)]}'
{"id":"openstack%2Fkeystone~1005070","triplet_id":"openstack%2Fkeystone~master~I38a6313ffb25e99f5583c9f5217689795b06fb74","project":"openstack/keystone","branch":"master","attention_set":{"7973":{"account":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"last_update":"2026-09-11 10:46:13.000000000","reason":"\u003cGERRIT_ACCOUNT_27900\u003e replied on the change","reason_account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}},"7414":{"account":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"last_update":"2026-09-11 10:46:13.000000000","reason":"\u003cGERRIT_ACCOUNT_27900\u003e replied on the change","reason_account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-09-14 14:58:49.000000000","reason":"\u003cGERRIT_ACCOUNT_14250\u003e replied on the change","reason_account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}}},"removed_from_attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-09-14 14:58:49.000000000","reason":"\u003cGERRIT_ACCOUNT_14250\u003e replied on the change","reason_account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}}},"hashtags":[],"change_id":"I38a6313ffb25e99f5583c9f5217689795b06fb74","subject":"feat: Register oauth2_credential as a marker auth method","status":"NEW","created":"2026-09-10 15:22:55.000000000","updated":"2026-09-14 15:34:06.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":false,"submittable":false,"total_comment_count":6,"unresolved_comment_count":1,"has_review_started":true,"meta_rev_id":"b477329c015bbf8d64f1822d438b4974036e3206","_number":1005070,"virtual_id_number":1005070,"owner":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"tag":"autogenerated:zuul:check","value":1,"date":"2026-09-11 19:17:34.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"disliked":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":-1,"date":"2026-09-14 10:07:11.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","value":-1,"default_value":0,"optional":true},"Workflow":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-09-10 15:53:53.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"CC"},{"updated":"2026-09-10 16:55:15.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-09-11 10:46:13.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2026-09-11 10:46:13.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"state":"REVIEWER"},{"updated":"2026-09-11 10:46:13.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"state":"REVIEWER"}],"messages":[{"id":"7470d2851ffd65a84e98480d1054a5c358e0b033","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-09-10 15:22:55.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"b9d4ddfcdc2077d2deeb9c079591a5f00c017d25","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-10 15:53:53.000000000","message":"Patch Set 1:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/3392e190566f43a19c0549ca34365d50\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/523d3836544848b28387a551473b3857 : SUCCESS in 21m 44s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/5897f8a64e604699b3a7101eb13c736e : SUCCESS in 19m 41s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/8e66ef7ccc1c42cf9ec206487cddff20 : SUCCESS in 25m 22s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"5df8fa3b2018c1eb5b251c87bad2807f052af95f","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-10 16:55:15.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/00cc48a1d89144f8a94109c8432592a6\n\n- test-release-openstack https://zuul.opendev.org/t/openstack/build/0b73f1963c674dccbbef717d6b7b6bf5 : SUCCESS in 3m 17s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/a237b924259c43e59add8f5e03050830 : SUCCESS in 16m 44s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/c077816aed5c4bddb0277d7f25d63576 : SUCCESS in 5m 46s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/0304434d62694882a3ebf225d91ce1fd : SUCCESS in 11m 40s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/18f66a62d70b422b92b6ac776000d222 : SUCCESS in 12m 20s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/36f01beddd924cc2a01c7572ccf61787 : SUCCESS in 14m 39s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/0547c58856e04f4d95a448f3c3232093 : SUCCESS in 15m 37s\n- requirements-check https://zuul.opendev.org/t/openstack/build/b14d8405f18643fb832e08e1b6cdc45f : SUCCESS in 2m 31s\n- grenade https://zuul.opendev.org/t/openstack/build/f523619a22cd47828f146127d00da533 : SUCCESS in 59m 25s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/bce3f7cd43d74ef0a9cc955189e7591b : SUCCESS in 1h 29m 18s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/2535f9b3d61747568f23a16316cbb417 : SUCCESS in 13m 22s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/979ae88fe4ef4dbdb559fd2eca0fb39b : FAILURE in 19m 34s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/bf462cb77a964b50af5a4b7bcc58b51a : SUCCESS in 34m 51s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/44ba036a2a704b04a23da94d75f37089 : FAILURE in 10m 53s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/8cef7a4f069244a6b2741a274dc59f55 : FAILURE in 28m 19s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/c6f52f5c6f484aa194cbba4235020d03 : SUCCESS in 40m 34s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/4bc4b5f4287840a4b3ae4a39e7dcfb81 : SUCCESS in 34m 14s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/7bd0ba8ad62d445cacde090997ab0bf0 : SUCCESS in 27m 15s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/5d8a74aa423942d4bea0a164b8994a77 : SUCCESS in 48m 52s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/9739856e8c484c87840d6f4dba8b4d1d : SUCCESS in 46m 12s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/9f1b1891d42e4e45b968d9612b3ace3d : SUCCESS in 7m 43s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":1},{"id":"d0880101302630e8688fb2010f77f7f6b429c4b3","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-09-11 15:38:17.000000000","message":"Patch Set 1: Code-Review-1\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"7f034e0a93bb9562c732ce77d2a8c07a8bf8f870","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-09-11 17:58:36.