)]}'
{"id":"openstack%2Fkeystone~1002306","triplet_id":"openstack%2Fkeystone~stable%2F2025.2~Iadc104ae95d6c59484f29f62d6afe4a935bd8593","project":"openstack/keystone","branch":"stable/2025.2","attention_set":{},"removed_from_attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-08-31 13:18:07.000000000","reason":"Change was submitted"}},"hashtags":["CVE-2026-80184","OSSA-2026-037"],"change_id":"Iadc104ae95d6c59484f29f62d6afe4a935bd8593","subject":"auth: reject delegated tokens from token-method reauthentication","status":"MERGED","created":"2026-08-25 14:49:45.000000000","updated":"2026-08-31 13:20:13.000000000","submitted":"2026-08-31 13:18:07.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":5,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1002306","meta_rev_id":"0662ea441952433e31097c11f1b39356ead8da08","_number":1002306,"virtual_id_number":1002306,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-08-31 13:18:07.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":2,"date":"2026-08-31 11:11:17.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":1,"date":"2026-08-31 11:11:17.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-25 17:53:51.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-08-31 11:11:17.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"REVIEWER"}],"messages":[{"id":"698218322dd8b9b70198687b800aa56f55476be2","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 14:49:45.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"4a48e8427910e14133ef471b95a39b0477b2e45a","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 16:14:28.000000000","message":"Uploaded patch set 2: New patch set was added with same tree, parent tree, and commit message as Patch Set 1.","accounts_in_message":[],"_revision_number":2},{"id":"e5be77337089837920f0bab01b2ffb0fe046320d","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 17:53:51.000000000","message":"Patch Set 2: Verified-1\n\n(5 comments)\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/6372ca23b5ea4689aa2c1ac2f23afed5\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/343f93e621d94db1ab45281a5783476e : SUCCESS in 17m 53s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/127273c2321e451c992921a3bcaffeae : FAILURE in 7m 23s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/3a0fafe4e4d3488f8a2686bc7f6f0df7 : SUCCESS in 9m 37s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/982a723c8b3b41b5bf5098b91b9a0516 : SUCCESS in 13m 17s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/9240cac71051476187eea6675f9c4e3d : SUCCESS in 16m 35s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/65f0fff74acf482baf8769cc49726cf3 : SUCCESS in 9m 28s\n- grenade https://zuul.opendev.org/t/openstack/build/1f72484984cc4b17acb43af07f6b8fa8 : SUCCESS in 1h 04m 43s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/aa332af258794b0abb6af611509f34c6 : SUCCESS in 1h 01m 24s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/13811aae39cc46fb8e88a864ca94dd9b : SUCCESS in 8m 13s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/d43ec83e846b4be4a59d90b4ce52669e : POST_FAILURE in 7m 02s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/0945c23c0b944887aec6511d9866c48f : SUCCESS in 33m 05s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/ca480f32befb40eab2177cd21068d3d9 : FAILURE in 12m 35s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/2e0d03c57ea14abfa828748156d4cd35 : FAILURE in 19m 54s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/56e9788d6b7e417eb054d81e491406dd : SUCCESS in 32m 15s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/8a2cc45bcefb4481b8553d23b08a84b6 : SUCCESS in 35m 26s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/ea228c00c1494309a7ee7fd5517c786a : FAILURE in 8m 50s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/4540487761a9426481e347170ff88910 : SUCCESS in 1h 00m 07s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/e17cd3716a5b4b5d847dfb0eede143a7 : FAILURE in 15m 10s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/a0020c34941f4d85bafc90f0775512e5 : FAILURE in 9m 06s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  Comments left for invalid file keystone/tests/unit/test_v3_trust.py","accounts_in_message":[],"_revision_number":2},{"id":"f6febd7a7be8fac35d39e8a4c98185ad639f82e2","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-08-25 22:13:02.000000000","message":"Hashtags added: CVE-2026-80184, OSSA-2026-037","accounts_in_message":[],"_revision_number":2},{"id":"cfc44aee52de5bfef3827c81c682a671205c7aef","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 22:43:33.000000000","message":"Uploaded patch set 3.