)]}'
{"id":"openstack%2Fkeystone~1002330","triplet_id":"openstack%2Fkeystone~master~I0d0c0e1a1d0728655e559fbe12ed3fd117d17d33","project":"openstack/keystone","branch":"master","attention_set":{},"removed_from_attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-09-10 15:10:40.000000000","reason":"Change was submitted"},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-09-09 12:43:27.000000000","reason":"\u003cGERRIT_ACCOUNT_27900\u003e replied on the change","reason_account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}}},"hashtags":[],"change_id":"I0d0c0e1a1d0728655e559fbe12ed3fd117d17d33","subject":"credentials: reject delegated tokens, restrict PATCH to blob only","status":"MERGED","created":"2026-08-25 15:49:26.000000000","updated":"2026-09-10 15:18:07.000000000","submitted":"2026-09-10 15:10:40.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":8,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1002330","meta_rev_id":"d130e8edeed4b108169108689bc62e5545f37de0","_number":1002330,"virtual_id_number":1002330,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-09-10 15:10:40.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"all":[{"value":2,"date":"2026-09-02 19:26:36.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2026-09-09 12:43:27.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"all":[{"value":1,"date":"2026-09-10 13:37:53.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-25 17:57:48.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-09-01 15:58:11.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"REVIEWER"},{"updated":"2026-09-02 19:26:36.000000000","updated_by":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"reviewer":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"state":"REVIEWER"}],"messages":[{"id":"bfcf56d55b3c405ec4e790b31873715683e53620","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 15:49:26.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"0ab09e69cd5dd25c9101a3ac68a35c154db94eb8","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 15:59:45.000000000","message":"Patch Set 1:\n\nThis change is ready for review.","accounts_in_message":[],"_revision_number":1},{"id":"53006ecb7bf9fce0844fd9b1435b9531ab620e2a","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 17:57:48.000000000","message":"Patch Set 1: Verified-1\n\n(4 comments)\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/db4d4ff423674f789d4e90bc0f78f275\n\n- build-openstack-api-ref https://zuul.opendev.org/t/openstack/build/ad5d9b963ed24fa09c2e58ccc4aeb07f : SUCCESS in 6m 18s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/7038d711582c48afbe1c674144e54179 : FAILURE in 24m 32s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/2674128db2b04e068225b7689e565a42 : FAILURE in 5m 56s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/3512c37df1d244119c2a5cc2d7c82543 : FAILURE in 10m 55s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/f997f6d8dd394cfb93d981aec9aa0012 : FAILURE in 11m 45s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/0b040c2f554e4cc1b1c082e89fac94af : FAILURE in 13m 36s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/efefcf3821fa4b15bfc0a9daa3f85d3b : SUCCESS in 14m 35s\n- grenade https://zuul.opendev.org/t/openstack/build/bd3b2f39b5b74bd18a2bf093622d7ca5 : SUCCESS in 1h 02m 56s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/eae78b7c266b45caa904ae82734912a8 : SUCCESS in 1h 40m 33s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/12e799b8d2ad404e8bf03fe6d71f9663 : SUCCESS in 14m 31s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/33aadeb4ffca42dab7d5f01ac142a218 : POST_FAILURE in 7m 31s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/1d8705b9f5df4099a86624d991b9f8e9 : SUCCESS in 50m 13s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/14c160ba0c2d40d0b860dca66bc6bd3e : FAILURE in 22m 54s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/f301fb69b5434e8993f74bcdca406511 : FAILURE in 30m 09s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/5b2af519bca747fdb94039ae9079faf7 : SUCCESS in 52m 58s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/0894520a12b94edf92968acea387237a : SUCCESS in 56m 44s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/8913fab415f0457783c31760bff80d92 : FAILURE in 7m 53s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/053a64784edc4e54bba976dec84f7746 : SUCCESS in 1h 04m 10s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/af719632e493491aab865ffc07ebe0a1 : SUCCESS in 46m 23s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/1dfa203414e7470098e57f5e2c7299a7 : SUCCESS in 8m 03s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  Comments left for invalid file keystone/tests/unit/test_v3_auth.py\n  Comments left for invalid file keystone/tests/unit/test_v3_trust.py","accounts_in_message":[],"_revision_number":1},{"id":"4f2b9d454a8ab1c7d4c21b16644d7333cccc31e8","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 19:41:10.