)]}'
{"id":"openstack%2Fkeystone~1002326","triplet_id":"openstack%2Fkeystone~stable%2F2025.2~I41c2d2dfe6e594ddff8971b2178d278e569f0067","project":"openstack/keystone","branch":"stable/2025.2","attention_set":{},"removed_from_attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-08-27 11:48:32.000000000","reason":"removed on reply"}},"hashtags":[],"change_id":"I41c2d2dfe6e594ddff8971b2178d278e569f0067","subject":"auth: encode ec2credential and oauth2_credential in the method bitmask","status":"NEW","created":"2026-08-25 15:24:07.000000000","updated":"2026-08-27 13:59:59.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"cherry_pick_of_change":1002289,"cherry_pick_of_patch_set":1,"meta_rev_id":"23239c19f37e4e0427683cd06d67ec39937c32a3","_number":1002326,"virtual_id_number":1002326,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:check","value":1,"date":"2026-08-27 13:59:59.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-25 18:02:39.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"6e76ad2fc86e9ba746a593d0655f0523684a8ad0","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 15:24:07.000000000","message":"Patch Set 1: Cherry Picked from branch master.","accounts_in_message":[],"_revision_number":1},{"id":"ba9af13473ab95134acab5d3a19633d1c59472ca","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 18:02:39.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/3d22f486866a449cacba20dfabd0adf7\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/4630c37fdd374815b58d428b62b6847c : SUCCESS in 13m 40s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/5545c00f3b954283bd28f1c4e6bcee61 : SUCCESS in 6m 43s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/906144469d06466e80d9a96b6f0da368 : SUCCESS in 12m 03s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/070af523eab741b2bd8d334e4f00649e : SUCCESS in 12m 28s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/4ad1044c97ac4202ad1aa6f399dae913 : SUCCESS in 20m 36s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/6df2dfe143b54ff0a8625c15535ae2e6 : SUCCESS in 13m 06s\n- grenade https://zuul.opendev.org/t/openstack/build/211e4aff8b21488b924c763327aaf2d1 : SUCCESS in 1h 05m 23s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/126a9225afd44b0ea764e6379c6c9171 : SUCCESS in 1h 53m 06s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/3aa53c23f2df47068223efbea8f616dd : SUCCESS in 14m 13s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/804aac3580d8488ca4817f969c2c7d23 : SUCCESS in 18m 16s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/13d2b941be1345d3a929c2790f73a211 : SUCCESS in 28m 42s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/16c3d7daffd646a1b934c3331df61824 : FAILURE in 18m 26s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/03b200a2ad70421d9dfe3fc5892820a4 : FAILURE in 25m 13s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/6f2066c39ac14bf3ad44502de0cd05e9 : SUCCESS in 32m 27s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/8a2405aefc674d819a371677c2614189 : SUCCESS in 17m 10s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/fc438a32527f4119b93d1bf5f0112f32 : SUCCESS in 37m 47s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/01207b73209a43279af828714e3bc96e : SUCCESS in 44m 59s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/6b6162e5336e4cc49222d31850264720 : FAILURE in 23m 02s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/55167ccf5fee4f62acc25b9624ead19b : FAILURE in 8m 01s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":1},{"id":"a15ed5bba87e8617c9161d303003374acc3e5cf4","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-27 11:48:32.000000000","message":"Patch Set 1:\n\nrecheck - protection-functional skip fixed by 1002440 (merged)","accounts_in_message":[],"_revision_number":1},{"id":"23239c19f37e4e0427683cd06d67ec39937c32a3","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-27 13:59:59.