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Code-Review-1 (copy condition: \"changekind:TRIVIAL_REBASE OR is:MIN\")\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"ac9cd7c7ce2af585fe514cbbc00cc9a974fde267","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-09-11 18:01:07.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"a69dbdf00aae7c52d553610b7285fbb006e2baf7","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-11 18:24:49.000000000","message":"Patch Set 2:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/f0218adce4c2403291974e080b34330d\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/35483f5b1d63484aa68737132594fb5a : SUCCESS in 16m 07s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/8427e1cab6c94fe591d15cdfe3ab79d7 : SUCCESS in 16m 54s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/243d4585388d44548b82474955066bf8 : SUCCESS in 23m 24s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"fd785dcfc0d0df36d50287a858f5c85dbbd300db","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-09-11 19:17:34.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/6f6bcd5f46884a2c8e7ef89b701cc5b3\n\n- test-release-openstack https://zuul.opendev.org/t/openstack/build/a6960e3edf3b424a9d77a8f33e28e822 : SUCCESS in 2m 55s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/06039ee1aa1e4a8bae838c68b0848f5b : SUCCESS in 16m 16s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/aaaebd137aea41d1ad66a4d42725810b : SUCCESS in 3m 27s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/7fae8c868f4e4783980b785f2cbe3eea : SUCCESS in 6m 59s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/98c80041fdad4f34a03108dea27c629d : SUCCESS in 9m 39s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/a7b75f109bed46f1bf65c689d1d18f5e : SUCCESS in 15m 03s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/7b39784fc4484239bd8d3848745e29be : SUCCESS in 11m 49s\n- requirements-check https://zuul.opendev.org/t/openstack/build/a40d9bfa45074859ace5b9cb57b5fede : SUCCESS in 3m 30s\n- grenade https://zuul.opendev.org/t/openstack/build/586dcd293a904623ac2d33fa3ca8362a : SUCCESS in 1h 12m 31s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/af4dd1e7a40945a29e174a6c0a38ff7a : SUCCESS in 55m 21s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/9108337554ce4e1293aac46d4122dcb2 : SUCCESS in 13m 37s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/1ed4e07cf35f47599e82075b8fa94a9b : FAILURE in 18m 08s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/dbe15f5646d844058ec048ec53d8397e : SUCCESS in 39m 16s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/60d57fece1a548ce874aea24efb3b6e5 : FAILURE in 19m 25s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/43bc21dae4a349a9866f1e588a230ce9 : FAILURE in 27m 51s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/5c743c80c7c343bd9579fa517143b852 : SUCCESS in 32m 32s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/cb5e5752bfae492b90f9126be4bd667e : SUCCESS in 50m 23s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/5614951731244417b230e509276104ee : SUCCESS in 40m 06s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/6004caf056cd49279475bae46c39d8e4 : SUCCESS in 27m 04s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/ca9e974f6f534fca8a1dcaa31b1b5b2d : SUCCESS in 26m 49s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/e7c0736a6d3c4b57bb722f55547af72b : SUCCESS in 9m 08s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":2},{"id":"bdf84ea664ce21c6e5ef19ea4b5a64c4b2b4b9bc","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-09-14 10:06:59.000000000","message":"Patch Set 1: -Code-Review\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"8d5d495b39999fd5e4da520b6b57974c51a40970","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-09-14 10:07:11.000000000","message":"Patch Set 2: Code-Review-1","accounts_in_message":[],"_revision_number":2},{"id":"95d4afc7b3334b7ef2ed3f3ccd8475125a1c28af","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-09-14 12:22:58.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"c10098014f11897995f7c2fbdf25252ad3b189c4","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-09-14 14:58:49.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"b477329c015bbf8d64f1822d438b4974036e3206","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-09-14 15:34:06.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"4ed0d9504630af61dd4e66956172452e604dfad0","revisions":{"d40512828923657edb2689399d5a9de3a3f5f5b2":{"kind":"REWORK","_number":1,"created":"2026-09-10 15:22:55.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/70/1005070/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/70/1005070/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/70/1005070/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/70/1005070/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/70/1005070/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/70/1005070/1"}}},"commit":{"parents":[{"commit":"b230bc793fa05158156d26a95a0a738aa5da5bd7","subject":"feat: Register ec2credential as a marker auth method","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/b230bc793fa05158156d26a95a0a738aa5da5bd7"}]}],"author":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-09-10 15:19:41.000000000","tz":120},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-09-10 15:22:07.000000000","tz":120},"subject":"feat: Register oauth2_credential as a marker auth method","message":"feat: Register oauth2_credential as a marker auth method\n\nTokens minted from an OAuth2 client credentials exchange (POST\n/v3/OS-OAUTH2/token with the tls_client_auth authentication method)\nrecord the oauth2_credential auth method, which was never a registered\nauth method. The fernet token provider encodes methods as a bitmask of\n[auth] methods, so the marker was silently dropped on the token payload\nround-trip: on any validation that re-read the payload (cache miss,\ndifferent process) the token looked like it had been issued with no\nauth methods at all, and the guard that rejects such tokens from\nauthorizing requests in Keystone could not recognize them. A stolen or\nleaked OAuth2 access token could therefore be used to authorize\nrequests in Keystone with the token user\u0027s project roles.