)]}'
{"id":"openstack%2Fkeystone~1002334","triplet_id":"openstack%2Fkeystone~stable%2F2025.2~I0d0c0e1a1d0728655e559fbe12ed3fd117d17d33","project":"openstack/keystone","branch":"stable/2025.2","attention_set":{},"removed_from_attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-08-27 11:48:34.000000000","reason":"removed on reply"}},"hashtags":[],"change_id":"I0d0c0e1a1d0728655e559fbe12ed3fd117d17d33","subject":"credentials: reject delegated tokens, restrict PATCH to blob only","status":"NEW","created":"2026-08-25 15:57:16.000000000","updated":"2026-09-01 11:32:17.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":8,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"bb8c4116fce7388fedae718264a798da58ce5132","_number":1002334,"virtual_id_number":1002334,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:check","value":1,"date":"2026-09-01 11:32:17.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-25 18:14:25.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"a752395f03b6762fd71288149f00ce402096b83c","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 15:57:16.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"87ec0b6207f4b9b361ff3766be73fd815d3647e6","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 16:00:03.000000000","message":"Patch Set 1:\n\nThis change is ready for review.","accounts_in_message":[],"_revision_number":1},{"id":"a603c713bb228d05fc62e3ae6b663c70e73c2351","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-25 18:14:25.000000000","message":"Patch Set 1: Verified-1\n\n(4 comments)\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/f8d3831c80fc4b99b49d908e29e8645c\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/b0133ecc252c44d991b5bf16e0579f63 : FAILURE in 18m 39s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/f8c516681ea64ff99219fb5df6a40d52 : FAILURE in 4m 50s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/d7c5668b383b43d4b0f8694649104de5 : FAILURE in 14m 21s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/c01a1a2e1a8e400ba77261a6c2f84287 : FAILURE in 15m 57s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/cc1b9eabd04f40f7be17d8b11ac77ca2 : FAILURE in 16m 30s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/ec6309ba1b6e4357b6f7cfc32829e06b : SUCCESS in 13m 25s\n- grenade https://zuul.opendev.org/t/openstack/build/9769ed7114c2461cbd4b6abee8737076 : SUCCESS in 1h 00m 32s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/05a855206a3e424c998db02f50a6ca36 : SUCCESS in 1h 35m 23s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/59df79624e384db6aa0ddefbc6c6ab0c : SUCCESS in 14m 45s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/3ec5dcd9d0f0496b81a9d914be8023cc : FAILURE in 19m 56s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/d4d772744dad40298b1a02fe0dfb6b90 : FAILURE in 8m 16s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/004bd226ebe44a2e868d65053a89be6b : FAILURE in 17m 35s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/cec441fbba4d46e5953e975e14549a96 : FAILURE in 16m 50s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/d33ffdf94d804b33b907e34d1d0a749d : SUCCESS in 19m 15s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/8d7c06c73047448c887a9795c740ccb8 : SUCCESS in 38m 59s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/8c8af62a18f14053b62cca00956c5f8e : SUCCESS in 33m 42s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/27df41b21a554ad690ed1c761cd530c8 : SUCCESS in 1h 01m 26s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/1944a4b2d67a4cfcb8eab89c6659daf1 : FAILURE in 29m 04s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/67d9bc0d578a4656bdc1d0d7d4d63c40 : FAILURE in 8m 51s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  Comments left for invalid file keystone/tests/unit/test_v3_auth.py\n  Comments left for invalid file keystone/tests/unit/test_v3_trust.py","accounts_in_message":[],"_revision_number":1},{"id":"ca66f80631cb123f6091c73e86f8e0eb03427a36","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 22:34:14.000000000","message":"Patch Set 2: Patch Set 1 was rebased\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"7bb18f73673d01ca6922df1ae2be21d59c26868d","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-26 00:21:21.000000000","message":"Patch Set 2: Verified-1\n\n(4 