)]}'
{"id":"openstack%2Fkeystone~1002333","triplet_id":"openstack%2Fkeystone~stable%2F2026.1~I0d0c0e1a1d0728655e559fbe12ed3fd117d17d33","project":"openstack/keystone","branch":"stable/2026.1","attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-08-25 18:42:32.000000000","reason":"A robot voted negatively on a label"}},"removed_from_attention_set":{},"hashtags":[],"change_id":"I0d0c0e1a1d0728655e559fbe12ed3fd117d17d33","subject":"credentials: reject delegated tokens, restrict PATCH to blob only","status":"NEW","created":"2026-08-25 15:57:10.000000000","updated":"2026-08-26 22:39:19.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":9,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"38d8abe4e15368ff32dbeb1ec49b4d0c1c78dae2","_number":1002333,"virtual_id_number":1002333,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:check","value":1,"date":"2026-08-26 22:39:19.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"CC":[{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-25 18:42:32.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-08-26 19:49:53.000000000","updated_by":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"reviewer":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"state":"CC"}],"messages":[{"id":"599e177bd48690f124a85181a5cff05eca5dc14e","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 15:57:10.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"116b876063679e8522ee8cd7b9896015e77159bf","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 16:00:00.000000000","message":"Patch Set 1:\n\nThis change is ready for review.","accounts_in_message":[],"_revision_number":1},{"id":"d50ad734e343af9c23200611adaf129627fb555c","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 18:42:32.000000000","message":"Patch Set 1: Verified-1\n\n(4 comments)\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/9865cc44a23742e392fd793e6bb2b89e\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/d3b812733d6a47d5846d8a96b5a959c1 : FAILURE in 19m 02s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/f3f8245699db4d57aa12f24591c99bf3 : FAILURE in 5m 14s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/14c81bc6c4194e909d4212a34cfc0e7a : FAILURE in 11m 49s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/c6318bd2213e4303ab1e78ef38bcb800 : FAILURE in 12m 08s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/12c87fcb3ac748248e520bba842b3495 : FAILURE in 17m 51s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/56c3bd93aeb34ce09a6804584f432c3e : SUCCESS in 16m 09s\n- grenade https://zuul.opendev.org/t/openstack/build/96cc41fee1ed4965a5a6dc75911598b7 : SUCCESS in 1h 06m 28s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/a45f9c55384c4d4791458593b9445b65 : SUCCESS in 1h 52m 29s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/da9f29ee55bf46ceb9822bcc7f395bd7 : SUCCESS in 14m 56s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/a7878e2988ed49c48ea0711b575d69b5 : FAILURE in 19m 21s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/1cd5ec29fcc9409daf9f138d3b1763bc : SUCCESS in 33m 31s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/6051db10a74146f3acdf5a942d298769 : FAILURE in 19m 25s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/aaaf7b6753764310bc594407cbf96fdc : FAILURE in 33m 20s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/790156f7d68347388070cf8f25ff6814 : SUCCESS in 25m 07s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/498b0e75d09d443eba8e9b8d2a7cf878 : FAILURE in 8m 10s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/72bf0a8717274aee834b6427943f6cad : SUCCESS in 40m 13s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/5078089829a0457bb7498f289eced055 : FAILURE in 8m 29s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/e6ce615080444142b60967337c87c3b9 : FAILURE in 8m 14s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/30413de947534ac9b527e105028d5711 : SUCCESS in 7m 37s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  Comments left for invalid file keystone/tests/unit/test_v3_auth.py\n  Comments left for invalid file keystone/tests/unit/test_v3_trust.py","accounts_in_message":[],"_revision_number":1},{"id":"132620864f5ed3696f690140a9400f9d3d8a6060","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 22:33:57.000000000","message":"Patch Set 2: Patch Set 1 was rebased\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"3d239af3ccddebb88c0883e935ce440e440ad0af","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-26 00:33:51.000000000","message":"Patch Set 2: Verified-1\n\n(4 comments)\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/b6b80a114867414a9ba00127755e01ab\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/4165a5e543494c28a3c79060986c7875 : FAILURE in 18m 55s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/56a8a1f61b354e5ea8863d4e7a6a12f9 : FAILURE in 4m 08s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/2ade29041f1c4e82a80fcf47620932d3 : FAILURE in 13m 41s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/d8c7c512ee1342fd985aa2af948bedd4 : FAILURE in 11m 45s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/14b49d7d1b8f4ca0b321e4b2908359d0 : FAILURE in 13m 51s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/68f8fa8882bc4a809df8b237d4321f62 : SUCCESS in 14m 23s\n- grenade https://zuul.opendev.org/t/openstack/build/14dd3eca02564936856d365c73682805 : SUCCESS in 50m 50s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/9ff3666c01ac49388cf416f65b342995 : SUCCESS in 1h 55m 11s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/6d742a67175f430abf96e31e806a6bf1 : SUCCESS in 14m 42s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/26f7f2f096714b84a9bd6199694a51eb : FAILURE in 21m 43s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/52feed082c6f44ed98c39f316e2627c3 : SUCCESS in 21m 07s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/c51b418d40464378a659741a0a287bad : FAILURE in 16m 38s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/b753acd6380b4b5592d760ea13876e3a : FAILURE in 25m 09s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/bbc4b5f6d71f45ea9f0fa6c15396435e : SUCCESS in 24m 43s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/4cec58c4dbb041c4ad25fa6fb7d4f017 : SUCCESS in 27m 03s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/0616893bb8e54200a5608b51b9e22ee1 : SUCCESS in 26m 16s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/adaf874838914b33a179abb3b2ed14f9 : SUCCESS in 45m 59s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/a98b112e66ef4ce3ae75a154dbc4cca1 : FAILURE in 16m 11s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/605fbeaefe1740769bfe596ae3001f1d : SUCCESS in 9m 18s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":2},{"id":"0443a4c5b2c33651c3819daeac8762d4df5013c6","author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"date":"2026-08-26 19:49:53.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"99166bd16313a426368a54ffd52bc62df635a4c0","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-26 20:36:50.000000000","message":"Uploaded patch set 3.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":3},{"id":"38d8abe4e15368ff32dbeb1ec49b4d0c1c78dae2","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-26 22:39:19.000000000","message":"Patch Set 3: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/79867f2531e64acaa242db4e26e7cfe6\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/2b1b44ff1f474afdbef62bae32f81772 : SUCCESS in 20m 10s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/69866b0df1614bc4baffad1fdae270e6 : SUCCESS in 5m 18s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/f90765da25d94f0bbdc77601d02d1d6a : SUCCESS in 11m 40s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/7495cb1676774c67a38b6fa6e0996171 : SUCCESS in 14m 04s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/1bb6457140d842b9985763b224b861ce : SUCCESS in 10m 05s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/00418bf4b6614c9682041c3ff634f17b : SUCCESS in 11m 03s\n- grenade https://zuul.opendev.org/t/openstack/build/e27d1ca4ce414058a2e8670541544f57 : SUCCESS in 1h 10m 45s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/17fb0d9b663449c8a5ab479952629de1 : SUCCESS in 2h 01m 14s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/3517432dda054159babbc2c76203dbb7 : SUCCESS in 11m 01s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/7e6304c9a0a4453bb0ce5a18836cc984 : FAILURE in 19m 28s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/d5c1f5db98714561950ce20f984d37f2 : SUCCESS in 32m 16s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/f3c378f9b0c0459f8014fe65e097f39a : FAILURE in 7m 13s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/db1eb270377a4abfaff107c0dde11540 : FAILURE in 30m 18s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/7003aa5205bd42bcacb6349292956176 : SUCCESS in 31m 18s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/0e04d308dbf3437daec32269cca8f1ce : SUCCESS in 34m 33s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/9eaec3b0e7e24e02a76c42551be59679 : SUCCESS in 39m 02s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/8a6acef2344b45b585521c08ac662a17 : SUCCESS in 58m 41s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/25b09ab270db4348b06686dec9e3982f : SUCCESS in 47m 30s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/428ec9b882924756bd3febb7311b6063 : SUCCESS in 7m 16s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":3}],"current_revision_number":3,"current_revision":"f739dfc1f36eac722248535ed602cb233bcd19da","revisions":{"f810f6063714af7c75081e58b960bbfea5ddbd71":{"kind":"REWORK","_number":1,"created":"2026-08-25 15:57:10.