\n\nRegister oauth2_credential as a deliberately non-functional auth method\nso the marker has a bit in the fernet methods bitmask and survives the\nround-trip, and is recognized as delegated-credential derived by all of\nthe guards that reject such tokens (Keystone authorization, token\nre-scoping, trust, application credential, and OAuth1 management). The\nplugin can never authenticate: OAuth2 client credentials must still be\nexchanged at the /v3/OS-OAUTH2/token endpoint, and attempts to\nauthenticate via /v3/auth/tokens are rejected with 401.\n\nThe method is appended to the end of the default [auth] methods list on\npurpose: the fernet method bitmask is positional, so appending\npreserves the bits of all existing methods and existing tokens\ncontinue to validate.\n\nWhile the method is removed from [auth] methods, the certificate-bound\ntoken flow (tls_client_auth) of POST /v3/OS-OAUTH2/token refuses to\nissue tokens (HTTP 503): a token minted without the marker would not be\nrecognized as OAuth2-credential derived on a token payload round-trip,\nso the endpoint fails closed rather than re-opening the vulnerability.\nThe client_secret_basic flow, which issues an application-credential\ntoken, is unaffected. Operators pinning an explicit methods list must\nadd the method after upgrading.\n\nAlso ensure oauth2_credential can never be reclassified as a primary\nauth method via [auth] additional_primary_auth_methods, which would\notherwise silently re-open the rescope path the guards block.\n\nAssisted-by: Qwen 3.8\nChange-Id: I38a6313ffb25e99f5583c9f5217689795b06fb74\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/d40512828923657edb2689399d5a9de3a3f5f5b2"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/d40512828923657edb2689399d5a9de3a3f5f5b2"}]},"branch":"refs/heads/master"},"4ed0d9504630af61dd4e66956172452e604dfad0":{"kind":"REWORK","_number":2,"created":"2026-09-11 17:58:36.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/70/1005070/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/70/1005070/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/70/1005070/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/70/1005070/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/70/1005070/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/70/1005070/2"}}},"commit":{"parents":[{"commit":"26c5f5275eb1f35e634ff4bcec16b3bfc1b0f039","subject":"feat: Register ec2credential as a marker auth method","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/26c5f5275eb1f35e634ff4bcec16b3bfc1b0f039"}]}],"author":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-09-10 15:19:41.000000000","tz":120},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-09-11 17:57:56.000000000","tz":120},"subject":"feat: Register oauth2_credential as a marker auth method","message":"feat: Register oauth2_credential as a marker auth method\n\nTokens minted from an OAuth2 client credentials exchange (POST\n/v3/OS-OAUTH2/token with the tls_client_auth authentication method)\nrecord the oauth2_credential auth method, which was never a registered\nauth method. The fernet token provider encodes methods as a bitmask of\n[auth] methods, so the marker was silently dropped on the token payload\nround-trip: on any validation that re-read the payload (cache miss,\ndifferent process) the token looked like it had been issued with no\nauth methods at all, and the guard that rejects such tokens from\nauthorizing requests in Keystone could not recognize them. A stolen or\nleaked OAuth2 access token could therefore be used to authorize\nrequests in Keystone with the token user\u0027s project roles.\n\nRegister oauth2_credential as a deliberately non-functional auth method\nso the marker has a bit in the fernet methods bitmask and survives the\nround-trip, and is recognized as delegated-credential derived by all of\nthe guards that reject such tokens (Keystone authorization, token\nre-scoping, trust, application credential, and OAuth1 management). The\nplugin can never authenticate: OAuth2 client credentials must still be\nexchanged at the /v3/OS-OAUTH2/token endpoint, and attempts to\nauthenticate via /v3/auth/tokens are rejected with 401.\n\nThe method is appended to the end of the default [auth] methods list on\npurpose: the fernet method bitmask is positional, so appending\npreserves the bits of all existing methods and existing tokens\ncontinue to validate.\n\nWhile the method is removed from [auth] methods, the certificate-bound\ntoken flow (tls_client_auth) of POST /v3/OS-OAUTH2/token refuses to\nissue tokens (HTTP 503): a token minted without the marker would not be\nrecognized as OAuth2-credential derived on a token payload round-trip,\nso the endpoint fails closed rather than re-opening the vulnerability.\nThe client_secret_basic flow, which issues an application-credential\ntoken, is unaffected. Operators pinning an explicit methods list must\nadd the method after upgrading.\n\nAlso ensure oauth2_credential can never be reclassified as a primary\nauth method via [auth] additional_primary_auth_methods, which would\notherwise silently re-open the rescope path the guards block.\n\nAssisted-by: Qwen 3.8\nChange-Id: I38a6313ffb25e99f5583c9f5217689795b06fb74\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/4ed0d9504630af61dd4e66956172452e604dfad0"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/4ed0d9504630af61dd4e66956172452e604dfad0"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}