)]}'
{"id":"openstack%2Fkeystone~1002322","triplet_id":"openstack%2Fkeystone~stable%2F2025.2~I4dd5817d20394369cfadd20ccf476a0660760c52","project":"openstack/keystone","branch":"stable/2025.2","attention_set":{},"removed_from_attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-09-01 09:41:44.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"I4dd5817d20394369cfadd20ccf476a0660760c52","subject":"Ban ec2credential tokens from Keystone API","status":"MERGED","created":"2026-08-25 15:22:01.000000000","updated":"2026-09-01 09:43:15.000000000","submitted":"2026-09-01 09:41:44.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":4,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1002322","cherry_pick_of_change":1002082,"cherry_pick_of_patch_set":3,"meta_rev_id":"b9216e2fb49465b6897624d345806ef73d5d70ef","_number":1002322,"virtual_id_number":1002322,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-09-01 09:41:44.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":2,"date":"2026-08-31 11:50:16.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":1,"date":"2026-08-31 11:50:16.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"CC":[{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-25 15:22:01.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"CC"},{"updated":"2026-08-25 18:42:36.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-08-31 11:50:16.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"REVIEWER"},{"updated":"2026-08-31 17:16:12.000000000","updated_by":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"reviewer":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"state":"CC"}],"messages":[{"id":"e3688e0f65425294deffa02d55b0878e116c3984","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 15:22:01.000000000","message":"Patch Set 1: Cherry Picked from branch stable/2026.1.","accounts_in_message":[],"_revision_number":1},{"id":"4073ebf59f51dadec565c8d681981ae20840c74e","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 16:14:28.000000000","message":"Uploaded patch set 2.","accounts_in_message":[],"_revision_number":2},{"id":"15ee1be5376d5b886d52a1df33f558c8d7376b37","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 18:42:36.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/92b0c484165a4f8a85cbc8af7597e032\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/43cebe931f324efaaba97be160b65de2 : FAILURE in 18m 55s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/27266632d1d5426c8ccc7a152c21a66d : FAILURE in 7m 07s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/ca5bb8eb65854a6da213aaec361fedc9 : FAILURE in 11m 31s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/b2c32c5a7e3d4cbfb77d9e27b72e2ca1 : FAILURE in 14m 21s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/fc45e10558734159a1aae79f5b25dbfa : FAILURE in 16m 15s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/968d412e90e24d00a98c305e59dc9bff : SUCCESS in 14m 57s\n- grenade https://zuul.opendev.org/t/openstack/build/43efcb86d2a04ba280da86071c858540 : SUCCESS in 1h 04m 12s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/f9cb359546e940849f107eb942e07fd9 : SUCCESS in 1h 37m 45s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/2d5049de43c94e4ab5cf964d85e8a4a8 : SUCCESS in 13m 50s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/a032b541cb85416291af8fa6a0113f80 : SUCCESS in 18m 26s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/8d86614ea5c5497b9fda90cddb480559 : SUCCESS in 19m 29s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/4df77b6a54394de89e3b0a99befc69c9 : FAILURE in 10m 11s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/9affdca09ee14845bb54f91a4c01d974 : FAILURE in 27m 02s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/47d2db2d39dd466f8bda19715c5a750a : SUCCESS in 30m 51s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/471fbb0af63e4e03ba09d5a69561a3fb : SUCCESS in 33m 29s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/9e9ab471ca7c44f8b5ea8330fd6c0cad : SUCCESS in 35m 31s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/f85afbe34ee34605b78a8af218ab8142 : SUCCESS in 39m 22s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/162938293f364619b82dafa85519f5e1 : FAILURE in 22m 19s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/70f5d19c778a47bea87b70ac10194d7b : FAILURE in 8m 12s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  Comments left for invalid file keystone/tests/unit/test_v3_auth.py\n  Comments left for invalid file keystone/tests/unit/test_v3_trust.py","accounts_in_message":[],"_revision_number":2},{"id":"f65a291a2d03039be709c4fcc72a01249d7d8939","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 22:43:33.000000000","message":"Uploaded patch set 3.