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":3},{"id":"7d4a4da7cbd08b79fa5e20809e30e1005d154157","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-26 00:44:04.000000000","message":"Patch Set 3: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/0d96e749b3cf4895930555fc5f985d8b\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/80003da5d5704046af151e4432f199c4 : SUCCESS in 21m 51s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/840ca6010994400bb94e25bee1d596c6 : SUCCESS in 8m 41s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/3c13a70534db4f4cad15a645ed28c15f : SUCCESS in 12m 04s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/3c46492e4d974f8ca6e6819824afebcd : SUCCESS in 12m 26s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/ca1309929dfa4d6c8d6217555a8fb330 : SUCCESS in 18m 14s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/948d55529ee24350998a45e20e83cc34 : SUCCESS in 12m 38s\n- grenade https://zuul.opendev.org/t/openstack/build/af283c8334f64547b481d8ba598ca890 : SUCCESS in 49m 31s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/d1daf9e78a004646937058ced3eb1422 : SUCCESS in 1h 49m 04s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/8d974c6e23364707a26fb210435e1c54 : SUCCESS in 10m 23s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/f5cb769fc8974091922effb3b5469527 : SUCCESS in 21m 57s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/fe15d8f634fe453babb399eb6d8cc333 : SUCCESS in 14m 49s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/bd9fcf42268f48b4a32fdaed640fd978 : FAILURE in 17m 58s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/06573f9899ba4fcdab5e3487d887cf37 : FAILURE in 19m 11s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/8409c7071a01416eb67a3c50d324a51b : SUCCESS in 15m 35s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/066220e31bb542fbac7fcc1b29db6ca2 : SUCCESS in 22m 36s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/c28a51d288664e98a114ca5f56b65e7b : SUCCESS in 31m 05s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/addfb2e23f244629af7f99a679cb2485 : SUCCESS in 46m 33s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/ad873777f4504108a7a09ed47cdbf334 : FAILURE in 29m 51s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/89914e27ec2b4708af668dfafd4ea4c0 : FAILURE in 10m 20s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":3},{"id":"63506e4eb14cef9a19789529bd23a034aec00eea","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-27 11:48:26.000000000","message":"Patch Set 3:\n\nrecheck - protection-functional skip fixed by 1002440 (merged)","accounts_in_message":[],"_revision_number":3},{"id":"d77a3d21b20ed2412317cc95537f3ff0705d7bfa","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-27 13:53:46.000000000","message":"Patch Set 3: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/d3bfa56d801b4f12a72e7f8619a699ff\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/ae8c015ba424495ea061201762f0e388 : SUCCESS in 19m 18s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/b8eee67325f445b2b4f6112fe0c80204 : SUCCESS in 4m 07s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/2bc7ea904af54ca3bced7cfd0011f1ef : SUCCESS in 12m 39s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/6c7421e8b3f340bdac58d057adc19dba : SUCCESS in 15m 07s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/5c61d3d455144a25a99e949852eaf612 : SUCCESS in 9m 42s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/dfeaa54f8cd64c2ea5f83c21011f20e8 : SUCCESS in 15m 41s\n- grenade https://zuul.opendev.org/t/openstack/build/fd41e83dbf094d198645c9ac8adb2893 : SUCCESS in 1h 08m 38s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/976dbe3f15cc46cebd71dcae6e9390f2 : SUCCESS in 1h 58m 21s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/8fbf46fac1684da881cf43f3b9bdc68d : SUCCESS in 5m 30s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/f23cbf13e665450db208c524ceb24e5e : SUCCESS in 10m 05s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/e30d1e44bd3346938c1435538418134d : SUCCESS in 13m 59s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/0da4f9a099094d9ead8f2e674fab46d7 : FAILURE in 19m 48s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/17681110f67b4ab29e1d672bfd1f1c9e : FAILURE in 28m 21s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/c638d889dbb64815a843f9216c8e6a68 : SUCCESS in 32m 37s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/e670683af31449e09c4665fbe8c00417 : SUCCESS in 25m 51s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/5606e11fe96541089f8a5d872235233f : SUCCESS in 22m 09s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/30a4607d09864b32bda7af70f2513df2 : SUCCESS in 52m 26s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/538d532736db4f2486ca882fa23c7db6 : SUCCESS in 45m 09s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/de8eca171fb546a6b11a03a82d8bc82e : FAILURE in 7m 43s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":3},{"id":"1267b44d1431b52733bf89241faf50344309d96d","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-08-31 11:11:17.000000000","message":"Patch Set 3: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":3},{"id":"c2400a5c7fbb387f937db9e9a3d5f8cb2219408b","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 11:11:49.000000000","message":"Patch Set 3: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":3},{"id":"32bc8c7c4bcfdafcb04553b5375cdcb691a60ff6","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 13:18:07.000000000","message":"Patch Set 3: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/4f44cacd2bf6401b8e683759fe773786\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/93c52898121c4e0bbe559a92fa6babe8 : SUCCESS in 4m 16s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/c3cc43f6cda647ccaeb9936faea9e7a9 : SUCCESS in 10m 39s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/62aa6faa26a44da7a46e7a61718c4f78 : SUCCESS in 7m 