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"d915ac0a5399f14244e7119dd7a00d91f7033b24","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 21:19:26.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/18ff0bd8566a497a9e91aa9f7c9d1802\n\n- build-openstack-api-ref https://zuul.opendev.org/t/openstack/build/c0f366b2bcb24676a805b2fe2ee9cb4b : SUCCESS in 7m 50s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/6c520554fc604d7cb793dc16243a8335 : SUCCESS in 19m 17s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/35ef4430fc3340389d4b7dbbbe2b428b : SUCCESS in 5m 44s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/5841affcedcd467a98d92fc3ff503be5 : SUCCESS in 12m 38s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/144365395b8e480ba278404172ae5d7a : SUCCESS in 12m 27s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/5396aba587794487899056403bfc35e0 : SUCCESS in 14m 32s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/cf0ed49bdec74897aa20f7161b12c654 : SUCCESS in 14m 29s\n- grenade https://zuul.opendev.org/t/openstack/build/a9b5e54f096f41f1a878da66e5fd58d2 : SUCCESS in 1h 04m 40s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/62cecba533d94f28af8d54b10f5968c1 : SUCCESS in 1h 35m 10s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/4f215cbe8ec24206a87e6da6e0e99480 : SUCCESS in 12m 59s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/e75baeefe9814d12ab0c4787fb58fe73 : FAILURE in 19m 29s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/aa2a5868d88046e5b3d1fb85a4b055d7 : SUCCESS in 54m 56s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/c490b9963c6d4742b12c9748b6db01e4 : FAILURE in 19m 12s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/a88ed142042643acb6e83975cdabd90b : FAILURE in 25m 47s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/fbc74d364a95421c9191b564c907f6d8 : SUCCESS in 31m 25s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/ffb48a9e29ba472ba9795c593e2af0f4 : SUCCESS in 52m 57s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/a1469a80713c45348ab1345b71973c36 : SUCCESS in 45m 05s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/f65ff53baad4419eab06334edd77b42d : SUCCESS in 58m 02s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/32cc89ffd92d40e1b252f6304260572f : SUCCESS in 46m 59s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/f5733150c3534743983d60f6139cdd41 : SUCCESS in 6m 49s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":2},{"id":"8c785cca420ced8e8884a840e6b5dbc631ec5587","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 21:37:32.000000000","message":"Patch Set 2:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/0a8ef143c1ba41a8b54a37d947e1232f\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/45cd08fcd2204082ac83b94fe353e51a : SUCCESS in 25m 01s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/b3166c68e5c04c97a85abda8e2242d94 : SUCCESS in 35m 26s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/87de311976d445b49c17f6952bd6ffef : SUCCESS in 28m 45s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"cb578140d3178ae2924831bd8aff4d2fb7f6a647","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-26 20:26:43.000000000","message":"Uploaded patch set 3.\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":3},{"id":"82618d01cfc09887cdd7ddbb5263a9ea93ba39ff","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-26 22:29:01.000000000","message":"Patch Set 3: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/2341bfdbcf624f44bcbdada93c57d2b0\n\n- build-openstack-api-ref https://zuul.opendev.org/t/openstack/build/c67ced07567144be96a02d894dd99782 : SUCCESS in 5m 28s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/7454295cfe2c47739d9615b29ba8d28a : SUCCESS in 17m 33s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/dae1dc218c8640dca0684aca6feef217 : SUCCESS in 5m 10s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/9cbcc8be1699419c90a6891dfab62ccc : SUCCESS in 12m 03s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/f0a6f60d72684be884849ef91bc031d9 : SUCCESS in 11m 03s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/03d44526de1642ac89be145317df68ec : SUCCESS in 9m 57s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/f74db1a038a0407aad3817cb8a844c77 : SUCCESS in 13m 15s\n- grenade https://zuul.opendev.org/t/openstack/build/ef906ff68aac48b097f2ba3bc52e5b5e : SUCCESS in 32m 46s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/d4bf3cdbbfd143e1ad47128771eebd7f : SUCCESS in 1h 47m 00s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/35adaed5acb2447cbccb9e184219c786 : SUCCESS in 13m 