)]}'
{"id":"openstack%2Fkeystone~1002408","triplet_id":"openstack%2Fkeystone~master~I23d66ac4381a5c7064bd135bf890ec6c6823b628","project":"openstack/keystone","branch":"master","hashtags":[],"change_id":"I23d66ac4381a5c7064bd135bf890ec6c6823b628","subject":"Add atomic revoke-all-access for user token generators","status":"NEW","created":"2026-08-25 23:18:13.000000000","updated":"2026-08-26 01:26:15.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"8d22267f129e1b1add839b5bd0c6195f18980698","_number":1002408,"virtual_id_number":1002408,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:check","value":1,"date":"2026-08-26 01:07:04.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-26 01:07:04.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"f31d1aa4c9fbacab94efc1a8c0c3863250aedac4","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 23:18:13.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"054e3cb76c6e9d38ecd3d85b6fbca5d2a48ddffb","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 23:24:24.000000000","message":"Patch Set 1:\n\nThis change is ready for review.","accounts_in_message":[],"_revision_number":1},{"id":"c666f3bc1b51608076ab90e402ca8ba122c0db61","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-26 01:07:04.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/2f8e435890ea4384b942a8397d8bd4b1\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/c27e3565b6a54920a5b13d7704b5f198 : SUCCESS in 17m 59s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/04893ae88c74476f87d48be44a89f45d : SUCCESS in 5m 48s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/7464001e3a95481c9cd5d92b04829735 : SUCCESS in 12m 04s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/16a3e115af884073840993610dccfd4b : SUCCESS in 10m 27s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/bf12781b8f7043a6a964b16fbb3536d8 : SUCCESS in 14m 49s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/d6ab738a1e034ebb9f635942051906c1 : SUCCESS in 13m 56s\n- grenade https://zuul.opendev.org/t/openstack/build/cbd2855c8b7548c29b964e5a3814ef70 : SUCCESS in 1h 07m 12s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/0f9a95ec2eb74f8da5dbb7bb1ed1f95f : SUCCESS in 1h 41m 37s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/9e16f3226f2148f7910156cfa2a592a4 : SUCCESS in 13m 30s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/64f2fe5990274f7f9d5f1854ac562023 : SUCCESS in 10m 52s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/97d4b81b60fd422791abc8c19db120c5 : SUCCESS in 1h 05m 47s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/bc45ae9006614475adeb27aed7636bc2 : FAILURE in 14m 02s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/4ad941807c524df1a652abb2583be90d : FAILURE in 27m 27s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/077507da3a3c406593fa1924d9833df0 : SUCCESS in 56m 35s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/e3ae954b4aed4c5f9e01ef697c9ba0c6 : SUCCESS in 36m 45s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/47533f15be944e38adac5fe6e00a5a8f : SUCCESS in 38m 21s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/f8539266739349cab8ed371db614b6af : SUCCESS in 1h 01m 45s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/0e76cb6d851e448c88ad949b76192623 : SUCCESS in 18m 04s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/ce450c4ce2b04ab380ccfe652a46f675 : RETRY_LIMIT in 7m 11s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":1},{"id":"8d22267f129e1b1add839b5bd0c6195f18980698","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-26 01:26:15.000000000","message":"Patch Set 1:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/368eaf6947ec43cc9b8cc2aad79bd718\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/1bf18ae50a1c4d47a39ccf57a60221b6 : SUCCESS in 21m 04s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/75bfb73b223549979d068b148d5dae60 : SUCCESS in 19m 57s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/e56340f2518f4744b557ec3beb47bf03 : SUCCESS in 33m 23s (non-voting)","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"c4b8263d01af83a8ec965c0b9767a307ddec1990","revisions":{"c4b8263d01af83a8ec965c0b9767a307ddec1990":{"kind":"REWORK","_number":1,"created":"2026-08-25 23:18:13.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/08/1002408/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/08/1002408/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/08/1002408/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/08/1002408/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/08/1002408/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/08/1002408/1"}}},"commit":{"parents":[{"commit":"16afc813b7e6de727d8a91e065d7824b06e32925","subject":"Merge \"Abandon server-side paged search cursor when sizelimit is reached\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/16afc813b7e6de727d8a91e065d7824b06e32925"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-06-29 07:48:08.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:18:06.000000000","tz":120},"subject":"Add atomic revoke-all-access for user token generators","message":"Add atomic revoke-all-access for user token generators\n\nExtend DELETE /v3/users/{id}/tokens with an optional\n?include_generators\u003dtrue query parameter. When set, the endpoint\natomically deletes every long-lived token generator belonging to the\nuser -- trusts (where user is trustor), application credentials, EC2\ncredentials, and OAuth1 access tokens -- before issuing a user-scoped\nrevocation event.\n\nExtend POST /v3/users/{id}/password with a matching\n?revoke_all_access\u003dtrue query parameter. When set, the endpoint calls\nthe same generator cleanup after the password change succeeds. This\ngives users a single-call emergency response for a suspected\ncompromise: the password change invalidates existing sessions while the\ngenerator cleanup prevents an attacker who holds a pre-existing\ncredential from producing new tokens.\n\nTo close the race window between the deletion sweep and the revocation\nevent, a tokens_valid_from user option (stored in user.options) is set\nto one second in the future before the revocation event is emitted.\nAny generator-based authentication (application credentials, EC2,\nOAuth1, trusts) is rejected while tokens_valid_from is in the future,\nblocking generators created in the race window from being usable.\nThe implementation sleeps for one second before returning so that the\ngrace period has expired by the time the caller receives the response,\nallowing rotation scripts to immediately create new generators.\n\nBoth parameters are opt-in; default behavior is unchanged.\n\nCloses-Bug: #2153447\n\nAssisted-by: claude-sonnet-4-5 \u003cnoreply@anthropic.com\u003e\nChange-Id: I23d66ac4381a5c7064bd135bf890ec6c6823b628\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/c4b8263d01af83a8ec965c0b9767a307ddec1990"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/c4b8263d01af83a8ec965c0b9767a307ddec1990"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY"},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}