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/33/1002333/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/33/1002333/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/33/1002333/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/33/1002333/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/33/1002333/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/33/1002333/1"}}},"commit":{"parents":[{"commit":"3582ad099b7e72753c2f12599a26dce6d810106f","subject":"auth: reject delegated tokens from token-method reauthentication","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3582ad099b7e72753c2f12599a26dce6d810106f"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-07-21 11:06:22.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 15:56:47.000000000","tz":120},"subject":"credentials: reject delegated tokens, restrict PATCH to blob only","message":"credentials: reject delegated tokens, restrict PATCH to blob only\n\nDelegated tokens (application_credential, OAuth1, trust, and\nec2credential) could read, create, modify, or delete credentials\nvia /v3/credentials and the OS-EC2 compat endpoint. The existing\nguards only compared project_id and never treated ec2credential\nas delegated.\n\nReplace those guards with a primary-auth-only gate: any token\nwhose methods aren\u0027t entirely primary auth methods, or that\ncarries a trust_id, is rejected from GET/POST/PATCH/DELETE on\nthose endpoints. This also removes trust/OAuth1 EC2 credential\ncreation, never a deliberate feature (bug 1242597 /\nOSSA-2013-032).\n\nPATCH now only accepts `blob`; `type`, `user_id`, and\n`project_id` are immutable after creation. Delete and recreate\nthe credential to change them.\n\nNarrow the existing, deprecated\nallow_insecure_admin_trust_cross_project_credentials_access\noption (LP#2150089) to ec2-type credentials only, matching its\ndocumented use case: an admin-role trust used to list/sync EC2\ncredentials.\n\nAn empty token.methods list is treated as delegated.\n\nUses keystone.api._shared.delegation from the LP#2153453 change.\n\nCloses-Bug: #2159643\nDepends-On: https://review.opendev.org/c/openstack/tempest/+/1002295\nDepends-On: https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/1002296\nChange-Id: I0d0c0e1a1d0728655e559fbe12ed3fd117d17d33\nAssisted-by: Cursor Grok 4.6 \u003cnoreply@cursor.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n(cherry picked from commit 3a1409e4d4ebe0232b72ba2ec52b66bb53ab3b81)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/f810f6063714af7c75081e58b960bbfea5ddbd71"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/f810f6063714af7c75081e58b960bbfea5ddbd71"}]},"branch":"refs/heads/stable/2026.1"},"ee7bf1d3dd3748674360f69befa01efd389d2ce1":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2026-08-25 22:33:57.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/33/1002333/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/33/1002333/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/33/1002333/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/33/1002333/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/33/1002333/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/33/1002333/2"}}},"commit":{"parents":[{"commit":"a054bfb0cc0d3087f2de4f0b18f27ef7da7d5ae9","subject":"auth: reject delegated tokens from token-method reauthentication","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a054bfb0cc0d3087f2de4f0b18f27ef7da7d5ae9"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-07-21 11:06:22.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 22:33:57.000000000","tz":0},"subject":"credentials: reject delegated tokens, restrict PATCH to blob only","message":"credentials: reject delegated tokens, restrict PATCH to blob only\n\nDelegated tokens (application_credential, OAuth1, trust, and\nec2credential) could read, create, modify, or delete credentials\nvia /v3/credentials and the OS-EC2 compat endpoint. The existing\nguards only compared project_id and never treated ec2credential\nas delegated.\n\nReplace those guards with a primary-auth-only gate: any token\nwhose methods aren\u0027t entirely primary auth methods, or that\ncarries a trust_id, is rejected from GET/POST/PATCH/DELETE on\nthose endpoints. This also removes trust/OAuth1 EC2 credential\ncreation, never a deliberate feature (bug 1242597 /\nOSSA-2013-032).