comments)\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/bd037d5c4a714e42a59a24e960dea3b0\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/daa0220a2e8a4a919bfbd53d0a83e61d : FAILURE in 16m 14s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/509d3bce030f457fac85901932b6f20d : FAILURE in 9m 26s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/8a80a344ae1f4f2da6fcb3820f20e74b : FAILURE in 15m 09s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/99e6aa0ddcac4cc989c622be0e461ec7 : FAILURE in 12m 44s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/fcbd19c7469a4b1ea7738ca13c78e963 : FAILURE in 14m 57s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/25c87d07e0254f578a06403e38c42063 : SUCCESS in 13m 23s\n- grenade https://zuul.opendev.org/t/openstack/build/f37b1ecd2b5346f08590c7b6a780112c : SUCCESS in 46m 22s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/94e3c62fedf84356bb6d3a09169a6c90 : SUCCESS in 1h 42m 35s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/3b0553ad91f044eda013c4fb7eebe64c : SUCCESS in 16m 26s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/fbe03f8a9f5e4842b6467cb01c4985a6 : FAILURE in 11m 57s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/04e154d3390e4450ab1904edcdea5e18 : SUCCESS in 28m 32s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/45d77f875f904f19a9a19402b959be39 : FAILURE in 12m 41s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/1dc16793de8145f49058af6a4a830106 : FAILURE in 14m 57s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/6879a936ac674b3cb7593a9c71a09c94 : SUCCESS in 31m 09s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/0cabd5c7858543b3a349bafa3ac4c4fa : SUCCESS in 20m 03s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/159067f41bbe4e328c1b9365df782a13 : SUCCESS in 41m 20s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/0e4374a8f6274437938b1bd58a0de23d : SUCCESS in 55m 35s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/bf3b13d074664765b88d3cb25c558e72 : FAILURE in 12m 18s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/8ece507ad1144c89bfc873ede125d490 : FAILURE in 4m 34s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  Comments left for invalid file keystone/tests/unit/test_v3_auth.py\n  Comments left for invalid file keystone/tests/unit/test_v3_trust.py","accounts_in_message":[],"_revision_number":2},{"id":"559967232f00536b8987d268bcfd5996caa5a743","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-26 20:40:20.000000000","message":"Uploaded patch set 3.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":3},{"id":"83b64d197790c6f4695e41959b4d4468a2ba2c41","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-27 11:48:34.000000000","message":"Patch Set 3:\n\nrecheck - protection-functional skip fixed by 1002440 (merged)","accounts_in_message":[],"_revision_number":3},{"id":"bfd713bd073e3a3c67a8ed10b9ea385806e8ce49","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-09-01 09:50:59.000000000","message":"Patch Set 4: Patch Set 3 was rebased","accounts_in_message":[],"_revision_number":4},{"id":"bb8c4116fce7388fedae718264a798da58ce5132","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-01 11:32:17.000000000","message":"Patch Set 4: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/6346f151058e4444b8529fb8ad634fa1\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/eb2c538a20694e388c085679a798d037 : SUCCESS in 14m 37s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/67286e18e429409893752e368ec3ca3b : SUCCESS in 3m 45s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/8f008bfc3d5149f6bc4edf4c57ba4b77 : SUCCESS in 13m 51s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/af4e862b12fc448d8bc029f94055f423 : SUCCESS in 11m 08s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/eef12cff563447c7b0e38d845cd8535e : SUCCESS in 13m 10s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/2a7e013f1c044ff4bcee3b47e69bd0cf : SUCCESS in 6m 45s\n- grenade https://zuul.opendev.org/t/openstack/build/f88b92d2f8274946b819e1cd29970555 : SUCCESS in 1h 13m 13s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/45073fa28cc0473c89e1bce45ff407c2 : SUCCESS in 1h 38m 04s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/3da46e227d35451f968d706126134e2f : SUCCESS in 14m 54s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/b7b83f57227341fbb69267cb9cb13de7 : FAILURE in 11m 29s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/be8e01aceb04445baa00619937968238 : SUCCESS in 33m 25s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/9b0784e0b67b40aaade69d8927f6e82d : FAILURE in 17m 30s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/67db2bb06c7a4260b9a11dd8f7329d09 : FAILURE in 27m 13s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/42d9f3e5ae334702bd9139bd0ed2d859 : SUCCESS in 31m 54s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/970af5841d2c423881131f37c28e47fb : SUCCESS in 36m 55s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/d7e11e8d58674111b57caa567076f413 : SUCCESS in 37m 46s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/6f95d4d3876f4a7997454b8b807084e6 : SUCCESS in 58m 07s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/147424a596f0456185c40c3fb27195bb : SUCCESS in 43m 53s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/d146dba8eb474630a3cffd0ebc3c9227 : FAILURE in 7m 52s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":4}],"current_revision_number":4,"current_revision":"ce7dc3e858015e6fe53ebd846f8da910d0b44648","revisions":{"27326573b19caa0c978b94e167e76dc5ff6c8c5a":{"kind":"REWORK","_number":1,"created":"2026-08-25 15:57:16.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/34/1002334/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/34/1002334/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/34/1002334/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/34/1002334/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/34/1002334/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/34/1002334/1"}}},"commit":{"parents":[{"commit":"d469e099b75bf05114f5e7f15a9032694d55d19b","subject":"auth: reject delegated tokens from token-method reauthentication","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/d469e099b75bf05114f5e7f15a9032694d55d19b"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-07-21 11:06:22.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 15:56:48.000000000","tz":120},"subject":"credentials: reject delegated tokens, restrict PATCH to blob only","message":"credentials: reject delegated tokens, restrict PATCH to blob only\n\nDelegated tokens (application_credential, OAuth1, trust, and\nec2credential) could read, create, modify, or delete credentials\nvia /v3/credentials and the OS-EC2 compat endpoint. The existing\nguards only compared project_id and never treated ec2credential\nas delegated.\n\nReplace those guards with a primary-auth-only gate: any token\nwhose methods aren\u0027t entirely primary auth methods, or that\ncarries a trust_id, is rejected from GET/POST/PATCH/DELETE on\nthose endpoints. This also removes trust/OAuth1 EC2 credential\ncreation, never a deliberate feature (bug 1242597 /\nOSSA-2013-032).\n\nPATCH now only accepts `blob`; `type`, `user_id`, and\n`project_id` are immutable after creation. Delete and recreate\nthe credential to change them.\n\nNarrow the existing, deprecated\nallow_insecure_admin_trust_cross_project_credentials_access\noption (LP#2150089) to ec2-type credentials only, matching its\ndocumented use case: an admin-role trust used to list/sync EC2\ncredentials.\n\nAn empty token.methods list is treated as delegated.\n\nUses keystone.api._shared.delegation from the LP#2153453 change.\n\nCloses-Bug: #2159643\nDepends-On: https://review.opendev.org/c/openstack/tempest/+/1002295\nDepends-On: https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/1002296\nChange-Id: I0d0c0e1a1d0728655e559fbe12ed3fd117d17d33\nAssisted-by: Cursor Grok 4.6 \u003cnoreply@cursor.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n(cherry picked from commit 3a1409e4d4ebe0232b72ba2ec52b66bb53ab3b81)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/27326573b19caa0c978b94e167e76dc5ff6c8c5a"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/27326573b19caa0c978b94e167e76dc5ff6c8c5a"}]},"branch":"refs/heads/stable/2025.2"},"3425d8cea5d29da648c03bcef98b725cecc0908a":{"kind":"NO_CHANGE","_number":2,"created":"2026-08-25 22:34:14.