)]}'
{"id":"openstack%2Fkeystone~1002082","triplet_id":"openstack%2Fkeystone~stable%2F2026.1~I4dd5817d20394369cfadd20ccf476a0660760c52","project":"openstack/keystone","branch":"stable/2026.1","attention_set":{"13252":{"account":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"last_update":"2026-08-25 15:49:17.000000000","reason":"A robot voted negatively on a label"},"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-08-25 15:49:17.000000000","reason":"A robot voted negatively on a label"}},"removed_from_attention_set":{},"hashtags":[],"change_id":"I4dd5817d20394369cfadd20ccf476a0660760c52","subject":"Ban ec2credential tokens from Keystone API","status":"NEW","created":"2026-08-24 12:47:50.000000000","updated":"2026-08-25 15:49:17.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":3,"unresolved_comment_count":2,"has_review_started":true,"cherry_pick_of_change":997369,"cherry_pick_of_patch_set":1,"meta_rev_id":"7159b54c59e4170c3ae40577985784fa5c220b2a","_number":1002082,"virtual_id_number":1002082,"owner":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"actions":{},"labels":{"Verified":{"disliked":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},{"tag":"autogenerated:zuul:check","value":-1,"date":"2026-08-25 15:49:17.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":-1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"rejected":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"all":[{"value":-1,"date":"2026-08-25 14:58:25.000000000","permitted_voting_range":{"min":-1,"max":1},"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"CC":[{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-24 12:47:50.000000000","updated_by":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"CC"},{"updated":"2026-08-24 13:04:34.000000000","updated_by":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"reviewer":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"state":"CC"},{"updated":"2026-08-24 13:04:34.000000000","updated_by":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"CC"},{"updated":"2026-08-24 14:33:06.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"4eec98d0ec270828c53ed225657c463b354c7a79","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"date":"2026-08-24 12:47:50.000000000","message":"Patch Set 1: Cherry Picked from branch master.","accounts_in_message":[],"_revision_number":1},{"id":"c36267884d5395d18dc1e89509504291ce4888a8","author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"date":"2026-08-24 13:04:34.000000000","message":"Patch Set 1:\n\n(2 comments)","accounts_in_message":[],"_revision_number":1},{"id":"db0cfbe85d00b380e6794bba583896227e37d342","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-24 14:33:06.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/fb17567f3d7846c5a323921e956511b7\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/1c385322b9d045da894f0339c6808108 : SUCCESS in 14m 12s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/195bf0c998334d558397b82b54d60d60 : SUCCESS in 5m 37s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/924066288fce4b8896468ecfa2b1305c : SUCCESS in 10m 49s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/5f5fa882a1e54b1cb908ac57d774f6f7 : SUCCESS in 10m 41s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/4e38638e93464a71b54046aee89b90eb : SUCCESS in 13m 57s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/0393a7340a4b4990a17104f5039b27f4 : SUCCESS in 12m 19s\n- grenade https://zuul.opendev.org/t/openstack/build/0a3d55936677449f946324a8bcab3e6b : SUCCESS in 1h 17m 16s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/130a3da105664ccc93e96591f480eef8 : SUCCESS in 1h 42m 16s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/905444a90e924b86a9346b2b776ea7a7 : SUCCESS in 14m 35s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/b6e71b626e9e48ad9dcc0b1ecb1c1381 : SUCCESS in 15m 11s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/b9fed42154944703b50661bda003e923 : SUCCESS in 33m 00s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/d3c4fab83b914ca7b23e6241abe3bee1 : FAILURE in 16m 52s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/fb18a59e6c0d4a93a5ed5278c37c1cb5 : FAILURE in 30m 02s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/41ac713f346149f1b5fa299afebdfbf2 : SUCCESS in 23m 24s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/19befc540050476f95bfdc5e106eed80 : SUCCESS in 25m 57s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/068e5fa6370a4e2e88c95d4e36c3d30b : SUCCESS in 37m 48s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/af29afd22d994b4b9dda1554e224cb77 : SUCCESS in 52m 18s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/3b20675bc16a475b92959c869b127747 : FAILURE in 25m 10s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/e2a71b12669143ad8500522e9234b6f7 : SUCCESS in 7m 39s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":1},{"id":"0935e9133baadb775e326a6a0d5065d1f69c2298","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 13:28:18.