)]}'
{"id":"openstack%2Fkeystone~1002304","triplet_id":"openstack%2Fkeystone~stable%2F2026.1~Iadc104ae95d6c59484f29f62d6afe4a935bd8593","project":"openstack/keystone","branch":"stable/2026.1","attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-08-25 16:39:09.000000000","reason":"A robot voted negatively on a label"}},"removed_from_attention_set":{},"hashtags":["CVE-2026-80184","OSSA-2026-037"],"change_id":"Iadc104ae95d6c59484f29f62d6afe4a935bd8593","subject":"auth: reject delegated tokens from token-method reauthentication","status":"NEW","created":"2026-08-25 14:49:42.000000000","updated":"2026-08-26 21:45:37.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":6,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"ab252a742bda355fe817de413713ff43edb14748","_number":1002304,"virtual_id_number":1002304,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:check","value":1,"date":"2026-08-26 21:45:37.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"CC":[{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-25 16:39:09.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-08-26 19:49:42.000000000","updated_by":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"reviewer":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"state":"CC"}],"messages":[{"id":"03388efc035dbef38bc6303515a704a0231b6878","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 14:49:42.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"1d2caac0698d3b8c4287f2ad386917dd9d1fc6c0","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 16:39:09.000000000","message":"Patch Set 1: Verified-1\n\n(5 comments)\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/e51ae0ce197d4da1a68fa9f396116f76\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/af033c6dc06640f98696cffc4ebf409a : SUCCESS in 16m 25s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/e8b622327d26420c93bc526fd81ba2f8 : FAILURE in 3m 52s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/ff16774599d5491d9179d63860efde0d : SUCCESS in 13m 25s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/f7724119b7a149b99991249b0804f879 : SUCCESS in 10m 52s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/69eaab8acdec4ab88e323529c3544fd6 : SUCCESS in 15m 45s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/ff423f3c06f242268e96cd29c765f532 : SUCCESS in 14m 02s\n- grenade https://zuul.opendev.org/t/openstack/build/fe4ea4b03c654d2ea7f32501d65d4400 : SUCCESS in 56m 54s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/f2e24a2381224546ac38f5d45449a061 : SUCCESS in 1h 42m 51s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/fee028c27ee4428a94c03460dc8ded4d : SUCCESS in 13m 27s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/3fe046a0975f4016a4383615b081a326 : SUCCESS in 10m 35s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/3895b6ecd83340b793f3064665381bda : SUCCESS in 34m 28s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/73385d6aa8084faaa1b10c1c5b520b8a : FAILURE in 8m 24s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/6911f444d347452aa169ed71d62aa0b5 : FAILURE in 29m 58s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/1be5812f8b4e4eceae7075419b3b3ef0 : SUCCESS in 15m 18s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/86c100fdeccb456e8e92a9599e2c3aba : SUCCESS in 31m 47s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/e760c54ddf144a3595afb7877a2190ee : SUCCESS in 39m 59s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/e1c1095bc4d948389248b09d276c98a2 : SUCCESS in 36m 59s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/534715f514bc4487853b42590a047f5c : FAILURE in 29m 28s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/215e37865b804b35afe21e56fc53680e : SUCCESS in 5m 22s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  Comments left for invalid file keystone/tests/unit/test_v3_trust.py","accounts_in_message":[],"_revision_number":1},{"id":"1ac08c7b7f8e282ebb73d7b3018bf5054bb21b5c","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-08-25 22:13:02.000000000","message":"Hashtags added: CVE-2026-80184, OSSA-2026-037","accounts_in_message":[],"_revision_number":1},{"id":"ca3b0f2d27bc1bb843172892f9c08549adb5d314","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 22:28:25.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"664c10ef39b17a661b645fc2d08cafba9b6f9e6e","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 23:56:14.