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/34/1002334/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/34/1002334/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/34/1002334/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/34/1002334/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/34/1002334/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/34/1002334/2"}}},"commit":{"parents":[{"commit":"71749bdc725f9c3d2e3135da0fc3492e88e71f41","subject":"auth: reject delegated tokens from token-method reauthentication","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/71749bdc725f9c3d2e3135da0fc3492e88e71f41"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-07-21 11:06:22.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 22:34:14.000000000","tz":0},"subject":"credentials: reject delegated tokens, restrict PATCH to blob only","message":"credentials: reject delegated tokens, restrict PATCH to blob only\n\nDelegated tokens (application_credential, OAuth1, trust, and\nec2credential) could read, create, modify, or delete credentials\nvia /v3/credentials and the OS-EC2 compat endpoint. The existing\nguards only compared project_id and never treated ec2credential\nas delegated.\n\nReplace those guards with a primary-auth-only gate: any token\nwhose methods aren\u0027t entirely primary auth methods, or that\ncarries a trust_id, is rejected from GET/POST/PATCH/DELETE on\nthose endpoints. This also removes trust/OAuth1 EC2 credential\ncreation, never a deliberate feature (bug 1242597 /\nOSSA-2013-032).\n\nPATCH now only accepts `blob`; `type`, `user_id`, and\n`project_id` are immutable after creation. Delete and recreate\nthe credential to change them.\n\nNarrow the existing, deprecated\nallow_insecure_admin_trust_cross_project_credentials_access\noption (LP#2150089) to ec2-type credentials only, matching its\ndocumented use case: an admin-role trust used to list/sync EC2\ncredentials.\n\nAn empty token.methods list is treated as delegated.\n\nUses keystone.api._shared.delegation from the LP#2153453 change.\n\nCloses-Bug: #2159643\nDepends-On: https://review.opendev.org/c/openstack/tempest/+/1002295\nDepends-On: https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/1002296\nChange-Id: I0d0c0e1a1d0728655e559fbe12ed3fd117d17d33\nAssisted-by: Cursor Grok 4.6 \u003cnoreply@cursor.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n(cherry picked from commit 3a1409e4d4ebe0232b72ba2ec52b66bb53ab3b81)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3425d8cea5d29da648c03bcef98b725cecc0908a"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3425d8cea5d29da648c03bcef98b725cecc0908a"}]},"branch":"refs/heads/stable/2025.2","description":"Rebase","conflicts":{"base":"d469e099b75bf05114f5e7f15a9032694d55d19b","ours":"27326573b19caa0c978b94e167e76dc5ff6c8c5a","theirs":"71749bdc725f9c3d2e3135da0fc3492e88e71f41","merge_strategy":"recursive","contains_conflicts":false}},"daf7945f77bf69a9c4cbf58f44a557842ef56edd":{"kind":"REWORK","_number":3,"created":"2026-08-26 20:40:20.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/34/1002334/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/34/1002334/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/34/1002334/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/34/1002334/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/34/1002334/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/34/1002334/3"}}},"commit":{"parents":[{"commit":"71749bdc725f9c3d2e3135da0fc3492e88e71f41","subject":"auth: reject delegated tokens from token-method reauthentication","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/71749bdc725f9c3d2e3135da0fc3492e88e71f41"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-07-21 11:06:22.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-26 20:40:09.000000000","tz":120},"subject":"credentials: reject delegated tokens, restrict PATCH to blob only","message":"credentials: reject delegated tokens, restrict PATCH to blob only\n\nDelegated tokens (application_credential, OAuth1, trust, and\nec2credential) could read, create, modify, or delete credentials\nvia /v3/credentials and the OS-EC2 compat endpoint. The existing\nguards only compared project_id and never treated ec2credential\nas delegated.\n\nReplace those guards with a primary-auth-only gate: any token\nwhose methods aren\u0027t entirely primary auth methods, or that\ncarries a trust_id, is rejected from GET/POST/PATCH/DELETE on\nthose endpoints. This also removes trust/OAuth1 EC2 credential\ncreation, never a deliberate feature (bug 1242597 /\nOSSA-2013-032).