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":3},{"id":"cc12c2a7bbc41d9526e1be21e0531e49dda1cbc8","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-26 00:44:05.000000000","message":"Patch Set 3: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/f5a79bdc36564e9085063cbb2628f91b\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/25c4dd75f0a541d1b428fd12cfbbdf93 : SUCCESS in 18m 05s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/1965c3a0df3c4e92b55110ca43229cbb : SUCCESS in 9m 12s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/b27857f044bd4d638de7f938075b7a65 : SUCCESS in 14m 06s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/afa12fa546694d0fb4cf0a91d531d971 : SUCCESS in 15m 53s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/2992722977634433a41d44624c23d0e5 : SUCCESS in 17m 40s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/8b89885fd16f4916af0ec8de09a5c65f : SUCCESS in 16m 06s\n- grenade https://zuul.opendev.org/t/openstack/build/8f820452d1a844ac8d9b6e59e799ad9e : SUCCESS in 1h 00m 51s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/49523011ce874ff8b487037afeca1208 : SUCCESS in 1h 36m 19s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/5e241d2171da45388cde90cba36c2e04 : SUCCESS in 9m 05s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/d9ba9b884313459fa29146c7dddd868c : SUCCESS in 15m 28s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/a3b17fabdfd94517a51478103c457103 : SUCCESS in 29m 42s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/ddaf54900db74ea89b93c94d4d5452e3 : FAILURE in 9m 01s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/a098ab60fd804a6f956dc98063d95afb : FAILURE in 32m 02s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/47fc49ca50174de58cf8bb3cda9d1136 : SUCCESS in 22m 20s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/8e371df7ea284d2b9e0ad10913e5f22d : SUCCESS in 24m 28s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/c4943f7c7bbc4cf8876393e60addd028 : SUCCESS in 30m 08s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/ceb5d182fc90458191cb21df30959d2d : SUCCESS in 49m 20s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/0c948f3c2e054c3dac2b2d3fe9202b21 : FAILURE in 18m 53s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/53a319258a554d34a0b936dd2bc0ae90 : FAILURE in 6m 06s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":3},{"id":"6838ff307999c755d8bd332dfdc745aa31c4d1a3","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-27 11:48:28.000000000","message":"Patch Set 3:\n\nrecheck - protection-functional skip fixed by 1002440 (merged)","accounts_in_message":[],"_revision_number":3},{"id":"b8681b8325f7efad88db6b32545f47bdbeeac6c6","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-27 13:07:10.000000000","message":"Patch Set 3: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/ae4dcdcc6973470fa60cf80c239174fa\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/54f312e453f548e8b6aa2d3bac21fe9e : SUCCESS in 18m 29s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/515a455fc4154d419429d0ee5f92a14e : SUCCESS in 6m 44s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/811c5920c0b34d3f969d358eec3a9c67 : SUCCESS in 9m 04s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/5652187bb41541f4b3e52945a0da4e9b : SUCCESS in 12m 36s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/4ee226ecab744ffd9f898ea333851ecf : SUCCESS in 11m 40s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/e3486a838c674a799bd9af267515ce84 : SUCCESS in 15m 50s\n- grenade https://zuul.opendev.org/t/openstack/build/9e14eefca6744c2480810d07dc1cc26e : SUCCESS in 1h 11m 09s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/7683771b2d2e41d4a53927c055af6e03 : SUCCESS in 1h 00m 27s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/4f4b074fe66c45198613478b8ad11581 : SUCCESS in 13m 54s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/b1c32f6d9c364373b5a4b1125bb41b11 : SUCCESS in 15m 29s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/a606524d8a574fb2b355c360451bde95 : SUCCESS in 28m 32s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/ff076e35ebbc4d27905a2a57b4c5eb64 : FAILURE in 11m 51s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/b7eda870fd6345e4a963bc4172f86a3e : FAILURE in 30m 38s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/4ad14a70838b4aabbefd16bc66dd0656 : SUCCESS in 31m 