)]}'
{"id":"openstack%2Fkeystone~561061","triplet_id":"openstack%2Fkeystone~master~I0ac38434ee8d2640aa5d861f75896a20af9cf9f6","project":"openstack/keystone","branch":"master","topic":"cleanup","hashtags":[],"change_id":"I0ac38434ee8d2640aa5d861f75896a20af9cf9f6","subject":"Make role reference across token scopes consistent","status":"ABANDONED","created":"2018-04-12 22:01:44.000000000","updated":"2021-11-22 21:31:34.000000000","total_comment_count":9,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"9511ee9ffead64622852d68be7abdf105f2d9314","_number":561061,"virtual_id_number":561061,"owner":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"tag":"autogenerated:zuul:check","value":1,"date":"2021-09-30 02:18:51.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"disliked":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"all":[{"value":-1,"date":"2021-11-22 21:31:34.000000000","permitted_voting_range":{"min":-1,"max":1},"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","value":-1,"default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"value":0,"permitted_voting_range":{"min":-1,"max":0},"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2019-04-25 13:00:25.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2019-04-26 18:34:18.000000000","updated_by":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"reviewer":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"state":"REVIEWER"}],"messages":[{"id":"2c87d0d82bd7e71a72a39e1966a9a459084aaa6c","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2018-04-12 22:01:44.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"bcf26255cf1a764e9967d1167980794e8d0167a3","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2018-04-12 22:02:27.000000000","message":"Patch Set 1: Workflow-1\n\nNeed to get TC approval before we can actually merge this.","accounts_in_message":[],"_revision_number":1},{"id":"43f69c02425b2c232242dd46e7feba41f5f03c7c","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2018-04-12 23:33:57.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\n\n- openstack-tox-pep8 http://logs.openstack.org/61/561061/1/check/openstack-tox-pep8/774add0/ : SUCCESS in 5m 41s\n- openstack-tox-py27 http://logs.openstack.org/61/561061/1/check/openstack-tox-py27/8fd2b12/ : SUCCESS in 13m 25s\n- openstack-tox-py35 http://logs.openstack.org/61/561061/1/check/openstack-tox-py35/206a2a8/ : SUCCESS in 11m 20s\n- build-openstack-sphinx-docs http://logs.openstack.org/61/561061/1/check/build-openstack-sphinx-docs/ee63a73/html/ : SUCCESS in 7m 18s\n- tempest-full http://logs.openstack.org/61/561061/1/check/tempest-full/648e00b/ : SUCCESS in 1h 23m 33s\n- neutron-grenade http://logs.openstack.org/61/561061/1/check/neutron-grenade/e965095/ : SUCCESS in 51m 24s\n- tempest-full-py3 http://logs.openstack.org/61/561061/1/check/tempest-full-py3/08838f7/ : SUCCESS in 1h 20m 14s\n- legacy-keystoneclient-dsvm-functional http://logs.openstack.org/61/561061/1/check/legacy-keystoneclient-dsvm-functional/ed4da0c/ : SUCCESS in 30m 15s (non-voting)\n- openstack-tox-cover http://logs.openstack.org/61/561061/1/check/openstack-tox-cover/80fc54f/cover/ : SUCCESS in 13m 30s\n- legacy-tempest-dsvm-ldap-domain-specific-driver http://logs.openstack.org/61/561061/1/check/legacy-tempest-dsvm-ldap-domain-specific-driver/76edf38/ : FAILURE in 1h 04m 41s (non-voting)\n- keystone-dsvm-functional http://logs.openstack.org/61/561061/1/check/keystone-dsvm-functional/cee1382/ : SUCCESS in 29m 11s\n- keystone-dsvm-functional-v3-only http://logs.openstack.org/61/561061/1/check/keystone-dsvm-functional-v3-only/9cf5d13/ : SUCCESS in 25m 18s (non-voting)\n- keystone-dsvm-py35-functional-v3-only http://logs.openstack.org/61/561061/1/check/keystone-dsvm-py35-functional-v3-only/de8b1b3/ : SUCCESS in 24m 28s (non-voting)\n- openstack-ansible-keystone-rolling-upgrade http://logs.openstack.org/61/561061/1/check/openstack-ansible-keystone-rolling-upgrade/6b9b91e/ : FAILURE in 26m 57s (non-voting)\n- openstack-tox-lower-constraints http://logs.openstack.org/61/561061/1/check/openstack-tox-lower-constraints/1a17836/ : SUCCESS in 11m 54s","accounts_in_message":[],"_revision_number":1},{"id":"444a12e38b05c4b0532823d85b1910467dc8b3fe","author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"date":"2018-04-13 