45s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/e8a419bef0b84d7383ad01afd0b76c8f : SUCCESS in 10m 34s\n- grenade https://zuul.opendev.org/t/openstack/build/c5e1e3a3b6ce465185d4b38b6ab629c0 : SUCCESS in 31m 05s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/4fd4b19a489a41e794a30efafd6ed280 : SUCCESS in 1h 47m 04s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/a11b0a47ac82405cbb4957b53090f33c : SUCCESS in 10m 36s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/f854f759632c4823a2d4cd548a163ffa : SUCCESS in 29m 32s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/6fc1b9ea291b4d44b4840239540a6d7c : SUCCESS in 16m 02s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/2960715e60c448ef903296526ec19b0b : SUCCESS in 44m 08s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/fe62ec18ba2c4a528d0cb3dec2973b63 : SUCCESS in 44m 07s","accounts_in_message":[],"_revision_number":3},{"id":"3253197ff2514e7f73c038f72e5b3aaa410f337c","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 13:18:07.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":3},{"id":"0662ea441952433e31097c11f1b39356ead8da08","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 13:20:13.000000000","message":"Patch Set 3:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/54e02a57b1b34bb1af27cf6ba99c6d26\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/f3f0e84b354e4aa89133a5aae9797b2f : SUCCESS in 1m 29s\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/59a9cadeb184481a981670f281bbef97 : SUCCESS in 1m 30s","accounts_in_message":[],"_revision_number":3}],"current_revision_number":3,"current_revision":"384eb6f83d0b6423e61001fdc7466220fc406dda","revisions":{"d469e099b75bf05114f5e7f15a9032694d55d19b":{"kind":"REWORK","_number":1,"created":"2026-08-25 14:49:45.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/06/1002306/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/06/1002306/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/06/1002306/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/06/1002306/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/06/1002306/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/06/1002306/1"}}},"commit":{"parents":[{"commit":"3ab7f1eebf9d3980a3e56ef3c1321c140a7f55df","subject":"trusts, oauth1, app-creds: reject delegated tokens across all endpoints","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3ab7f1eebf9d3980a3e56ef3c1321c140a7f55df"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-24 11:13:51.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 14:48:07.000000000","tz":120},"subject":"auth: reject delegated tokens from token-method reauthentication","message":"auth: reject delegated tokens from token-method reauthentication\n\ntoken_authenticate() unconditionally blocks trust-scoped and\nOAuth1-scoped tokens from creating another token via the token\nmethod, but application_credential tokens were only blocked from\nrequesting an explicit scope -- an omitted scope fell through to\nthe user\u0027s default-project scoping, letting an app-cred token\nbound to project A come back scoped to the user\u0027s default project\nB. ec2credential tokens matched no check at all, so they could\nrescope via an explicit scope to any project the underlying user\nhas a role on, not just a default-project fallback.\n\nBoth are the same root cause: application credentials and EC2\ncredentials are deliberately narrow, single-project grants, and the\n\"token\" method\u0027s rescoping logic never accounted for that, treating\nthem like a normal user session that\u0027s free to move between any of\nits own role assignments.\n\nBlock application_credential tokens from this path entirely,\nmatching trust/OAuth1, using the same shared\nkeystone.api._shared.delegation classification introduced by\nLP#2153453: any token whose methods aren\u0027t entirely primary auth\nmethods (built-in, or operator-registered via\n[auth] additional_primary_auth_methods) is rejected outright,\nincluding ec2credential and any future delegated method. An empty\ntoken.methods list (e.g. an ec2credential-derived token that lost its\nmethods on a fernet cache-miss round-trip) is also treated as\ndelegated, since issuperset([]) is True and would otherwise be\naccepted as \u0027all primary\u0027.\n\nCloses-Bug: #2158538\nChange-Id: Iadc104ae95d6c59484f29f62d6afe4a935bd8593\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nCo-developed-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/d469e099b75bf05114f5e7f15a9032694d55d19b"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/d469e099b75bf05114f5e7f15a9032694d55d19b"}]},"branch":"refs/heads/stable/2025.2"},"71749bdc725f9c3d2e3135da0fc3492e88e71f41":{"kind":"NO_CHANGE","_number":2,"created":"2026-08-25 16:14:28.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/06/1002306/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/06/1002306/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/06/1002306/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/06/1002306/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/06/1002306/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/06/1002306/2"}}},"commit":{"parents":[{"commit":"b33744c4facad53aaa3aaf68655ef95e72a0c034","subject":"trusts, oauth1, app-creds: reject delegated tokens across all endpoints","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/b33744c4facad53aaa3aaf68655ef95e72a0c034"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-24 11:13:51.