25s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/52d7564a4d76432a9779eeb44cbc9ed4 : SUCCESS in 32m 36s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/5051f6f5ddbc4560904cc26650703c66 : SUCCESS in 45m 16s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/65c633b248794fada753603b52d55bae : SUCCESS in 31m 30s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/4134cddf4a1f4ddcb5e1c8e795c77d2f : SUCCESS in 41m 28s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/6d33ad0502a0496e84c26908b650d71d : FAILURE in 7m 56s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":3},{"id":"09b5123224c5ec986accd0b01977898a0bdcca98","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-08-31 11:50:16.000000000","message":"Patch Set 3: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":3},{"id":"2d4b647b089432374a97bb6ac3d313961d617bab","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 11:50:47.000000000","message":"Patch Set 3: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":3},{"id":"ab802c35c9486f1377b3072eecc605066067af81","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 13:30:13.000000000","message":"Patch Set 3: Verified-2\n\nBuild failed (gate pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\nhttps://zuul.opendev.org/t/openstack/buildset/d0d4cdcc574a4596ae82034c3c9c294a\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/2661a4e7a5d84c568dbc126193cab5a7 : SUCCESS in 6m 43s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/bcc4a1f1483c4a91ba2f8ec68c8aee4d : SUCCESS in 9m 13s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/d15439fefa6a4a01b5eacd8df12d5921 : SUCCESS in 12m 12s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/976e10edbae3429f9eb55801ebf76614 : SUCCESS in 14m 44s\n- grenade https://zuul.opendev.org/t/openstack/build/56cdd15dc0af4d019004e743c8cf0992 : SUCCESS in 1h 05m 37s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/526cb8c2228c408ea31e2aceca7072be : POST_FAILURE in 8m 33s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/38607a9699564017a3fd01b6b9adfa85 : SUCCESS in 13m 18s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/42750e8800ed4409b5870d7d26a6893c : SUCCESS in 28m 57s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/dad6f53a939749969185d741d10cf22b : SUCCESS in 18m 34s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/16cb67703f0243b8b428805d99782d2f : SUCCESS in 31m 16s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/22b8cdaf4d704f718a014e4e5dabef99 : SUCCESS in 39m 44s","accounts_in_message":[],"_revision_number":3},{"id":"841b1e3acd6989bc3ddaba22de80f39013e9885f","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-08-31 13:47:28.000000000","message":"Patch Set 3:\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"94f17fb3fdb41d54ed02629ef1c1523283e17248","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 15:35:07.000000000","message":"Patch Set 3: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/8a96f06b484c4b689f1e6e914fbb81ab\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/3ecaf4c15e204ad08f04c9d5ec6599cc : SUCCESS in 18m 24s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/d4e9c41be9484e47bae8f945a1e72925 : SUCCESS in 7m 19s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/8bc27424b84d4709b540ac47d0da7892 : SUCCESS in 8m 47s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/b5da2cd025044abbb955cf12eb22211e : SUCCESS in 14m 01s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/402ff095403941ffa86c2957b8853cbb : SUCCESS in 16m 40s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/2e18df5b150748b79daf1b8d910eb942 : SUCCESS in 14m 14s\n- grenade https://zuul.opendev.org/t/openstack/build/3ad5ff9e58c04bc599efc13fe08b44c9 : SUCCESS in 1h 05m 48s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/a5b39015971e47ff8eb1cc6487e971ae : SUCCESS in 1h 14m 46s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/868bfa92968f42919c9af005fee3c1d8 : SUCCESS in 10m 57s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/c4b4c9df73b84884b72ac347180d2693 : SUCCESS in 9m 49s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/35be9e92a0224b049a3bfab1a91da9b1 : SUCCESS in 21m 44s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/443e89202b3542cd9ac09d2eb40d8aca : FAILURE in 19m 35s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/f07922fb12c142caae59ed94f3e00e7e : FAILURE in 9m 48s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/a52384c2fd4c40edb4ac2748e0f9a256 : SUCCESS in 16m 53s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/966bc596d2c742998b3d3688ea30dbde : SUCCESS in 21m 