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/0030255f1cf34ce6996650376b22091b\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/24a3c365bde445ceafe9a8573c44fd9a : SUCCESS in 11m 11s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/974c62292eef4c16b9716d4ab4833053 : SUCCESS in 9m 01s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/51b29bfc7947421bb49836c387f5870b : SUCCESS in 7m 29s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/77989dfad0ad4616947252314c4a9a96 : SUCCESS in 13m 26s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/7d232dba8cd0400c8f95cafae56294c4 : SUCCESS in 15m 28s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/a4940d71c3c64f5a98dfaefb07597120 : SUCCESS in 7m 44s\n- grenade https://zuul.opendev.org/t/openstack/build/1bd73a78a7c849b793a0091b68a7b5b0 : SUCCESS in 34m 19s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/7460571143a846d8ac03b01dc1dd4969 : SUCCESS in 2h 04m 27s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/3b64de2286f24c23a3877ff7960c4c29 : SUCCESS in 5m 22s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/392b77af1c7243e394e5d55fc663c06c : SUCCESS in 21m 36s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/9ac3dd679771413b90a92a20a8d50ca8 : SUCCESS in 38m 52s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/fb1d1900336946b4b6dcc365c1dae3b1 : FAILURE in 19m 25s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/2b69666c4c1740fd9f824d8094bf1890 : FAILURE in 31m 23s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/520de279e2684d298c813358b4e98ab3 : SUCCESS in 32m 50s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/b6329970be49451a98f6400fbd63f16a : SUCCESS in 16m 45s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/8d97f736b10c4684bdaa4c2207ca8f09 : SUCCESS in 40m 39s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/e4274864b7ba4c2f8a71d5197fb49f09 : SUCCESS in 1h 02m 10s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/55aa7713e4fc4c4392b3db9b21b8a87b : SUCCESS in 56m 28s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/f1633233da0f4e8292f1ae2799bb1ad6 : FAILURE in 7m 57s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"6a234fddfcdb933ce8bf0a950b404ff40a08c7af","revisions":{"6a234fddfcdb933ce8bf0a950b404ff40a08c7af":{"kind":"REWORK","_number":1,"created":"2026-08-25 15:24:07.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/26/1002326/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/26/1002326/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/26/1002326/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/26/1002326/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/26/1002326/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/26/1002326/1"}}},"commit":{"parents":[{"commit":"3dfbbe7b9bd11dcd64420da0e4eda48b637f4a70","subject":"Merge \"Fix project policy allowing unauthorized access to root domains\" into stable/2025.2","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3dfbbe7b9bd11dcd64420da0e4eda48b637f4a70"}]}],"author":{"name":"Benjamin Pinchon","email":"benjamin.pinchon@corp.ovh.com","date":"2026-08-25 13:20:12.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 15:24:07.000000000","tz":0},"subject":"auth: encode ec2credential and oauth2_credential in the method bitmask","message":"auth: encode ec2credential and oauth2_credential in the method bitmask\n\nconvert_method_list_to_integer() builds its map from CONF.auth.methods,\nso a method name absent from that list is silently dropped and the\nresult is 0, which convert_integer_to_method_list() turns back into\nan empty list.\n\n\u0027ec2credential\u0027 (keystone.api._shared.EC2_S3_Resource) and\n\u0027oauth2_credential\u0027 (keystone.api.os_oauth2) are written into\ntoken.methods by endpoints that are not auth plugins, so they cannot\nbe listed in CONF.auth.methods: load_auth_methods() would look for a\nkeystone.auth.\u003cname\u003e entry point that does not exist, and the name\nwould become client-requestable on POST /v3/auth/tokens. Neither has\never survived the fernet round-trip.\n\nMaster already ships the EC2 API ban (910ebab06) which rejects\ntokens with \u0027ec2credential\u0027 in token.methods. Without this round-trip\nfix that check never sees the method on a fernet token, so the ban\nis a no-op for issued tokens.\n\nReserve fixed high bits for both so they round-trip. High and fixed\nmeans they never collide with the sequential indexes and adding one\nnever shifts an existing index, so tokens in circulation stay\ndecodable.\n\nThis does not fix tokens already issued: they carry the integer 0\nand still decode to an empty list.\n\nChange-Id: I41c2d2dfe6e594ddff8971b2178d278e569f0067\nAssisted-by: Cursor Grok 4.6 \u003cnoreply@cursor.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/6a234fddfcdb933ce8bf0a950b404ff40a08c7af"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/6a234fddfcdb933ce8bf0a950b404ff40a08c7af"}]},"branch":"refs/heads/stable/2025.2","conflicts":{"base":"16afc813b7e6de727d8a91e065d7824b06e32925","ours":"3dfbbe7b9bd11dcd64420da0e4eda48b637f4a70","theirs":"dbb5c174705153f23f93d143c951a2008c9912b6","merge_strategy":"recursive","contains_conflicts":false}}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY"},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}