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"8d5c5b81a0c8b25d7999c8b69b5cb3475a5acd9f","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 13:32:08.000000000","message":"Uploaded patch set 3.","accounts_in_message":[],"_revision_number":3},{"id":"bd13ffe6e8dc7d76180157a55be708b6d53a8cd9","author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"date":"2026-08-25 14:58:25.000000000","message":"Patch Set 3: Workflow-1\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"7159b54c59e4170c3ae40577985784fa5c220b2a","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 15:49:17.000000000","message":"Patch Set 3: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/c3c1e57bf05e46e5ba002723e63a8af9\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/7402eb20cfba42ac9050388b2ba1bcc3 : SUCCESS in 18m 38s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/11b2f18c02cf45b0a2e4cd79b2ded9c7 : SUCCESS in 5m 31s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/f31357eb7d3842efb4931380495330fe : SUCCESS in 12m 35s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/139d1d046dd040ee86002ff47df3164e : SUCCESS in 7m 37s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/d4a00a203457496d9b1fa5b2a4183fc2 : SUCCESS in 15m 38s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/d67f2b9c29474119a3668d409f69d5a5 : SUCCESS in 15m 11s\n- grenade https://zuul.opendev.org/t/openstack/build/6646afdefcd84c52a904dbe6e00e575a : SUCCESS in 45m 10s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/4e2d4afa55e04be7ab76ff36a1797505 : SUCCESS in 2h 10m 40s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/66cd886e00714209b8c39e95bb32d3bb : SUCCESS in 9m 54s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/95ad2da8a76645e0a82c6c655e8de9a1 : SUCCESS in 14m 41s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/e7113ecf2c934c9d897c8a521f089397 : SUCCESS in 29m 37s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/29e35a671cb1480094bb1d66d3bb6d74 : FAILURE in 8m 11s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/9e5be10e4ca546008e3c26ef4fcf2a2b : FAILURE in 25m 50s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/2c2211427d4b45279d1cfc9b97e533b1 : SUCCESS in 38m 00s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/fc3c0913e3854506a90bf53f74fd177b : SUCCESS in 31m 33s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/18d6b9490c20426692eac22fb1c70ade : SUCCESS in 21m 53s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/a7e9e91c06944c8c8c5844197f330f5b : SUCCESS in 45m 04s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/746e2c10a7f04a33bd1f175bec8f31bc : FAILURE in 22m 21s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/916d9ef281d241b388b81679ccfcc800 : SUCCESS in 7m 54s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":3}],"current_revision_number":3,"current_revision":"050ff690849c88a7a24ca7d858be43696e7d5c2f","revisions":{"78e2b524d7d8f97b7785c34b34a811840d84fa31":{"kind":"REWORK","_number":1,"created":"2026-08-24 12:47:50.000000000","uploader":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"ref":"refs/changes/82/1002082/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/82/1002082/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/82/1002082/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/82/1002082/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/82/1002082/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/82/1002082/1"}}},"commit":{"parents":[{"commit":"7b9f39226744b8db50a6d702cc5f715fc9c17f37","subject":"Merge \"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)\" into stable/2026.1","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/7b9f39226744b8db50a6d702cc5f715fc9c17f37"}]}],"author":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-07-15 11:08:10.000000000","tz":120},"committer":{"name":"Dr. Jens Harbott","email":"frickler@offenerstapel.de","date":"2026-08-24 12:47:50.000000000","tz":0},"subject":"Ban ec2credential tokens from Keystone API","message":"Ban ec2credential tokens from Keystone API\n\nEC2 credentials are supported by Keystone only to allow Swift to\nimplement S3 protocol while using Keystone identities. There are no real\nreasons for ec2credential fernet tokens (after authenticating) being\naccepted by the Keystone itself. There are many barriers where\nKeystone explicitly checks and bans such credentials to prevent\nrescoping or accessing resources belonging to other projects. There\nhave been multiple security issues due to missing guards. Instead of\nthose individual barriers, simply bar such tokens from any Keystone\noperation except validating the token (which Swift needs to do) and\nre-authenticating (renewing the token). The latter is questionable on\nits own, but is kept for now.\n\nSolve the problem by simply rejecting the ec2credential issued token\nin the auth middleware which runs before any authenticated request.\nThe /auth/tokens are unauthenticated and as such are not affected.\n\nChange-Id: I4dd5817d20394369cfadd20ccf476a0660760c52\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit 910ebab06db3b9c119a3139b9443f7bd2369158f)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/78e2b524d7d8f97b7785c34b34a811840d84fa31"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/78e2b524d7d8f97b7785c34b34a811840d84fa31"}]},"branch":"refs/heads/stable/2026.1","conflicts":{"base":"2513d1dca7aa3d2cfcbe373b166c2ad54116047d","ours":"7b9f39226744b8db50a6d702cc5f715fc9c17f37","theirs":"910ebab06db3b9c119a3139b9443f7bd2369158f","merge_strategy":"recursive","contains_conflicts":false}},"d7592569ea87406d6ac8e1e2047e78c6d4c49278":{"kind":"REWORK","_number":2,"created":"2026-08-25 13:28:18.