)]}'
{"id":"openstack%2Fkeystone~1002325","triplet_id":"openstack%2Fkeystone~stable%2F2026.1~I41c2d2dfe6e594ddff8971b2178d278e569f0067","project":"openstack/keystone","branch":"stable/2026.1","attention_set":{},"removed_from_attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-08-27 11:48:30.000000000","reason":"removed on reply"}},"hashtags":[],"change_id":"I41c2d2dfe6e594ddff8971b2178d278e569f0067","subject":"auth: encode ec2credential and oauth2_credential in the method bitmask","status":"NEW","created":"2026-08-25 15:23:20.000000000","updated":"2026-08-27 13:44:56.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"cherry_pick_of_change":1002289,"cherry_pick_of_patch_set":1,"meta_rev_id":"698e86df0a388021dc15bf86fb60ab4d50b46a63","_number":1002325,"virtual_id_number":1002325,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:check","value":1,"date":"2026-08-27 13:44:56.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-25 16:54:20.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"274e42ba99c387980c31b3aedeccb5c5ae4cf24d","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 15:23:20.000000000","message":"Patch Set 1: Cherry Picked from branch master.","accounts_in_message":[],"_revision_number":1},{"id":"853d077f7f120ca16424837ca328f0fcea96069a","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 16:54:20.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/bac88e540e0c4f6db66bea39fcfd677f\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/4f36f7a2196743e382f5c2860dacc7ba : SUCCESS in 20m 22s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/e38bd67b63ff48e7bc17a53d51f906cf : SUCCESS in 5m 55s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/c344eee371f942ab9a189e2d017e36d3 : SUCCESS in 8m 55s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/585c5311e4d340c6af436c962724a58a : SUCCESS in 12m 24s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/5e043fabe15e4ecba8a83aa12ecc0851 : SUCCESS in 12m 45s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/008d76b777334611a452972e0412217d : SUCCESS in 12m 38s\n- grenade https://zuul.opendev.org/t/openstack/build/80b59d32b16547e1813da3c234932a06 : SUCCESS in 50m 21s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/d5a694260e854755b8a0d311cd22ed6c : FAILURE in 8m 06s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/88eed69a19824c3f9707be3fabd2a99f : SUCCESS in 12m 49s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/a865415536174ae5961f4484646b3ad5 : SUCCESS in 11m 44s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/0fe00728df614af49090df2168e2adec : FAILURE in 8m 01s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/bce8b447304a413781b0db42f903aea8 : FAILURE in 15m 29s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/629fa58006c444e1a3f25577789e1d62 : FAILURE in 24m 58s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/f1c7f7d17dda4504813317f91eefe029 : SUCCESS in 30m 03s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/907636688d554e0fa9fe92d5c5cd03c5 : SUCCESS in 31m 40s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/a565fadb6106472e86bfde9a6acd7bea : SUCCESS in 39m 55s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/3365d7fedbf54a3097a8e260a2498cc6 : SUCCESS in 46m 40s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/db5a206a96f54ddca0aafffe290034d7 : FAILURE in 23m 06s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/449e13516217484fb57d4c40e2499ab3 : SUCCESS in 8m 16s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":1},{"id":"6ab27379cbf8e7eeb61f61e1719258a7c895519d","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-27 11:48:30.000000000","message":"Patch Set 1:\n\nrecheck - protection-functional skip fixed by 1002440 (merged)","accounts_in_message":[],"_revision_number":1},{"id":"698e86df0a388021dc15bf86fb60ab4d50b46a63","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-27 13:44:56.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/cb56af5433e74637b3e759c055a011cd\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/6b702c30dc4244beb07c2a042121085a : SUCCESS in 17m 11s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/c380db1afee74320997c84340ba7d1be : SUCCESS in 5m 54s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/3e3e7dbff87f4e14b310614e8cb940a9 : SUCCESS in 12m 09s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/efd0d5a8b8374553866414d91cad0402 : SUCCESS in 13m 20s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/5781b236c31948ba84902994f2f98e2f : SUCCESS in 8m 38s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/6833ce2170044389b322ac25cef7ff23 : SUCCESS in 7m 17s\n- grenade https://zuul.opendev.org/t/openstack/build/9c46d5c5957a438fbfe1b20c95788c28 : SUCCESS in 35m 06s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/69804dc21ba14dbaba4db25e877e6824 : SUCCESS in 1h 46m 38s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/b2da0abee597407489bf9497e55e7925 : SUCCESS in 11m 49s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/9d25aa63ef104c14b40f614e48876d34 : SUCCESS in 22m 46s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/35d8c4712f404acb98fb340bf451e1be : SUCCESS in 13m 14s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/838ead4c29b74741a32414f4777f8a61 : FAILURE in 22m 39s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/e8565d0ab0bf4c09898f50476bfa7b5e : FAILURE in 32m 14s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/0b192db1de9e4a4cae262f9558344c0a : SUCCESS in 30m 01s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/38fc079fc67c46da973c79c926ec36c8 : SUCCESS in 33m 49s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/950aaafd882e4537ace169614e725b98 : SUCCESS in 38m 39s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/6239372cdb22466b8b7d179a5d85d1e8 : SUCCESS in 30m 09s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/32b940f9cbbf44cd84690bae33539f3b : SUCCESS in 50m 47s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/18ed5db53bf249599106bd06a22d1ead : SUCCESS in 4m 05s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"df715dd6345c216a902699e4fdb621f4d2d1f0d5","revisions":{"df715dd6345c216a902699e4fdb621f4d2d1f0d5":{"kind":"REWORK","_number":1,"created":"2026-08-25 15:23:20.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/25/1002325/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/25/1002325/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/25/1002325/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/25/1002325/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/25/1002325/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/25/1002325/1"}}},"commit":{"parents":[{"commit":"7b9f39226744b8db50a6d702cc5f715fc9c17f37","subject":"Merge \"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)\" into stable/2026.1","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/7b9f39226744b8db50a6d702cc5f715fc9c17f37"}]}],"author":{"name":"Benjamin Pinchon","email":"benjamin.pinchon@corp.ovh.com","date":"2026-08-25 13:20:12.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 15:23:20.000000000","tz":0},"subject":"auth: encode ec2credential and oauth2_credential in the method bitmask","message":"auth: encode ec2credential and oauth2_credential in the method bitmask\n\nconvert_method_list_to_integer() builds its map from CONF.auth.methods,\nso a method name absent from that list is silently dropped and the\nresult is 0, which convert_integer_to_method_list() turns back into\nan empty list.\n\n\u0027ec2credential\u0027 (keystone.api._shared.EC2_S3_Resource) and\n\u0027oauth2_credential\u0027 (keystone.api.os_oauth2) are written into\ntoken.methods by endpoints that are not auth plugins, so they cannot\nbe listed in CONF.auth.methods: load_auth_methods() would look for a\nkeystone.auth.\u003cname\u003e entry point that does not exist, and the name\nwould become client-requestable on POST /v3/auth/tokens. Neither has\never survived the fernet round-trip.\n\nMaster already ships the EC2 API ban (910ebab06) which rejects\ntokens with \u0027ec2credential\u0027 in token.methods. Without this round-trip\nfix that check never sees the method on a fernet token, so the ban\nis a no-op for issued tokens.\n\nReserve fixed high bits for both so they round-trip. High and fixed\nmeans they never collide with the sequential indexes and adding one\nnever shifts an existing index, so tokens in circulation stay\ndecodable.\n\nThis does not fix tokens already issued: they carry the integer 0\nand still decode to an empty list.\n\nChange-Id: I41c2d2dfe6e594ddff8971b2178d278e569f0067\nAssisted-by: Cursor Grok 4.6 \u003cnoreply@cursor.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/df715dd6345c216a902699e4fdb621f4d2d1f0d5"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/df715dd6345c216a902699e4fdb621f4d2d1f0d5"}]},"branch":"refs/heads/stable/2026.1","conflicts":{"base":"16afc813b7e6de727d8a91e065d7824b06e32925","ours":"7b9f39226744b8db50a6d702cc5f715fc9c17f37","theirs":"dbb5c174705153f23f93d143c951a2008c9912b6","merge_strategy":"recursive","contains_conflicts":false}}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY"},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}