\n\nPATCH now only accepts `blob`; `type`, `user_id`, and\n`project_id` are immutable after creation. Delete and recreate\nthe credential to change them.\n\nNarrow the existing, deprecated\nallow_insecure_admin_trust_cross_project_credentials_access\noption (LP#2150089) to ec2-type credentials only, matching its\ndocumented use case: an admin-role trust used to list/sync EC2\ncredentials.\n\nAn empty token.methods list is treated as delegated.\n\nUses keystone.api._shared.delegation from the LP#2153453 change.\n\nCloses-Bug: #2159643\nDepends-On: https://review.opendev.org/c/openstack/tempest/+/1002295\nDepends-On: https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/1002296\nChange-Id: I0d0c0e1a1d0728655e559fbe12ed3fd117d17d33\nAssisted-by: Cursor Grok 4.6 \u003cnoreply@cursor.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n(cherry picked from commit 3a1409e4d4ebe0232b72ba2ec52b66bb53ab3b81)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/ee7bf1d3dd3748674360f69befa01efd389d2ce1"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/ee7bf1d3dd3748674360f69befa01efd389d2ce1"}]},"branch":"refs/heads/stable/2026.1","description":"Rebase","conflicts":{"base":"3582ad099b7e72753c2f12599a26dce6d810106f","ours":"f810f6063714af7c75081e58b960bbfea5ddbd71","theirs":"a054bfb0cc0d3087f2de4f0b18f27ef7da7d5ae9","merge_strategy":"recursive","contains_conflicts":false}},"f739dfc1f36eac722248535ed602cb233bcd19da":{"kind":"REWORK","_number":3,"created":"2026-08-26 20:36:50.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/33/1002333/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/33/1002333/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/33/1002333/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/33/1002333/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/33/1002333/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/33/1002333/3"}}},"commit":{"parents":[{"commit":"a054bfb0cc0d3087f2de4f0b18f27ef7da7d5ae9","subject":"auth: reject delegated tokens from token-method reauthentication","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a054bfb0cc0d3087f2de4f0b18f27ef7da7d5ae9"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-26 20:36:41.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-26 20:36:41.000000000","tz":120},"subject":"credentials: reject delegated tokens, restrict PATCH to blob only","message":"credentials: reject delegated tokens, restrict PATCH to blob only\n\nDelegated tokens (application_credential, OAuth1, trust, and\nec2credential) could read, create, modify, or delete credentials\nvia /v3/credentials and the OS-EC2 compat endpoint. The existing\nguards only compared project_id and never treated ec2credential\nas delegated.\n\nReplace those guards with a primary-auth-only gate: any token\nwhose methods aren\u0027t entirely primary auth methods, or that\ncarries a trust_id, is rejected from GET/POST/PATCH/DELETE on\nthose endpoints. This also removes trust/OAuth1 EC2 credential\ncreation, never a deliberate feature (bug 1242597 /\nOSSA-2013-032).\n\nPATCH now only accepts `blob`; `type`, `user_id`, and\n`project_id` are immutable after creation. Delete and recreate\nthe credential to change them. This also closes bug 2158931: the\nold guard only validated the stored (pre-image) project_id on\nPATCH, never the new project_id in the request body, so a\ndelegated token scoped to project A could rewrite project_id to\nany project B on a credential it already owned in A. Banning\nproject_id from PATCH entirely removes that write path for every\ncaller, not just delegated tokens.\n\nNarrow the existing, deprecated\nallow_insecure_admin_trust_cross_project_credentials_access\noption (LP#2150089) to ec2-type credentials only, matching its\ndocumented use case: an admin-role trust used to list/sync EC2\ncredentials.\n\nAn empty token.methods list is treated as delegated.\n\nUses keystone.api._shared.delegation from the LP#2153453 change.\n\nCloses-Bug: #2159643\nCloses-Bug: #2158931\nDepends-On: https://review.opendev.org/c/openstack/tempest/+/1002295\nDepends-On: https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/1002296\nChange-Id: I0d0c0e1a1d0728655e559fbe12ed3fd117d17d33\nAssisted-by: Cursor Grok 4.6 \u003cnoreply@cursor.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n(cherry picked from commit 42d80b5d2)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/f739dfc1f36eac722248535ed602cb233bcd19da"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/f739dfc1f36eac722248535ed602cb233bcd19da"}]},"branch":"refs/heads/stable/2026.1"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY"},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}