\n\nPATCH now only accepts `blob`; `type`, `user_id`, and\n`project_id` are immutable after creation. Delete and recreate\nthe credential to change them.\n\nNarrow the existing, deprecated\nallow_insecure_admin_trust_cross_project_credentials_access\noption (LP#2150089) to ec2-type credentials only, matching its\ndocumented use case: an admin-role trust used to list/sync EC2\ncredentials.\n\nAn empty token.methods list is treated as delegated.\n\nUses keystone.api._shared.delegation from the LP#2153453 change.\n\nCloses-Bug: #2159643\nDepends-On: https://review.opendev.org/c/openstack/tempest/+/1002295\nDepends-On: https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/1002296\nChange-Id: I0d0c0e1a1d0728655e559fbe12ed3fd117d17d33\nAssisted-by: Cursor Grok 4.6 \u003cnoreply@cursor.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n(cherry picked from commit 3a1409e4d4ebe0232b72ba2ec52b66bb53ab3b81)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/daf7945f77bf69a9c4cbf58f44a557842ef56edd"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/daf7945f77bf69a9c4cbf58f44a557842ef56edd"}]},"branch":"refs/heads/stable/2025.2"},"ce7dc3e858015e6fe53ebd846f8da910d0b44648":{"kind":"TRIVIAL_REBASE","_number":4,"created":"2026-09-01 09:50:59.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/34/1002334/4","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/34/1002334/4","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/34/1002334/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/34/1002334/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/34/1002334/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/34/1002334/4"}}},"commit":{"parents":[{"commit":"c0f8139167179f4ffe7749516105958a2ecdc2b0","subject":"Merge \"Ban ec2credential tokens from Keystone API\" into stable/2025.2","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/c0f8139167179f4ffe7749516105958a2ecdc2b0"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-07-21 11:06:22.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-09-01 09:50:59.000000000","tz":0},"subject":"credentials: reject delegated tokens, restrict PATCH to blob only","message":"credentials: reject delegated tokens, restrict PATCH to blob only\n\nDelegated tokens (application_credential, OAuth1, trust, and\nec2credential) could read, create, modify, or delete credentials\nvia /v3/credentials and the OS-EC2 compat endpoint. The existing\nguards only compared project_id and never treated ec2credential\nas delegated.\n\nReplace those guards with a primary-auth-only gate: any token\nwhose methods aren\u0027t entirely primary auth methods, or that\ncarries a trust_id, is rejected from GET/POST/PATCH/DELETE on\nthose endpoints. This also removes trust/OAuth1 EC2 credential\ncreation, never a deliberate feature (bug 1242597 /\nOSSA-2013-032).\n\nPATCH now only accepts `blob`; `type`, `user_id`, and\n`project_id` are immutable after creation. Delete and recreate\nthe credential to change them.\n\nNarrow the existing, deprecated\nallow_insecure_admin_trust_cross_project_credentials_access\noption (LP#2150089) to ec2-type credentials only, matching its\ndocumented use case: an admin-role trust used to list/sync EC2\ncredentials.\n\nAn empty token.methods list is treated as delegated.\n\nUses keystone.api._shared.delegation from the LP#2153453 change.\n\nCloses-Bug: #2159643\nDepends-On: https://review.opendev.org/c/openstack/tempest/+/1002295\nDepends-On: https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/1002296\nChange-Id: I0d0c0e1a1d0728655e559fbe12ed3fd117d17d33\nAssisted-by: Cursor Grok 4.6 \u003cnoreply@cursor.com\u003e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n(cherry picked from commit 3a1409e4d4ebe0232b72ba2ec52b66bb53ab3b81)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/ce7dc3e858015e6fe53ebd846f8da910d0b44648"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/ce7dc3e858015e6fe53ebd846f8da910d0b44648"}]},"branch":"refs/heads/stable/2025.2","description":"Rebase","conflicts":{"base":"71749bdc725f9c3d2e3135da0fc3492e88e71f41","ours":"daf7945f77bf69a9c4cbf58f44a557842ef56edd","theirs":"c0f8139167179f4ffe7749516105958a2ecdc2b0","merge_strategy":"recursive","contains_conflicts":false}}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY"},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}