)]}'
{"id":"openstack%2Fkeystone~1002413","triplet_id":"openstack%2Fkeystone~stable%2F2025.2~Ice4a656e8deefd8538e10ad8d8d1fb12a3e3d12d","project":"openstack/keystone","branch":"stable/2025.2","attention_set":{},"removed_from_attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-08-31 15:45:30.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"Ice4a656e8deefd8538e10ad8d8d1fb12a3e3d12d","subject":"Prevent unauthorized project-scoped assignment list","status":"MERGED","created":"2026-08-25 23:26:45.000000000","updated":"2026-08-31 15:47:06.000000000","submitted":"2026-08-31 15:45:30.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"1002413","meta_rev_id":"22efbc058d178b3135d570e582e6af4934613381","_number":1002413,"virtual_id_number":1002413,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-08-31 15:45:30.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":2,"date":"2026-08-31 13:46:26.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":1,"date":"2026-08-31 13:46:26.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-08-25 23:26:45.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"CC"},{"updated":"2026-08-26 01:06:09.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-08-31 13:46:26.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"REVIEWER"}],"messages":[{"id":"54b8cef15d0894feb584b0869a52ff3fafd1d039","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 23:26:45.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"837f7641138834c1d28150c9332145f7a7033f6e","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-25 23:51:24.000000000","message":"Patch Set 1:\n\nThis change is ready for review.","accounts_in_message":[],"_revision_number":1},{"id":"d2333900bd386d8c174d972be28a453fa1c121fb","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-26 01:06:09.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/10f095ef01da4e4dbecfd18b51e0d532\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/e5e7e54ff54f4fab9b79f38288974c63 : SUCCESS in 20m 43s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/4247343d79d24895b49decf661ecaa3f : SUCCESS in 7m 41s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/453615ec9654400a99c136df1b6f4e74 : SUCCESS in 14m 40s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/b012ea0e388343fc908908650cda1776 : SUCCESS in 12m 27s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/b3a866adfc2e4370a8c54663b19349f6 : SUCCESS in 18m 34s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/90da376c6fda45cda05a3664d61c533e : SUCCESS in 12m 16s\n- grenade https://zuul.opendev.org/t/openstack/build/582ff38380af4e2b98391a85024e63a6 : SUCCESS in 34m 24s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/50beaccdd8c4495aadf61c37a4b95030 : SUCCESS in 1h 33m 53s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/8a537a52d1b946a3bc842f0c9e613891 : SUCCESS in 6m 25s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/9a67b240cd4b47028abb4412620f8d50 : SUCCESS in 14m 17s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/b892f3abcbeb4684bb777e4cd4e97e03 : SUCCESS in 35m 36s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/3eb77c79b5f84307a1fc9af0a07c6bcc : FAILURE in 12m 08s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/bd2c4c2177274297bcdaaedea401901a : FAILURE in 30m 52s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/90d65e01e6f9428e9d02fdf59eee0b7b : SUCCESS in 25m 23s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/923516a81f6448a5a1ba967c19ac28be : SUCCESS in 16m 14s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/33ddaed7ac6a4ee69ca89ae17db7d129 : SUCCESS in 18m 54s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/a786c7a676fc486fa74bea07dec32796 : SUCCESS in 55m 56s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/376f67e1b5954af6aeac950e7e6045c8 : FAILURE in 24m 25s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/dc97343a81f94deba6554417b749fe43 : FAILURE in 5m 06s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":1},{"id":"621378acaf904db51037dcd72bba4afd34c5158f","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-08-27 11:48:24.000000000","message":"Patch Set 1:\n\nrecheck - protection-functional skip fixed by 1002440 (merged)","accounts_in_message":[],"_revision_number":1},{"id":"c8fb0b7b71ec44e9329c1dd47337300f0d5f2faa","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-27 12:44:19.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/591ce82798614f3a84e5980ca24acb69\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/35425a1e04764906abbd1d1fe45124cf : SUCCESS in 19m 03s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/cf1a0743dd384c27802512e8c55a96a1 : SUCCESS in 3m 34s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/2a30369e663f4f718784112a2d191cf0 : SUCCESS in 14m 45s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/63d396137a9c4f4794746cc596c1eabb : SUCCESS in 12m 31s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/0908297dc542414cb26a459ec87f5c4e : SUCCESS in 15m 46s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/692368130c9740cb88a8cf730da29554 : SUCCESS in 13m 59s\n- grenade https://zuul.opendev.org/t/openstack/build/d554364d37d54ccba6d38a4587daf5bc : SUCCESS in 53m 14s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/9f304db50e5e4ca2b9626341d0ce3e72 : SUCCESS in 53m 12s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/30c506be99c74a668869d720cb99ebd1 : SUCCESS in 13m 29s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/e24fd351537a4e7692efba560b9d6e65 : SUCCESS in 8m 23s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/d6c8ab8441714cd2ad98ce8f6eaeef50 : SUCCESS in 13m 47s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/86c5528de4004168b2a428c5351f8fbf : FAILURE in 13m 10s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/67dcbf0a7b6a4c21a886354d3bc58596 : FAILURE in 20m 08s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/2eec9a84637a48c1b1b67dc41c1c42a5 : SUCCESS in 26m 35s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/ceaacc68d1bb4ce79f8f21a0e661257b : SUCCESS in 32m 23s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/08d3ed772a02409b9b6f54f6dde97064 : SUCCESS in 37m 39s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/a8be6a1d3fa94487b1c20d8d6db7f6d2 : SUCCESS in 50m 02s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/ef12231717874fb0bdcc3bcacb2ee657 : SUCCESS in 42m 08s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/37f69af1ea154ee6af629387479f9465 : FAILURE in 8m 06s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":1},{"id":"72026f728b62c009f93a795ce3cd6113b336448f","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-08-31 13:46:26.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"91313e2909521eb1d8ad3d73144f74a0e3b184dd","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 13:46:56.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"c9a361ed07cb119234ff115528a46cd76bcf7c76","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 15:45:30.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/2d0f349fcaec4e849c8560c0ea6e6949\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/988666a25e75487c8a94f40dcf2a84f8 : SUCCESS in 6m 31s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/199202e1f7a94d2ab2745e7ad96e7627 : SUCCESS in 14m 43s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/b8ef65ce187c49bc89a08d2ac42aadfe : SUCCESS in 8m 27s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/224bb7062c1e4af99c2c29356fd6d3f5 : SUCCESS in 14m 05s\n- grenade https://zuul.opendev.org/t/openstack/build/666a5e53fdef40c6bf49c51cd9742f41 : SUCCESS in 1h 15m 52s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/f41e150ed5924859a10aea4f4d1eea54 : SUCCESS in 55m 57s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/dc64d8111250445a9b6822dc4de42587 : SUCCESS in 13m 31s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/470e2427bd6449caa5bd0ba786b052d8 : SUCCESS in 37m 55s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/18211d31128444479e32b54aa8cf1c2c : SUCCESS in 16m 04s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/4a2458a980364894ad1a69f62f011216 : SUCCESS in 1h 09m 22s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/0253f5faf90a40ce830644e5c9cf2363 : SUCCESS in 47m 14s","accounts_in_message":[],"_revision_number":1},{"id":"5206b7831cd45dc786b9b7575d1f9964f843e6d1","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 15:45:30.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1},{"id":"22efbc058d178b3135d570e582e6af4934613381","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-31 15:47:06.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/2494967d795a4f3480b5c7d11b0066b4\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/0d9e221fd7bc4c4c8edef8adacd5845d : SUCCESS in 1m 24s\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/de14ebbaaedf42e9bd152c3f51c6cb5d : SUCCESS in 50s","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"9186da9ae41f27e61403403ba0962624ebe43dec","revisions":{"9186da9ae41f27e61403403ba0962624ebe43dec":{"kind":"REWORK","_number":1,"created":"2026-08-25 23:26:45.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/13/1002413/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/13/1002413/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/13/1002413/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/13/1002413/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/13/1002413/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/13/1002413/1"}}},"commit":{"parents":[{"commit":"3dfbbe7b9bd11dcd64420da0e4eda48b637f4a70","subject":"Merge \"Fix project policy allowing unauthorized access to root domains\" into stable/2025.2","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3dfbbe7b9bd11dcd64420da0e4eda48b637f4a70"}]}],"author":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-08-04 11:51:03.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-08-25 23:26:24.000000000","tz":120},"subject":"Prevent unauthorized project-scoped assignment list","message":"Prevent unauthorized project-scoped assignment list\n\nAny user holding `role:reader` on any project could list all role\nassignments under any domain by passing a domain ID as\n`scope.project.id` to `GET /v3/role_assignments?include_subtree`.\nDomain projects store `domain_id\u003dnull`, which matched the `null`\n`domain_id` of any project-scoped token in the oslo.policy string\ncomparison, bypassing the domain-reader restriction.  An explicit `not\nNone:%(target.domain_id)s` guard has been added to the affected policy\nrules.\n\nCloses-Bug: #2154645\nChange-Id: Ice4a656e8deefd8538e10ad8d8d1fb12a3e3d12d\nCo-Authored-By: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit eb27f4e309708746a8e7a5f0ad7e9a510e47ff0b)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/9186da9ae41f27e61403403ba0962624ebe43dec"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/9186da9ae41f27e61403403ba0962624ebe43dec"}]},"branch":"refs/heads/stable/2025.2"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}