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/3edb0ce48dc64660b2b5098d85c918b2\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/4bbd0b04764e44cb9f66c8e6c8590924 : SUCCESS in 12m 21s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/96319ee711cb44c6a76cebe2b7232acd : SUCCESS in 3m 33s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/9fd33c32750c44f7b6fe52688f37d265 : SUCCESS in 12m 28s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/50089fba62194e8ab2e63b0d41752c7c : SUCCESS in 12m 27s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/c0b638111a2d41c9ab1eb0d27a7282de : SUCCESS in 16m 20s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/72af7f66690f41179560ae493b2291fd : SUCCESS in 6m 50s\n- grenade https://zuul.opendev.org/t/openstack/build/b216ffdb6090464188f32680216f4a22 : SUCCESS in 1h 21m 43s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/08d5d747de0c4ca2ac106ef0b7ecf769 : SUCCESS in 58m 32s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/7e04ca0001b4429c8c772a49b72f523e : SUCCESS in 7m 41s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/f1721d6ed86a4b5bbf1dd5cd41d048af : SUCCESS in 11m 44s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/52177fba7d094607b942b54bfae05da3 : SUCCESS in 14m 58s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/e0c655766f794a248ccd42cf390838f9 : FAILURE in 9m 45s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/35472f318a514df38434561954ffa37f : FAILURE in 21m 49s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/6e3d8fbce4c94a75a7f7c25b367c4ee4 : SUCCESS in 14m 30s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/e2a8c381247f499a90749f48c5eb501e : SUCCESS in 26m 49s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/690d520682da42fe8798fa2bf1dcba6f : SUCCESS in 21m 46s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/3d0297bd565b466a8e1c9318be96309a : SUCCESS in 47m 41s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/c9d3067cc55a457790dd2f2251dd3db4 : FAILURE in 13m 25s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/285170fe5b9c40f9a45016765e3ecc31 : SUCCESS in 7m 49s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":2},{"id":"ad4efcb51cd058399b0c912b733b41adec606ad9","author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"date":"2026-08-26 19:49:42.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"ab252a742bda355fe817de413713ff43edb14748","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-26 21:45:37.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/3c8283f0643d4530b09a12a052d898b5\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/dff91acc76e341c4825de88ae75529aa : SUCCESS in 17m 49s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/c83887a6c4b24f2cade117ec35ed2668 : SUCCESS in 5m 25s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/82228d3788f44312928ec9c20572b67b : SUCCESS in 12m 29s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/b692d781d6004fb280613dff074f6539 : SUCCESS in 9m 34s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/8b785601457a441983375987b0ede310 : SUCCESS in 14m 50s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/56e0c15fc6af47458edbe8ec3c1f55f5 : SUCCESS in 15m 35s\n- grenade https://zuul.opendev.org/t/openstack/build/10518619a2c64872b821d440ffbad01a : SUCCESS in 34m 47s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/8d446a9f3b5948d3863f7c8c31fa935e : SUCCESS in 1h 49m 49s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/f3bc1ce3db074567893e0153e70597b3 : SUCCESS in 6m 33s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/00cbfea9c8ed4e8baf911f92514c4dff : SUCCESS in 19m 28s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/4e420888329b4d7cae244902b681ef27 : SUCCESS in 32m 34s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/1f0bebd568d444d7b9f471f0a283264f : FAILURE in 8m 36s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/74839a7d69b94cc5a9d83a48012af122 : FAILURE in 28m 05s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/df5ae9861fb9451bb782bddffc8dd329 : SUCCESS in 33m 29s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/219211b875624ed4bf44edb513c958c0 : SUCCESS in 30m 01s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/cf1ee5a994b2407dadf5fe07f4e197f2 : SUCCESS in 33m 23s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/b6fedc6aace24d4db497984972f3c2ca : SUCCESS in 52m 20s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/cf3bf6d4e60245009f2f85b16ee16c06 : SUCCESS in 19m 35s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/254452af742b4059a7ff93b07a6dd509 : SUCCESS in 7m 03s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"a054bfb0cc0d3087f2de4f0b18f27ef7da7d5ae9","revisions":{"3582ad099b7e72753c2f12599a26dce6d810106f":{"kind":"REWORK","_number":1,"created":"2026-08-25 14:49:42.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/04/1002304/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/04/1002304/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/1002304/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/1002304/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/1002304/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/04/1002304/1"}}},"commit":{"parents":[{"commit":"695056d21ff317e7ef6d4687b1d0ab2cafd38ceb","subject":"trusts, oauth1, app-creds: reject delegated tokens across all endpoints","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/695056d21ff317e7ef6d4687b1d0ab2cafd38ceb"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-24 11:13:51.