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/82/1002082/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/82/1002082/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/82/1002082/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/82/1002082/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/82/1002082/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/82/1002082/2"}}},"commit":{"parents":[{"commit":"7b9f39226744b8db50a6d702cc5f715fc9c17f37","subject":"Merge \"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)\" into stable/2026.1","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/7b9f39226744b8db50a6d702cc5f715fc9c17f37"}]}],"author":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-07-15 11:08:10.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 13:27:54.000000000","tz":120},"subject":"Ban ec2credential tokens from Keystone API","message":"Ban ec2credential tokens from Keystone API\n\nEC2 credentials are supported by Keystone only to allow Swift to\nimplement S3 protocol while using Keystone identities. There are no real\nreasons for ec2credential fernet tokens (after authenticating) being\naccepted by the Keystone itself. There are many barriers where\nKeystone explicitly checks and bans such credentials to prevent\nrescoping or accessing resources belonging to other projects. There\nhave been multiple security issues due to missing guards. Instead of\nthose individual barriers, simply bar such tokens from any Keystone\noperation except validating the token (which Swift needs to do) and\nre-authenticating (renewing the token). The latter is questionable on\nits own, but is kept for now.\n\nSolve the problem by simply rejecting the ec2credential issued token\nin the auth middleware which runs before any authenticated request.\nThe /auth/tokens are unauthenticated and as such are not affected.\n\nAdd a config option, [auth] ban_ec2credential_tokens, default True, so\ndeployments with an undocumented dependency on using EC2-derived\ntokens directly against the API can opt out instead of being broken\noutright. Also add a release note, since this changes existing,\ndocumented API behavior for anyone relying on it.\n\nChange-Id: I4dd5817d20394369cfadd20ccf476a0660760c52\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit 910ebab06db3b9c119a3139b9443f7bd2369158f)\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/d7592569ea87406d6ac8e1e2047e78c6d4c49278"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/d7592569ea87406d6ac8e1e2047e78c6d4c49278"}]},"branch":"refs/heads/stable/2026.1"},"050ff690849c88a7a24ca7d858be43696e7d5c2f":{"kind":"REWORK","_number":3,"created":"2026-08-25 13:32:08.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/82/1002082/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/82/1002082/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/82/1002082/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/82/1002082/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/82/1002082/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/82/1002082/3"}}},"commit":{"parents":[{"commit":"7b9f39226744b8db50a6d702cc5f715fc9c17f37","subject":"Merge \"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)\" into stable/2026.1","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/7b9f39226744b8db50a6d702cc5f715fc9c17f37"}]}],"author":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-07-15 11:08:10.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 13:32:00.000000000","tz":120},"subject":"Ban ec2credential tokens from Keystone API","message":"Ban ec2credential tokens from Keystone API\n\nEC2 credentials are supported by Keystone only to allow Swift to\nimplement S3 protocol while using Keystone identities. There are no real\nreasons for ec2credential fernet tokens (after authenticating) being\naccepted by the Keystone itself. There are many barriers where\nKeystone explicitly checks and bans such credentials to prevent\nrescoping or accessing resources belonging to other projects. There\nhave been multiple security issues due to missing guards. Instead of\nthose individual barriers, simply bar such tokens from any Keystone\noperation except validating the token (which Swift needs to do) and\nre-authenticating (renewing the token). The latter is questionable on\nits own, but is kept for now.\n\nSolve the problem by simply rejecting the ec2credential issued token\nin the auth middleware which runs before any authenticated request.\nThe /auth/tokens are unauthenticated and as such are not affected.\n\nAdd a config option, [auth] ban_ec2credential_tokens, default True, so\ndeployments with an undocumented dependency on using EC2-derived\ntokens directly against the API can opt out instead of being broken\noutright. Also add a release note, since this changes existing,\ndocumented API behavior for anyone relying on it.\n\nChange-Id: I4dd5817d20394369cfadd20ccf476a0660760c52\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit 910ebab06db3b9c119a3139b9443f7bd2369158f)\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/050ff690849c88a7a24ca7d858be43696e7d5c2f"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/050ff690849c88a7a24ca7d858be43696e7d5c2f"}]},"branch":"refs/heads/stable/2026.1"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY"},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":["label:Workflow\u003dMIN"],"failing_atoms":["label:Workflow\u003dMAX"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}