)]}'
{"id":"openstack%2Fkeystonemiddleware~942995","triplet_id":"openstack%2Fkeystonemiddleware~master~I3d7e16164bb596f2279a86c36e553d3183795ce1","project":"openstack/keystonemiddleware","branch":"master","topic":"external-oauth2","hashtags":[],"change_id":"I3d7e16164bb596f2279a86c36e553d3183795ce1","subject":"[WiP] Local signature validation for JWT OAuth2.0 tokens","status":"NEW","created":"2025-02-28 11:49:30.000000000","updated":"2025-07-01 12:05:34.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":false,"submittable":false,"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"ff1ae2daae47168fdde5ce413cdc4c3650dc00f5","_number":942995,"virtual_id_number":942995,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:check","value":1,"date":"2025-07-01 12:05:34.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2025-02-28 13:16:02.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"5ed5f269107f1982b9a6e2ab809e209075339ed1","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2025-02-28 11:49:30.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"d59e083deac1bb511cbc98b82edac82d5c96a28b","tag":"autogenerated:gerrit:setTopic","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2025-02-28 11:53:56.000000000","message":"Topic set to external-oauth2","accounts_in_message":[],"_revision_number":1},{"id":"e7ac9c0a003672d8dc487729639ebcc765ac71f1","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-02-28 13:16:02.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/971942926b304b79b5c2ba7d702ec02b\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/79d481eda481413eba644fb79f278f4a : SUCCESS in 3m 26s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/a5ff559de112413b9338c8ef46be4f3e : SUCCESS in 3m 15s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/2f9b2cd1da9c4f16a1f9309b7f4ca8bb : SUCCESS in 3m 37s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/1b432f0bb6214d31a31094b3c7775551 : SUCCESS in 3m 31s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/e0615baf2b9e4d3491cdc6c74e510e4d : SUCCESS in 5m 48s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/20c32495c4284fbfa894bc48dc5b498d : SUCCESS in 1h 25m 15s","accounts_in_message":[],"_revision_number":1},{"id":"546cde86333c4cb03ec2eda7ab7583c5981277fe","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2025-07-01 09:17:31.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Verified+1\n","accounts_in_message":[],"_revision_number":2},{"id":"ff1ae2daae47168fdde5ce413cdc4c3650dc00f5","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-07-01 12:05:34.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/2959ae8b630e4a92ad01465c573f9612\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/82f5a79296ab404b92fac4c16a46bbe5 : SUCCESS in 3m 12s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/453606e480c44cc395e7c7efcb970e87 : SUCCESS in 2m 56s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/6b1b501c90fd41bda8c51656eb561d06 : SUCCESS in 3m 18s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/4767092cd7bf4b899411e8b260f7ccc6 : SUCCESS in 3m 17s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/d42e89f795e744c2886e3530e31d86c2 : SUCCESS in 7m 10s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/d129593716124486801a6f7728ffdbfe : SUCCESS in 6m 34s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/81e45a43d49945f8b12991d7162a4d14 : SUCCESS in 1h 30m 14s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"7e5a6e8f8de6ee5776095389fd435f9301497a94","revisions":{"cff0789f3de0dc4af73607e3edc067e50e7f3d68":{"kind":"REWORK","_number":1,"created":"2025-02-28 11:49:30.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/95/942995/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystonemiddleware","ref":"refs/changes/95/942995/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/95/942995/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/95/942995/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/95/942995/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystonemiddleware refs/changes/95/942995/1"}}},"commit":{"parents":[{"commit":"0fb83d844208bde9d6ffd9cb04fda130063855c6","subject":"[WiP] External OAuth2.0 service tokens","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/0fb83d844208bde9d6ffd9cb04fda130063855c6"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2025-02-26 20:39:20.000000000","tz":60},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2025-02-28 11:49:17.000000000","tz":60},"subject":"[WiP] Local signature validation for JWT OAuth2.0 tokens","message":"[WiP] Local signature validation for JWT OAuth2.0 tokens\n\nOAuth2.0 protocol itself doesn\u0027t allow validation of an\nexpired token. Fortunately, many OAuth2.0 servers also\nissue JSON Web Tokens. This enables us to do local\nsignature verification of an expired token, a.k.a.\nretrieving an expired token, achieving feature\ncompatibility with the native Keystone API.\n\nImplements: blueprint allow-expired\nChange-Id: I3d7e16164bb596f2279a86c36e553d3183795ce1\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/cff0789f3de0dc4af73607e3edc067e50e7f3d68"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/cff0789f3de0dc4af73607e3edc067e50e7f3d68"}]},"branch":"refs/heads/master"},"7e5a6e8f8de6ee5776095389fd435f9301497a94":{"kind":"REWORK","_number":2,"created":"2025-07-01 09:17:31.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/95/942995/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystonemiddleware","ref":"refs/changes/95/942995/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/95/942995/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/95/942995/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystonemiddleware refs/changes/95/942995/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystonemiddleware refs/changes/95/942995/2"}}},"commit":{"parents":[{"commit":"5078603a5d19d09a2a4501ad3199ffacf7432320","subject":"[WiP] External OAuth2.0 service tokens","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/5078603a5d19d09a2a4501ad3199ffacf7432320"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2025-02-26 20:39:20.000000000","tz":60},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2025-07-01 09:17:10.000000000","tz":120},"subject":"[WiP] Local signature validation for JWT OAuth2.0 tokens","message":"[WiP] Local signature validation for JWT OAuth2.0 tokens\n\nOAuth2.0 protocol itself doesn\u0027t allow validation of an\nexpired token. Fortunately, many OAuth2.0 servers also\nissue JSON Web Tokens. This enables us to do local\nsignature verification of an expired token, a.k.a.\nretrieving an expired token, achieving feature\ncompatibility with the native Keystone API.\n\nImplements: blueprint allow-expired\nChange-Id: I3d7e16164bb596f2279a86c36e553d3183795ce1\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/7e5a6e8f8de6ee5776095389fd435f9301497a94"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystonemiddleware/commit/7e5a6e8f8de6ee5776095389fd435f9301497a94"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY"},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}