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 14:48:07.000000000","tz":120},"subject":"auth: reject delegated tokens from token-method reauthentication","message":"auth: reject delegated tokens from token-method reauthentication\n\ntoken_authenticate() unconditionally blocks trust-scoped and\nOAuth1-scoped tokens from creating another token via the token\nmethod, but application_credential tokens were only blocked from\nrequesting an explicit scope -- an omitted scope fell through to\nthe user\u0027s default-project scoping, letting an app-cred token\nbound to project A come back scoped to the user\u0027s default project\nB. ec2credential tokens matched no check at all, so they could\nrescope via an explicit scope to any project the underlying user\nhas a role on, not just a default-project fallback.\n\nBoth are the same root cause: application credentials and EC2\ncredentials are deliberately narrow, single-project grants, and the\n\"token\" method\u0027s rescoping logic never accounted for that, treating\nthem like a normal user session that\u0027s free to move between any of\nits own role assignments.\n\nBlock application_credential tokens from this path entirely,\nmatching trust/OAuth1, using the same shared\nkeystone.api._shared.delegation classification introduced by\nLP#2153453: any token whose methods aren\u0027t entirely primary auth\nmethods (built-in, or operator-registered via\n[auth] additional_primary_auth_methods) is rejected outright,\nincluding ec2credential and any future delegated method. An empty\ntoken.methods list (e.g. an ec2credential-derived token that lost its\nmethods on a fernet cache-miss round-trip) is also treated as\ndelegated, since issuperset([]) is True and would otherwise be\naccepted as \u0027all primary\u0027.\n\nCloses-Bug: #2158538\nChange-Id: Iadc104ae95d6c59484f29f62d6afe4a935bd8593\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nCo-developed-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3582ad099b7e72753c2f12599a26dce6d810106f"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3582ad099b7e72753c2f12599a26dce6d810106f"}]},"branch":"refs/heads/stable/2026.1"},"a054bfb0cc0d3087f2de4f0b18f27ef7da7d5ae9":{"kind":"REWORK","_number":2,"created":"2026-08-25 22:28:25.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/04/1002304/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/04/1002304/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/1002304/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/1002304/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/04/1002304/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/04/1002304/2"}}},"commit":{"parents":[{"commit":"54c5a5f11e7e14c2fcc9f81568bcf471f71013fe","subject":"trusts, oauth1, app-creds: reject delegated tokens across all endpoints","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/54c5a5f11e7e14c2fcc9f81568bcf471f71013fe"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-24 11:13:51.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 22:26:59.000000000","tz":120},"subject":"auth: reject delegated tokens from token-method reauthentication","message":"auth: reject delegated tokens from token-method reauthentication\n\ntoken_authenticate() unconditionally blocks trust-scoped and\nOAuth1-scoped tokens from creating another token via the token\nmethod, but application_credential tokens were only blocked from\nrequesting an explicit scope -- an omitted scope fell through to\nthe user\u0027s default-project scoping, letting an app-cred token\nbound to project A come back scoped to the user\u0027s default project\nB. ec2credential tokens matched no check at all, so they could\nrescope via an explicit scope to any project the underlying user\nhas a role on, not just a default-project fallback.\n\nBoth are the same root cause: application credentials and EC2\ncredentials are deliberately narrow, single-project grants, and the\n\"token\" method\u0027s rescoping logic never accounted for that, treating\nthem like a normal user session that\u0027s free to move between any of\nits own role assignments.\n\nBlock application_credential tokens from this path entirely,\nmatching trust/OAuth1, using the same shared\nkeystone.api._shared.delegation classification introduced by\nLP#2153453: any token whose methods aren\u0027t entirely primary auth\nmethods (built-in, or operator-registered via\n[auth] additional_primary_auth_methods) is rejected outright,\nincluding ec2credential and any future delegated method. An empty\ntoken.methods list (e.g. an ec2credential-derived token that lost its\nmethods on a fernet cache-miss round-trip) is also treated as\ndelegated, since issuperset([]) is True and would otherwise be\naccepted as \u0027all primary\u0027.\n\nCloses-Bug: #2158538\nChange-Id: Iadc104ae95d6c59484f29f62d6afe4a935bd8593\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nCo-developed-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a054bfb0cc0d3087f2de4f0b18f27ef7da7d5ae9"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a054bfb0cc0d3087f2de4f0b18f27ef7da7d5ae9"}]},"branch":"refs/heads/stable/2026.1"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY"},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}