58s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/387791f5693348a99d1ec84de95c5210 : FAILURE in 10m 49s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/b1151f0552564a1b8282c1c5f2847da2 : SUCCESS in 25m 36s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/0594204bb127453e8afec7b65814c851 : FAILURE in 18m 48s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/0a8eb9c6ceb74146954743ac3e646987 : FAILURE in 15m 44s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/58c704d0aa5740de8468711731482636 : SUCCESS in 49m 59s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/281d21fda020469a85a0b608ccb841f0 : SUCCESS in 23m 52s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/19e324fe8eb042399f61e3493c671c12 : SUCCESS in 19m 32s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/e01ba94f5b67459db6c5f1539be56f85 : SUCCESS in 29m 57s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/3f0da41523934446b881261a37e8f485 : SUCCESS in 20m 15s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/60005b8489554303a964889970416464 : SUCCESS in 8m 43s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":3},{"id":"28ba8c6a797e25836209056405427f292acb4549","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-27 00:57:25.000000000","message":"Patch Set 3:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/3540915875fd42829cc2ef24b3d4cfb7\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/02a83b8f02bc4e23a9e506dfbab9e0d0 : SUCCESS in 31m 47s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/0e9ab128cbd84f36aba7e651d65de179 : SUCCESS in 30m 02s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/7d478a0717014133b41770091344cbbb : SUCCESS in 47m 13s (non-voting)","accounts_in_message":[],"_revision_number":3},{"id":"19e43da78491e1481e2fc0cc9a9c9b4c72740835","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-09-01 15:58:11.000000000","message":"Patch Set 3: Code-Review-1\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"724f03c3a0e46ded1cbe25ea72213058b3b59237","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-09-02 09:52:25.000000000","message":"Patch Set 3:\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"5a5365129dfad8a2836159e31e85246320708f27","author":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"date":"2026-09-02 19:26:36.000000000","message":"Patch Set 3: Code-Review+2\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"30dc19508312d937193ce2fa85df538547a45d52","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-09-09 12:43:27.000000000","message":"Patch Set 3: Code-Review+2\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"2f221453aa96e4e1a5c25aa59429a9ddeca53f56","author":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"date":"2026-09-10 13:37:53.000000000","message":"Patch Set 3: Workflow+1","accounts_in_message":[],"_revision_number":3},{"id":"a4fb5565445ec231a43d45a8c39ce4f7e2efd9e7","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-10 13:38:38.000000000","message":"Patch Set 3: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":3},{"id":"37b4e74fee6a44c84301592da673e2ec5c343d88","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-10 15:10:40.000000000","message":"Patch Set 3: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/108714d5e63547ab8f8f1722d6f27e64\n\n- build-openstack-api-ref https://zuul.opendev.org/t/openstack/build/c34290818fb042f08b2f00614dad724b : SUCCESS in 5m 51s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/3fd732dccf3f45b8ab7a4e114c63b7b2 : SUCCESS in 7m 23s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/222dcb05ea8f4d71be2789b96f6644f1 : SUCCESS in 7m 53s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/3abc07f5fbb34c259600d6f95469ac17 : SUCCESS in 11m 37s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/23c310c3200e4d938b4c6aa49cef5891 : SUCCESS in 14m 57s\n- grenade https://zuul.opendev.org/t/openstack/build/9db95215969845d789f35039345be307 : SUCCESS in 1h 15m 50s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/2f584c9559f4454ba1111ce291521ad0 : SUCCESS in 43m 35s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/cb3b1548a84e4a2dbea6a8efad5c8e97 : SUCCESS in 5m 16s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/d3a611518bc54d229ed3e7841be87e08 : SUCCESS in 50m 44s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/fbc9a427fe5a4da795a3075954107d38 : SUCCESS in 57m 37s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/faa70cabbc7b4c938636aa66f3168ec3 : SUCCESS in 28m 00s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/62aff361e5194e39b72842c44783fa9c : SUCCESS in 35m 44s","accounts_in_message":[],"_revision_number":3},{"id":"626926f9d2cdbd1b8b1cd8ba467c7b4c17b20403","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-10 15:10:40.