54s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/de62106513a6411096552422f6652363 : SUCCESS in 34m 59s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/b12bee94ba014cd79b759f93b2e27a10 : SUCCESS in 1h 07m 08s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/73aa40a9680143fca07f7711053bf810 : FAILURE in 46m 28s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/8e9e95baf42e4861b23417a81a1c963e : FAILURE in 10m 03s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":3},{"id":"87a82b17fba9557422bd0c25c70a89cc6fe89b58","author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"date":"2026-08-31 17:16:12.000000000","message":"Patch Set 3:\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"ea87ae351fb2c4f7bb99048883a0280dd6175ee7","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 19:12:02.000000000","message":"Patch Set 3: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/1cfa9ecbac274b4fbd5e34bdbc12dbb7\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/6c4c20623e924fbab412db2e90d9528b : SUCCESS in 18m 15s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/9e33b3f79b6a493c8c39a0266fd2c9f9 : SUCCESS in 6m 55s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/b0bd03df3c0a4a69acb528a5ff07d068 : SUCCESS in 15m 03s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/9ae4cae65f1c4246ac6f632c1c2ddedf : SUCCESS in 12m 32s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/038d48093b334badaa1847399c47207b : SUCCESS in 14m 24s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/a4a9ed833c174cad80b1b1b6f50968f1 : SUCCESS in 14m 02s\n- grenade https://zuul.opendev.org/t/openstack/build/e576ae5c20cf4592b4e382c7c9251815 : SUCCESS in 46m 59s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/28ee4788cf634876b2bfe0a7a978fcdb : SUCCESS in 1h 49m 04s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/e3c088e79b404f858956b259aad63794 : SUCCESS in 16m 38s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/f911c14c4d74495faf84ba472c33e297 : SUCCESS in 19m 32s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/5f1b4117f5e043139885afb7b48d0ab2 : SUCCESS in 30m 48s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/96b062179844491a9f50c7863b9f6802 : FAILURE in 9m 40s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/98388a8ca9914f5bbd2e1db3fc99acf0 : FAILURE in 31m 12s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/8e3dadc020884f7088e94f60e1f9cc7e : SUCCESS in 34m 18s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/fedfa9ee3e124c9291bea5d1aa9e8441 : SUCCESS in 18m 07s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/2a5d574d1344460b8d5bb8543960d059 : SUCCESS in 41m 29s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/9b9ec79cfea34636a8b36ab5a51e215b : SUCCESS in 1h 07m 18s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/b88ef1f15ca54ad3bbeae9cd0bdce5e8 : SUCCESS in 47m 41s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/4bc2e24fc57b4a7083f523daf5b391d8 : FAILURE in 8m 22s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":3},{"id":"fa4e66fa784d2a96a550b418f308da582ecdd5ed","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 19:12:27.000000000","message":"Patch Set 3: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":3},{"id":"6453f39bd25a727ef5262597fdbb0552f3ebcce6","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 21:04:08.000000000","message":"Patch Set 3: Verified-2\n\nBuild failed (gate pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\nhttps://zuul.opendev.org/t/openstack/buildset/f761389951284d5790d3bbe496a37f37\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/2a6b3969dcc5458ca54301d65a8e6710 : SUCCESS in 7m 05s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/97b81856f6894a4284ccc3e7b9063e0a : SUCCESS in 14m 40s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/1ca3dba229774268a2a015a4b8a45746 : SUCCESS in 12m 47s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/71c42513f33d420fbdcb41213bb32d87 : SUCCESS in 14m 40s\n- grenade https://zuul.opendev.org/t/openstack/build/280aae97e09b4c4da1f85320f50e8dbb : SUCCESS in 1h 04m 38s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/66543234ef334a68b31602c0ff4a7f77 : SUCCESS in 1h 46m 58s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/2c9ae3e9cd5948c2b1b779f4ca467f2f : SUCCESS in 11m 41s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/6423603519354ceea1e52a32fadea2de : SUCCESS in 32m 55s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/2d101768433b41539f62a2c3915260df : SUCCESS in 30m 38s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/64c81ff9b35c4e8d9232de1b85015fc1 : SUCCESS in 31m 23s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/5ada4b06ead049a9a4b4f41c41fb6917 : FAILURE in 19m 38s","accounts_in_message":[],"_revision_number":3},{"id":"50232637af24ed74448679d26272326678876518","author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"date":"2026-09-01 05:57:38.000000000","message":"Patch Set 3:\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"465d21eff3207f5b53d99a21084f64c0a699e801","author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"date":"2026-09-01 05:58:06.000000000","message":"Patch Set 3:\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"de2c8219c6979e7a2ed9f7e858433b309e19168e","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-01 07:48:46.000000000","message":"Patch Set 3: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/b6300f76380142e6822e0d3c894ae782\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/294846a64a8449079753fd8e2908797e : SUCCESS in 15m 10s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/57d3e95c9c844cd28fdaa94513d3e32b : SUCCESS in 6m 33s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/19ef951f73fe4c2fb074375eef0fa54e : SUCCESS in 7m 35s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/fb618cd9531945ad9a61215775e2aa1a : SUCCESS in 12m 56s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/67b5e0395f4346f2b8712f6742cdc42f : SUCCESS in 16m 32s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/34c321a7e9604d05830ae5a697187fa4 : SUCCESS in 12m 47s\n- grenade https://zuul.opendev.org/t/openstack/build/fa02ff374539425086c9771ba5745259 : SUCCESS in 55m 15s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/3963cbadb92b4158bab39b0569a8d355 : SUCCESS in 1h 43m 04s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/e3e3228d73cd4cb8acea772ba273ec0d : SUCCESS in 12m 42s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/ceffe8060b914f448dbdbec7d5108de1 : SUCCESS in 18m 44s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/143d9907eed64838a997dfea234a7fa2 : SUCCESS in 13m 57s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/5fbc152a58db472b8ee5d3c13cc51a9c : FAILURE in 16m 30s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/fe7ae7d5842548d0ba07f4eb6a8f8d49 : FAILURE in 20m 55s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/61da23f9b6b94b1da64aaf9180bc7c1c : SUCCESS in 18m 40s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/be219a8c24954ee0bb149be75a5e7c66 : SUCCESS in 35m 20s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/d51797670ae64c51bf3723f65f3cb5e2 : SUCCESS in 33m 41s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/4f83e75509c54398a553cb6c3805b7fe : SUCCESS in 52m 58s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/a63c695da856467ead0982e34e90241a : SUCCESS in 32m 32s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/9f5f0213929f43e798fef0f15b415a32 : FAILURE in 7m 06s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":3},{"id":"3c0ab0e5f55126d3d67b9da04e5ec3b7c666203d","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-01 07:49:07.000000000","message":"Patch Set 3: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":3},{"id":"6ce4a04c715b5b1017a8dfc32a0e54a5957792bd","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-01 09:41:44.000000000","message":"Patch Set 3: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/2122a7c8b1e84dc7995ae2c897cda813\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/c546500c960d4270bec67a6e43444b89 : SUCCESS in 6m 33s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/b59c0752b521493f8cf7798d8baffb7a : SUCCESS in 16m 36s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/66b28712d5ca491e81810df70e03a671 : SUCCESS in 13m 27s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/8aa225757cb74e1998f7300c3e4dda32 : SUCCESS in 13m 42s\n- grenade https://zuul.opendev.org/t/openstack/build/04fbb5f111994e059d6f1f2f314a550f : SUCCESS in 30m 14s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/5ac8f5a03f46415b8e875ec0acf800b2 : SUCCESS in 1h 47m 46s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/f038e19a16ef479bb9d4ebc389ce81ae : SUCCESS in 6m 00s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/6fd389f363d143c0a5655069a9a6d9e0 : SUCCESS in 31m 22s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/33c70282c6084ba5bdbc97429142d52d : SUCCESS in 31m 21s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/b0c63df296d8462e914c2ab4e40e6ec8 : SUCCESS in 1h 03m 30s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/7f6eb58013ac44e2bf446b07ebea6dcd : SUCCESS in 21m 57s","accounts_in_message":[],"_revision_number":3},{"id":"fa500715b8ff9f4adac9c3bac6a636adb0ca65ae","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-01 09:41:44.