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 16:11:45.000000000","tz":120},"subject":"auth: reject delegated tokens from token-method reauthentication","message":"auth: reject delegated tokens from token-method reauthentication\n\ntoken_authenticate() unconditionally blocks trust-scoped and\nOAuth1-scoped tokens from creating another token via the token\nmethod, but application_credential tokens were only blocked from\nrequesting an explicit scope -- an omitted scope fell through to\nthe user\u0027s default-project scoping, letting an app-cred token\nbound to project A come back scoped to the user\u0027s default project\nB. ec2credential tokens matched no check at all, so they could\nrescope via an explicit scope to any project the underlying user\nhas a role on, not just a default-project fallback.\n\nBoth are the same root cause: application credentials and EC2\ncredentials are deliberately narrow, single-project grants, and the\n\"token\" method\u0027s rescoping logic never accounted for that, treating\nthem like a normal user session that\u0027s free to move between any of\nits own role assignments.\n\nBlock application_credential tokens from this path entirely,\nmatching trust/OAuth1, using the same shared\nkeystone.api._shared.delegation classification introduced by\nLP#2153453: any token whose methods aren\u0027t entirely primary auth\nmethods (built-in, or operator-registered via\n[auth] additional_primary_auth_methods) is rejected outright,\nincluding ec2credential and any future delegated method. An empty\ntoken.methods list (e.g. an ec2credential-derived token that lost its\nmethods on a fernet cache-miss round-trip) is also treated as\ndelegated, since issuperset([]) is True and would otherwise be\naccepted as \u0027all primary\u0027.\n\nCloses-Bug: #2158538\nChange-Id: Iadc104ae95d6c59484f29f62d6afe4a935bd8593\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nCo-developed-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/71749bdc725f9c3d2e3135da0fc3492e88e71f41"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/71749bdc725f9c3d2e3135da0fc3492e88e71f41"}]},"branch":"refs/heads/stable/2025.2"},"384eb6f83d0b6423e61001fdc7466220fc406dda":{"kind":"REWORK","_number":3,"created":"2026-08-25 22:43:33.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/06/1002306/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/06/1002306/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/06/1002306/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/06/1002306/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/06/1002306/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/06/1002306/3"}}},"commit":{"parents":[{"commit":"8bdd432cf230af7eaccc8f03fe2ba98df44f2a84","subject":"trusts, oauth1, app-creds: reject delegated tokens across all endpoints","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/8bdd432cf230af7eaccc8f03fe2ba98df44f2a84"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-24 11:13:51.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 22:29:44.000000000","tz":120},"subject":"auth: reject delegated tokens from token-method reauthentication","message":"auth: reject delegated tokens from token-method reauthentication\n\ntoken_authenticate() unconditionally blocks trust-scoped and\nOAuth1-scoped tokens from creating another token via the token\nmethod, but application_credential tokens were only blocked from\nrequesting an explicit scope -- an omitted scope fell through to\nthe user\u0027s default-project scoping, letting an app-cred token\nbound to project A come back scoped to the user\u0027s default project\nB. ec2credential tokens matched no check at all, so they could\nrescope via an explicit scope to any project the underlying user\nhas a role on, not just a default-project fallback.\n\nBoth are the same root cause: application credentials and EC2\ncredentials are deliberately narrow, single-project grants, and the\n\"token\" method\u0027s rescoping logic never accounted for that, treating\nthem like a normal user session that\u0027s free to move between any of\nits own role assignments.\n\nBlock application_credential tokens from this path entirely,\nmatching trust/OAuth1, using the same shared\nkeystone.api._shared.delegation classification introduced by\nLP#2153453: any token whose methods aren\u0027t entirely primary auth\nmethods (built-in, or operator-registered via\n[auth] additional_primary_auth_methods) is rejected outright,\nincluding ec2credential and any future delegated method. An empty\ntoken.methods list (e.g. an ec2credential-derived token that lost its\nmethods on a fernet cache-miss round-trip) is also treated as\ndelegated, since issuperset([]) is True and would otherwise be\naccepted as \u0027all primary\u0027.\n\nCloses-Bug: #2158538\nChange-Id: Iadc104ae95d6c59484f29f62d6afe4a935bd8593\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nCo-developed-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/384eb6f83d0b6423e61001fdc7466220fc406dda"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/384eb6f83d0b6423e61001fdc7466220fc406dda"}]},"branch":"refs/heads/stable/2025.2"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}