)]}'
{"id":"openstack%2Fkeystone~1002302","triplet_id":"openstack%2Fkeystone~master~Iadc104ae95d6c59484f29f62d6afe4a935bd8593","project":"openstack/keystone","branch":"master","attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-08-25 16:26:55.000000000","reason":"A robot voted negatively on a label"}},"removed_from_attention_set":{},"hashtags":["CVE-2026-80184","OSSA-2026-037"],"change_id":"Iadc104ae95d6c59484f29f62d6afe4a935bd8593","subject":"auth: reject delegated tokens from token-method reauthentication","status":"NEW","created":"2026-08-25 14:47:47.000000000","updated":"2026-08-26 10:21:16.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":5,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"51a78420e8e93a2ee2570db05fa1f80018a8e320","_number":1002302,"virtual_id_number":1002302,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:check","value":1,"date":"2026-08-25 20:59:11.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"CC":[{"_account_id":8313,"name":"Lajos Katona","display_name":"lajoskatona","email":"katonalala@gmail.com","username":"elajkat","status":"Ericsson Software Technology"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-25 16:26:55.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-08-26 10:21:16.000000000","updated_by":{"_account_id":8313,"name":"Lajos Katona","display_name":"lajoskatona","email":"katonalala@gmail.com","username":"elajkat","status":"Ericsson Software Technology"},"reviewer":{"_account_id":8313,"name":"Lajos Katona","display_name":"lajoskatona","email":"katonalala@gmail.com","username":"elajkat","status":"Ericsson Software Technology"},"state":"CC"}],"messages":[{"id":"dcc697721517aceb47d691e4e6b234678698abb2","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 14:47:47.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"6fdbcfdf9474328ab6d9fe0740dd73d8bf7ca3f7","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 16:26:55.000000000","message":"Patch Set 1: Verified-1\n\n(5 comments)\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/ae4c2fb414fa408db019905125ba5fcd\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/f31a54016db84a35baa352dd319623c0 : SUCCESS in 11m 42s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/eb6d652ddbe0461883527ab995e8a940 : FAILURE in 3m 23s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/7a8f5eefbae1450085ec54769d903438 : SUCCESS in 8m 57s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/1d7407fe118347e5885ce2a1c91f624a : SUCCESS in 12m 14s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/3efe5d38f0474a0faf5bb91baa6783cd : SUCCESS in 15m 54s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/fe5062c0ff4a4413a1eb9c42d2136fe8 : SUCCESS in 9m 05s\n- grenade https://zuul.opendev.org/t/openstack/build/14e3c2477a3e4b3897ffc54d3e858328 : SUCCESS in 1h 04m 33s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/718f2612e32743b0b2f91abbad5b81b7 : SUCCESS in 1h 35m 04s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/8c4225e19138464a9879992c7c9e57b4 : SUCCESS in 9m 25s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/d4db409b629c435ba46c6fbe8553c43f : SUCCESS in 20m 30s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/80661e3e35b5406d93edc3acf71d36db : SUCCESS in 1h 01m 43s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/d1ccffb393044839ab2eecd80b02499e : FAILURE in 11m 06s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/676da94a69184baba654b044ffb5b682 : FAILURE in 14m 57s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/c80e134e54f7478998fe6f639af8a53a : SUCCESS in 50m 43s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/ecc58952864f43d28a7675cc466a53fc : SUCCESS in 56m 59s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/1aebeca03ccf495f89f54004d9f4e3e4 : SUCCESS in 21m 00s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/5812d4bc9b134cdab4fed93fda65fa36 : SUCCESS in 31m 14s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/bf8a58cfed5549bea53036476389b998 : SUCCESS in 19m 37s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/cde7d81963d54ca9841e6411b0910690 : SUCCESS in 5m 45s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  Comments left for invalid file keystone/tests/unit/test_v3_trust.py","accounts_in_message":[],"_revision_number":1},{"id":"0bc26cc2875d64c1f77393472429e621f6169b0d","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 19:28:35.000000000","message":"Patch Set 1:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/72ddfc62427a4caaa139ab0ea4e36643\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/a95e66f0a3fa4700a43babcd891f3969 : SUCCESS in 13m 11s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/9ce00070d8d34fb1a516e654ef6c5284 : SUCCESS in 20m 16s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/21f9f835966841d982d714a3b3afc52f : SUCCESS in 39m 38s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"b298176af6305889f700f2faaf5f734d60251f4d","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 19:32:01.