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":3},{"id":"b9216e2fb49465b6897624d345806ef73d5d70ef","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-01 09:43:15.000000000","message":"Patch Set 3:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/966f80add13b438e9fb4283ed24a6e48\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/1e7b96d864d94c28b7ccac6ce79650fc : SUCCESS in 1m 04s\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/cad1d45218e544e89bb514b2e312ef26 : SUCCESS in 45s","accounts_in_message":[],"_revision_number":3}],"current_revision_number":3,"current_revision":"547f996ae67200b05ae75c998eb4f1f3fe3c3190","revisions":{"2775076270b223c9e10d208f5495efd22e96362d":{"kind":"REWORK","_number":1,"created":"2026-08-25 15:22:01.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/22/1002322/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/22/1002322/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/22/1002322/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/22/1002322/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/22/1002322/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/22/1002322/1"}}},"commit":{"parents":[{"commit":"3dfbbe7b9bd11dcd64420da0e4eda48b637f4a70","subject":"Merge \"Fix project policy allowing unauthorized access to root domains\" into stable/2025.2","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3dfbbe7b9bd11dcd64420da0e4eda48b637f4a70"}]}],"author":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-07-15 11:08:10.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 15:22:01.000000000","tz":0},"subject":"Ban ec2credential tokens from Keystone API","message":"Ban ec2credential tokens from Keystone API\n\nEC2 credentials are supported by Keystone only to allow Swift to\nimplement S3 protocol while using Keystone identities. There are no real\nreasons for ec2credential fernet tokens (after authenticating) being\naccepted by the Keystone itself. There are many barriers where\nKeystone explicitly checks and bans such credentials to prevent\nrescoping or accessing resources belonging to other projects. There\nhave been multiple security issues due to missing guards. Instead of\nthose individual barriers, simply bar such tokens from any Keystone\noperation except validating the token (which Swift needs to do) and\nre-authenticating (renewing the token). The latter is questionable on\nits own, but is kept for now.\n\nSolve the problem by simply rejecting the ec2credential issued token\nin the auth middleware which runs before any authenticated request.\nThe /auth/tokens are unauthenticated and as such are not affected.\n\nAdd a config option, [auth] ban_ec2credential_tokens, default True, so\ndeployments with an undocumented dependency on using EC2-derived\ntokens directly against the API can opt out instead of being broken\noutright. Also add a release note, since this changes existing,\ndocumented API behavior for anyone relying on it.\n\nChange-Id: I4dd5817d20394369cfadd20ccf476a0660760c52\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit 910ebab06db3b9c119a3139b9443f7bd2369158f)\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/2775076270b223c9e10d208f5495efd22e96362d"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/2775076270b223c9e10d208f5495efd22e96362d"}]},"branch":"refs/heads/stable/2025.2","conflicts":{"base":"7b9f39226744b8db50a6d702cc5f715fc9c17f37","ours":"3dfbbe7b9bd11dcd64420da0e4eda48b637f4a70","theirs":"050ff690849c88a7a24ca7d858be43696e7d5c2f","merge_strategy":"recursive","contains_conflicts":false}},"788f00e42eb0854662b247d9780c9867815309fd":{"kind":"REWORK","_number":2,"created":"2026-08-25 16:14:28.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/22/1002322/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/22/1002322/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/22/1002322/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/22/1002322/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/22/1002322/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/22/1002322/2"}}},"commit":{"parents":[{"commit":"71749bdc725f9c3d2e3135da0fc3492e88e71f41","subject":"auth: reject delegated tokens from token-method reauthentication","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/71749bdc725f9c3d2e3135da0fc3492e88e71f41"}]}],"author":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-07-15 11:08:10.