCCESS in 4m 35s\n- osc-tox-py314-tips https://zuul.opendev.org/t/openstack/build/151dd931baa1415786e60937f9e4cfb4 : SUCCESS in 7m 51s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/0693d97b84a7423ca54d00447c4a2da9 : SUCCESS in 8m 16s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/1f02a03c042e4225b95717f364999580 : SUCCESS in 3m 57s","accounts_in_message":[],"_revision_number":1},{"id":"cc2204564a8ef8ac31155e79dd593e19f396035f","author":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"},"date":"2026-09-15 13:12:12.000000000","message":"Patch Set 1: Code-Review-1\n\n(3 comments)","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"0283f58d4fe5a310333078a2a6507f3998615098","revisions":{"0283f58d4fe5a310333078a2a6507f3998615098":{"kind":"REWORK","_number":1,"created":"2026-09-15 10:23:56.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/08/1005708/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystoneauth","ref":"refs/changes/08/1005708/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystoneauth refs/changes/08/1005708/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystoneauth refs/changes/08/1005708/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystoneauth refs/changes/08/1005708/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystoneauth refs/changes/08/1005708/1"}}},"commit":{"parents":[{"commit":"ac0679fc8a611fd2a8984fcc5e6c2474caf9d355","subject":"typing: Remove unnecessary use of TYPE_CHECKING","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystoneauth/commit/ac0679fc8a611fd2a8984fcc5e6c2474caf9d355"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-09-15 10:23:51.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-09-15 10:23:54.000000000","tz":120},"subject":"Validate OAuth2 mTLS token thumbprint at auth time","message":"Validate OAuth2 mTLS token thumbprint at auth time\n\nAfter Keystone returns an oauth2_credential token, compare the x5t#S256\nclaim against the client certificate on the session when cert is set.\nKeystonemiddleware already enforces certificate binding on inbound API\nrequests, so this is mainly a correctness and debugging aid: auth fails\nearly when the token thumbprint does not match the local client cert\ninstead of only failing on the first service call.\n\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nChange-Id: I99610b837675fc0e3e39fc26ccd8b90381e2d91c\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystoneauth/commit/0283f58d4fe5a310333078a2a6507f3998615098"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystoneauth/commit/0283f58d4fe5a310333078a2a6507f3998615098"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":15334,"name":"Stephen Finucane","display_name":"stephenfin","email":"stephenfin@redhat.com","username":"sfinucan"}},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}