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"581b456b7a848ba9b758cf371e0c657eaa502a72","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 19:41:10.000000000","message":"Uploaded patch set 3: Patch Set 2 was rebased.","accounts_in_message":[],"_revision_number":3},{"id":"a92449ed838910469583abd3f85aefd1a97613a1","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 20:59:11.000000000","message":"Patch Set 3: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/b79bcc32c77443a59be0f384e62eeb7e\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/9c89a5c56ad24271a5d87bf0fd93ad92 : SUCCESS in 18m 59s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/839711ccd05c4e739fba75423f08e71c : SUCCESS in 5m 24s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/bf8e516dc580431bb0c697541dff76c2 : SUCCESS in 8m 28s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/47208bb610f14c0ca289cde704913d47 : SUCCESS in 10m 25s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/07ba1c6135d646a9968a98716b3c8216 : SUCCESS in 17m 47s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/3e9ce31402264a3793f42c9a2ccdae30 : SUCCESS in 7m 55s\n- grenade https://zuul.opendev.org/t/openstack/build/bd681b96a423491eb0bcc51b58d983c5 : SUCCESS in 1h 06m 01s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/b8b8892be77d4feeb6d29fa230b0c733 : SUCCESS in 55m 12s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/1b6d71cb47814cfa8a26f99fad7328a7 : SUCCESS in 13m 41s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/c01a2f24df644ed6814d62a3f9e7fd29 : SUCCESS in 8m 49s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/d2f76662969c49c684e58b71d7ce9b30 : SUCCESS in 40m 55s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/b9e2fad2f2dd44b4b2b030bda3813ff9 : FAILURE in 10m 00s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/158daedf6bfc4a53a714facf4665967b : FAILURE in 14m 31s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/87f6fad9ffc4460fbd1505323f3d2ebe : SUCCESS in 25m 20s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/6f080ac7c293431bb2811fd38a9436c7 : SUCCESS in 1h 02m 00s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/c8d0050fc74b46c6afdfb006e79c67c6 : SUCCESS in 35m 56s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/acfb74e74ee3438baf249dda1ef4cec6 : SUCCESS in 32m 28s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/c7f6fcf8ea804ecf89844dd615593853 : SUCCESS in 43m 15s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/a25e23498fe9472e9045b1f63ca173bc : SUCCESS in 7m 42s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":3},{"id":"8aacfcfe9f05fd637d66b3c6c316b4240cb27c92","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 21:32:34.000000000","message":"Patch Set 3:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/971afbd8b1234f3c87b3abac85d9c8c1\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/77d82037dbcd4cab821d8ba9370719ea : SUCCESS in 17m 37s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/50c3a39c814d40a5966a18b6cf8fdb3d : SUCCESS in 20m 14s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/331fa0c1db7841b1a8b6b76abf787c23 : SUCCESS in 25m 27s (non-voting)","accounts_in_message":[],"_revision_number":3},{"id":"23f61d5d729efdd3f3ba1602dcbf97915ec9e29c","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-08-25 22:13:01.000000000","message":"Hashtags added: CVE-2026-80184, OSSA-2026-037","accounts_in_message":[],"_revision_number":3}],"current_revision_number":3,"current_revision":"49baa3f9ed8f85aaab5c01499dde92841d5e320c","revisions":{"3e2ea3f298cec883b27db9bc79426d0fad6b1dea":{"kind":"REWORK","_number":1,"created":"2026-08-25 14:47:47.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/02/1002302/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/02/1002302/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/02/1002302/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/02/1002302/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/02/1002302/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/02/1002302/1"}}},"commit":{"parents":[{"commit":"eed696ba20f40571e2a3d430ddbe3c18aa91de7e","subject":"trusts, oauth1, app-creds: reject delegated tokens across all endpoints","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/eed696ba20f40571e2a3d430ddbe3c18aa91de7e"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-24 11:13:51.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 14:47:35.000000000","tz":120},"subject":"auth: reject delegated tokens from token-method reauthentication","message":"auth: reject delegated tokens from token-method reauthentication\n\ntoken_authenticate() unconditionally blocks trust-scoped and\nOAuth1-scoped tokens from creating another token via the token\nmethod, but application_credential tokens were only blocked from\nrequesting an explicit scope -- an omitted scope fell through to\nthe user\u0027s default-project scoping, letting an app-cred token\nbound to project A come back scoped to the user\u0027s default project\nB. ec2credential tokens matched no check at all, so they could\nrescope via an explicit scope to any project the underlying user\nhas a role on, not just a default-project fallback.\n\nBoth are the same root cause: application credentials and EC2\ncredentials are deliberately narrow, single-project grants, and the\n\"token\" method\u0027s rescoping logic never accounted for that, treating\nthem like a normal user session that\u0027s free to move between any of\nits own role assignments.\n\nBlock application_credential tokens from this path entirely,\nmatching trust/OAuth1, using the same shared\nkeystone.api._shared.delegation classification introduced by\nLP#2153453: any token whose methods aren\u0027t entirely primary auth\nmethods (built-in, or operator-registered via\n[auth] additional_primary_auth_methods) is rejected outright,\nincluding ec2credential and any future delegated method. An empty\ntoken.methods list (e.g. an ec2credential-derived token that lost its\nmethods on a fernet cache-miss round-trip) is also treated as\ndelegated, since issuperset([]) is True and would otherwise be\naccepted as \u0027all primary\u0027.\n\nCloses-Bug: #2158538\nChange-Id: Iadc104ae95d6c59484f29f62d6afe4a935bd8593\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nCo-developed-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3e2ea3f298cec883b27db9bc79426d0fad6b1dea"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3e2ea3f298cec883b27db9bc79426d0fad6b1dea"}]},"branch":"refs/heads/master"},"7d287620214183e675cd621381862f6e0be7b719":{"kind":"REWORK","_number":2,"created":"2026-08-25 19:32:01.