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 16:12:11.000000000","tz":120},"subject":"Ban ec2credential tokens from Keystone API","message":"Ban ec2credential tokens from Keystone API\n\nEC2 credentials are supported by Keystone only to allow Swift to\nimplement S3 protocol while using Keystone identities. There are no real\nreasons for ec2credential fernet tokens (after authenticating) being\naccepted by the Keystone itself. There are many barriers where\nKeystone explicitly checks and bans such credentials to prevent\nrescoping or accessing resources belonging to other projects. There\nhave been multiple security issues due to missing guards. Instead of\nthose individual barriers, simply bar such tokens from any Keystone\noperation except validating the token (which Swift needs to do) and\nre-authenticating (renewing the token). The latter is questionable on\nits own, but is kept for now.\n\nSolve the problem by simply rejecting the ec2credential issued token\nin the auth middleware which runs before any authenticated request.\nThe /auth/tokens are unauthenticated and as such are not affected.\n\nAdd a config option, [auth] ban_ec2credential_tokens, default True, so\ndeployments with an undocumented dependency on using EC2-derived\ntokens directly against the API can opt out instead of being broken\noutright. Also add a release note, since this changes existing,\ndocumented API behavior for anyone relying on it.\n\nChange-Id: I4dd5817d20394369cfadd20ccf476a0660760c52\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit 910ebab06db3b9c119a3139b9443f7bd2369158f)\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/788f00e42eb0854662b247d9780c9867815309fd"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/788f00e42eb0854662b247d9780c9867815309fd"}]},"branch":"refs/heads/stable/2025.2"},"547f996ae67200b05ae75c998eb4f1f3fe3c3190":{"kind":"REWORK","_number":3,"created":"2026-08-25 22:43:33.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/22/1002322/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/22/1002322/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/22/1002322/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/22/1002322/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/22/1002322/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/22/1002322/3"}}},"commit":{"parents":[{"commit":"384eb6f83d0b6423e61001fdc7466220fc406dda","subject":"auth: reject delegated tokens from token-method reauthentication","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/384eb6f83d0b6423e61001fdc7466220fc406dda"}]}],"author":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-07-15 11:08:10.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 22:42:11.000000000","tz":120},"subject":"Ban ec2credential tokens from Keystone API","message":"Ban ec2credential tokens from Keystone API\n\nEC2 credentials are supported by Keystone only to allow Swift to\nimplement S3 protocol while using Keystone identities. There are no real\nreasons for ec2credential fernet tokens (after authenticating) being\naccepted by the Keystone itself. There are many barriers where\nKeystone explicitly checks and bans such credentials to prevent\nrescoping or accessing resources belonging to other projects. There\nhave been multiple security issues due to missing guards. Instead of\nthose individual barriers, simply bar such tokens from any Keystone\noperation except validating the token (which Swift needs to do) and\nre-authenticating (renewing the token). The latter is questionable on\nits own, but is kept for now.\n\nSolve the problem by simply rejecting the ec2credential issued token\nin the auth middleware which runs before any authenticated request.\nThe /auth/tokens are unauthenticated and as such are not affected.\n\nAdd a config option, [auth] ban_ec2credential_tokens, default True, so\ndeployments with an undocumented dependency on using EC2-derived\ntokens directly against the API can opt out instead of being broken\noutright. Also add a release note, since this changes existing,\ndocumented API behavior for anyone relying on it.\n\nChange-Id: I4dd5817d20394369cfadd20ccf476a0660760c52\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit 910ebab06db3b9c119a3139b9443f7bd2369158f)\nAssisted-by: Claude Sonnet 5 \u003cnoreply@anthropic.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/547f996ae67200b05ae75c998eb4f1f3fe3c3190"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/547f996ae67200b05ae75c998eb4f1f3fe3c3190"}]},"branch":"refs/heads/stable/2025.2"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}