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":3},{"id":"d130e8edeed4b108169108689bc62e5545f37de0","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-10 15:18:07.000000000","message":"Patch Set 3:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/01e848c47d3c47d1af5128433f19c551\n\n- promote-api-ref https://zuul.opendev.org/t/openstack/build/c80914883fe549bc98a02f1f5cc5870e : SUCCESS in 1m 11s\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/90e11817cede4848b93be48b4148be7d : SUCCESS in 1m 36s\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/7a6436171e6a4509b420de2edd627170 : SUCCESS in 1m 33s","accounts_in_message":[],"_revision_number":3}],"current_revision_number":3,"current_revision":"42d80b5d284078328c4429d4d9995b26c8688d1b","revisions":{"3a1409e4d4ebe0232b72ba2ec52b66bb53ab3b81":{"kind":"REWORK","_number":1,"created":"2026-08-25 15:49:26.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/30/1002330/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/30/1002330/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/30/1002330/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/30/1002330/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/30/1002330/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/30/1002330/1"}}},"commit":{"parents":[{"commit":"3e2ea3f298cec883b27db9bc79426d0fad6b1dea","subject":"auth: reject delegated tokens from token-method reauthentication","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3e2ea3f298cec883b27db9bc79426d0fad6b1dea"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-07-21 11:06:22.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 15:48:59.000000000","tz":120},"subject":"credentials: reject delegated tokens, restrict PATCH to blob only","message":"credentials: reject delegated tokens, restrict PATCH to blob only\n\nDelegated tokens (application_credential, OAuth1, trust, and\nec2credential) could read, create, modify, or delete credentials\nvia /v3/credentials and the OS-EC2 compat endpoint. The existing\nguards only compared project_id and never treated ec2credential\nas delegated.\n\nReplace those guards with a primary-auth-only gate: any token\nwhose methods aren\u0027t entirely primary auth methods, or that\ncarries a trust_id, is rejected from GET/POST/PATCH/DELETE on\nthose endpoints. This also removes trust/OAuth1 EC2 credential\ncreation, never a deliberate feature (bug 1242597 /\nOSSA-2013-032).\n\nPATCH now only accepts `blob`; `type`, `user_id`, and\n`project_id` are immutable after creation. Delete and recreate\nthe credential to change them.\n\nNarrow the existing, deprecated\nallow_insecure_admin_trust_cross_project_credentials_access\noption (LP#2150089) to ec2-type credentials only, matching its\ndocumented use case: an admin-role trust used to list/sync EC2\ncredentials.\n\nAn empty token.methods list is treated as delegated.\n\nUses keystone.api._shared.delegation from the LP#2153453 change.\n\nCloses-Bug: #2159643\nDepends-On: https://review.opendev.org/c/openstack/tempest/+/1002295\nDepends-On: https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/1002296\nChange-Id: I0d0c0e1a1d0728655e559fbe12ed3fd117d17d33\nAssisted-by: Cursor Grok 4.6 \u003cnoreply@cursor.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3a1409e4d4ebe0232b72ba2ec52b66bb53ab3b81"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3a1409e4d4ebe0232b72ba2ec52b66bb53ab3b81"}]},"branch":"refs/heads/master"},"ffc4c0630290f9d89ff45f90e353f875e7cde7b9":{"kind":"REWORK","_number":2,"created":"2026-08-25 19:41:10.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/30/1002330/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/30/1002330/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/30/1002330/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/30/1002330/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/30/1002330/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/30/1002330/2"}}},"commit":{"parents":[{"commit":"49baa3f9ed8f85aaab5c01499dde92841d5e320c","subject":"auth: reject delegated tokens from token-method reauthentication","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/49baa3f9ed8f85aaab5c01499dde92841d5e320c"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-07-21 11:06:22.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 19:40:59.000000000","tz":120},"subject":"credentials: reject delegated tokens, restrict PATCH to blob only","message":"credentials: reject delegated tokens, restrict PATCH to blob only\n\nDelegated tokens (application_credential, OAuth1, trust, and\nec2credential) could read, create, modify, or delete credentials\nvia /v3/credentials and the OS-EC2 compat endpoint. The existing\nguards only compared project_id and never treated ec2credential\nas delegated.