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/02/1002302/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/02/1002302/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/02/1002302/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/02/1002302/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/02/1002302/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/02/1002302/2"}}},"commit":{"parents":[{"commit":"eed696ba20f40571e2a3d430ddbe3c18aa91de7e","subject":"trusts, oauth1, app-creds: reject delegated tokens across all endpoints","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/eed696ba20f40571e2a3d430ddbe3c18aa91de7e"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-24 11:13:51.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 19:30:30.000000000","tz":120},"subject":"auth: reject delegated tokens from token-method reauthentication","message":"auth: reject delegated tokens from token-method reauthentication\n\ntoken_authenticate() unconditionally blocks trust-scoped and\nOAuth1-scoped tokens from creating another token via the token\nmethod, but application_credential tokens were only blocked from\nrequesting an explicit scope -- an omitted scope fell through to\nthe user\u0027s default-project scoping, letting an app-cred token\nbound to project A come back scoped to the user\u0027s default project\nB. ec2credential tokens matched no check at all, so they could\nrescope via an explicit scope to any project the underlying user\nhas a role on, not just a default-project fallback.\n\nBoth are the same root cause: application credentials and EC2\ncredentials are deliberately narrow, single-project grants, and the\n\"token\" method\u0027s rescoping logic never accounted for that, treating\nthem like a normal user session that\u0027s free to move between any of\nits own role assignments.\n\nBlock application_credential tokens from this path entirely,\nmatching trust/OAuth1, using the same shared\nkeystone.api._shared.delegation classification introduced by\nLP#2153453: any token whose methods aren\u0027t entirely primary auth\nmethods (built-in, or operator-registered via\n[auth] additional_primary_auth_methods) is rejected outright,\nincluding ec2credential and any future delegated method. An empty\ntoken.methods list (e.g. an ec2credential-derived token that lost its\nmethods on a fernet cache-miss round-trip) is also treated as\ndelegated, since issuperset([]) is True and would otherwise be\naccepted as \u0027all primary\u0027.\n\nCloses-Bug: #2158538\nChange-Id: Iadc104ae95d6c59484f29f62d6afe4a935bd8593\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nCo-developed-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/7d287620214183e675cd621381862f6e0be7b719"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/7d287620214183e675cd621381862f6e0be7b719"}]},"branch":"refs/heads/master"},"49baa3f9ed8f85aaab5c01499dde92841d5e320c":{"kind":"TRIVIAL_REBASE","_number":3,"created":"2026-08-25 19:41:10.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/02/1002302/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/02/1002302/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/02/1002302/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/02/1002302/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/02/1002302/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/02/1002302/3"}}},"commit":{"parents":[{"commit":"aeea08706020a1a66954256053689a361b04c2fd","subject":"trusts, oauth1, app-creds: reject delegated tokens across all endpoints","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/aeea08706020a1a66954256053689a361b04c2fd"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-24 11:13:51.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 19:32:41.000000000","tz":120},"subject":"auth: reject delegated tokens from token-method reauthentication","message":"auth: reject delegated tokens from token-method reauthentication\n\ntoken_authenticate() unconditionally blocks trust-scoped and\nOAuth1-scoped tokens from creating another token via the token\nmethod, but application_credential tokens were only blocked from\nrequesting an explicit scope -- an omitted scope fell through to\nthe user\u0027s default-project scoping, letting an app-cred token\nbound to project A come back scoped to the user\u0027s default project\nB. ec2credential tokens matched no check at all, so they could\nrescope via an explicit scope to any project the underlying user\nhas a role on, not just a default-project fallback.\n\nBoth are the same root cause: application credentials and EC2\ncredentials are deliberately narrow, single-project grants, and the\n\"token\" method\u0027s rescoping logic never accounted for that, treating\nthem like a normal user session that\u0027s free to move between any of\nits own role assignments.\n\nBlock application_credential tokens from this path entirely,\nmatching trust/OAuth1, using the same shared\nkeystone.api._shared.delegation classification introduced by\nLP#2153453: any token whose methods aren\u0027t entirely primary auth\nmethods (built-in, or operator-registered via\n[auth] additional_primary_auth_methods) is rejected outright,\nincluding ec2credential and any future delegated method. An empty\ntoken.methods list (e.g. an ec2credential-derived token that lost its\nmethods on a fernet cache-miss round-trip) is also treated as\ndelegated, since issuperset([]) is True and would otherwise be\naccepted as \u0027all primary\u0027.\n\nCloses-Bug: #2158538\nChange-Id: Iadc104ae95d6c59484f29f62d6afe4a935bd8593\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nCo-developed-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/49baa3f9ed8f85aaab5c01499dde92841d5e320c"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/49baa3f9ed8f85aaab5c01499dde92841d5e320c"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY"},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}