\n\nReplace those guards with a primary-auth-only gate: any token\nwhose methods aren\u0027t entirely primary auth methods, or that\ncarries a trust_id, is rejected from GET/POST/PATCH/DELETE on\nthose endpoints. This also removes trust/OAuth1 EC2 credential\ncreation, never a deliberate feature (bug 1242597 /\nOSSA-2013-032).\n\nPATCH now only accepts `blob`; `type`, `user_id`, and\n`project_id` are immutable after creation. Delete and recreate\nthe credential to change them. This also closes bug 2158931: the\nold guard only validated the stored (pre-image) project_id on\nPATCH, never the new project_id in the request body, so a\ndelegated token scoped to project A could rewrite project_id to\nany project B on a credential it already owned in A. Banning\nproject_id from PATCH entirely removes that write path for every\ncaller, not just delegated tokens.\n\nNarrow the existing, deprecated\nallow_insecure_admin_trust_cross_project_credentials_access\noption (LP#2150089) to ec2-type credentials only, matching its\ndocumented use case: an admin-role trust used to list/sync EC2\ncredentials.\n\nAn empty token.methods list is treated as delegated.\n\nUses keystone.api._shared.delegation from the LP#2153453 change.\n\nCloses-Bug: #2159643\nCloses-Bug: #2158931\nDepends-On: https://review.opendev.org/c/openstack/tempest/+/1002295\nDepends-On: https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/1002296\nChange-Id: I0d0c0e1a1d0728655e559fbe12ed3fd117d17d33\nAssisted-by: Cursor Grok 4.6 \u003cnoreply@cursor.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/ffc4c0630290f9d89ff45f90e353f875e7cde7b9"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/ffc4c0630290f9d89ff45f90e353f875e7cde7b9"}]},"branch":"refs/heads/master"},"42d80b5d284078328c4429d4d9995b26c8688d1b":{"kind":"REWORK","_number":3,"created":"2026-08-26 20:26:43.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/30/1002330/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/30/1002330/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/30/1002330/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/30/1002330/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/30/1002330/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/30/1002330/3"}}},"commit":{"parents":[{"commit":"49baa3f9ed8f85aaab5c01499dde92841d5e320c","subject":"auth: reject delegated tokens from token-method reauthentication","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/49baa3f9ed8f85aaab5c01499dde92841d5e320c"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-07-21 11:06:22.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-26 20:26:33.000000000","tz":120},"subject":"credentials: reject delegated tokens, restrict PATCH to blob only","message":"credentials: reject delegated tokens, restrict PATCH to blob only\n\nDelegated tokens (application_credential, OAuth1, trust, and\nec2credential) could read, create, modify, or delete credentials\nvia /v3/credentials and the OS-EC2 compat endpoint. The existing\nguards only compared project_id and never treated ec2credential\nas delegated.\n\nReplace those guards with a primary-auth-only gate: any token\nwhose methods aren\u0027t entirely primary auth methods, or that\ncarries a trust_id, is rejected from GET/POST/PATCH/DELETE on\nthose endpoints. This also removes trust/OAuth1 EC2 credential\ncreation, never a deliberate feature (bug 1242597 /\nOSSA-2013-032).\n\nPATCH now only accepts `blob`; `type`, `user_id`, and\n`project_id` are immutable after creation. Delete and recreate\nthe credential to change them. This also closes bug 2158931: the\nold guard only validated the stored (pre-image) project_id on\nPATCH, never the new project_id in the request body, so a\ndelegated token scoped to project A could rewrite project_id to\nany project B on a credential it already owned in A. Banning\nproject_id from PATCH entirely removes that write path for every\ncaller, not just delegated tokens.\n\nNarrow the existing, deprecated\nallow_insecure_admin_trust_cross_project_credentials_access\noption (LP#2150089) to ec2-type credentials only, matching its\ndocumented use case: an admin-role trust used to list/sync EC2\ncredentials.\n\nAn empty token.methods list is treated as delegated.\n\nUses keystone.api._shared.delegation from the LP#2153453 change.\n\nCloses-Bug: #2159643\nCloses-Bug: #2158931\nDepends-On: https://review.opendev.org/c/openstack/tempest/+/1002295\nDepends-On: https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/1002296\nChange-Id: I0d0c0e1a1d0728655e559fbe12ed3fd117d17d33\nAssisted-by: Cursor Grok 4.6 \u003cnoreply@cursor.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/42d80b5d284078328c4429d4d9995b26c8688d1b"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/42d80b5d284078328c4429d4d9995b26c8688d1b"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}