00:56:07.000000000","message":"Patch Set 1:\n\nThis looks good. waiting for TC","accounts_in_message":[],"_revision_number":1},{"id":"9f8974ca04584d4217e3c807fd832e5d2af106d8","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2019-04-16 02:17:44.000000000","message":"Patch Set 1: Code-Review-1\n\nDo we want to go forward with this? At a minimum this definitely needs a release note.","accounts_in_message":[],"_revision_number":1},{"id":"445e08264982f4a1fa8d3def0b87b767ff7d8d5c","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2019-04-18 19:46:45.000000000","message":"Patch Set 1:\n\n\u003e Do we want to go forward with this? At a minimum this definitely\n \u003e needs a release note.\n\nDo you have a preference on the direction of this?","accounts_in_message":[],"_revision_number":1},{"id":"cdadde39671128589e65c2beaee2d5f3bbca9976","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2019-04-18 20:15:05.000000000","message":"Patch Set 1:\n\n\u003e \u003e Do we want to go forward with this? At a minimum this definitely\n \u003e \u003e needs a release note.\n \u003e \n \u003e Do you have a preference on the direction of this?\n\nI think this is worthwhile. Currently, the only attributes a role has are id, name, domain_id, and description. I think preventing data leakage has high value and removing the role description from the token is relatively low risk.","accounts_in_message":[],"_revision_number":1},{"id":"a80128dea556778aa0761906e1b853b8d5545bc5","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2019-04-19 14:59:28.000000000","message":"Uploaded patch set 2.","accounts_in_message":[],"_revision_number":2},{"id":"b20f794b3fc5d74b0ca78994689ebbb4b152c8b7","author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"date":"2019-04-22 16:17:20.000000000","message":"Patch Set 2: Code-Review+2","accounts_in_message":[],"_revision_number":2},{"id":"fd590defdca75d18ca79074e42145cc182cf46f2","author":{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"},"date":"2019-04-25 07:35:35.000000000","message":"Patch Set 3: Patch Set 2 was rebased","accounts_in_message":[],"_revision_number":3},{"id":"19a822dfed445cbdaf9c5e82443e98b888bd19eb","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2019-04-25 13:00:25.000000000","message":"Patch Set 3: Verified+1\n\nBuild succeeded (check pipeline).\n\n- openstack-tox-cover http://logs.openstack.org/61/561061/3/check/openstack-tox-cover/c022b4c/cover/ : SUCCESS in 30m 30s\n- openstack-tox-lower-constraints http://logs.openstack.org/61/561061/3/check/openstack-tox-lower-constraints/ced1736/ : SUCCESS in 32m 35s\n- openstack-tox-pep8 http://logs.openstack.org/61/561061/3/check/openstack-tox-pep8/301d209/ : SUCCESS in 5m 42s\n- openstack-tox-py27 http://logs.openstack.org/61/561061/3/check/openstack-tox-py27/fc6b2bc/ : SUCCESS in 28m 41s\n- openstack-tox-py36 http://logs.openstack.org/61/561061/3/check/openstack-tox-py36/f4c50a6/ : SUCCESS in 22m 21s\n- openstack-tox-py37 http://logs.openstack.org/61/561061/3/check/openstack-tox-py37/8fa7870/ : SUCCESS in 21m 52s\n- openstack-tox-docs http://logs.openstack.org/61/561061/3/check/openstack-tox-docs/d183801/html/ : SUCCESS in 6m 30s\n- tempest-full http://logs.openstack.org/61/561061/3/check/tempest-full/e339493/ : SUCCESS in 1h 34m 18s\n- neutron-grenade http://logs.openstack.org/61/561061/3/check/neutron-grenade/ab08098/ : SUCCESS in 1h 02m 15s\n- grenade-py3 http://logs.openstack.org/61/561061/3/check/grenade-py3/8ef3c6c/ : SUCCESS in 50m 36s\n- tempest-full-py3 http://logs.openstack.org/61/561061/3/check/tempest-full-py3/9e22220/ : SUCCESS in 1h 34m 45s\n- build-openstack-releasenotes http://logs.openstack.org/61/561061/3/check/build-openstack-releasenotes/c3627bb/html/ : SUCCESS in 9m 26s\n- keystone-dsvm-functional http://logs.openstack.org/61/561061/3/check/keystone-dsvm-functional/e583192/ : SUCCESS in 32m 38s\n- keystone-dsvm-py3-functional http://logs.openstack.org/61/561061/3/check/keystone-dsvm-py3-functional/44b553d/ : SUCCESS in 35m 46s\n- keystone-dsvm-functional-federation-opensuse15 http://logs.openstack.org/61/561061/3/check/keystone-dsvm-functional-federation-opensuse15/d4b138d/ : SUCCESS in 37m 21s (non-voting)\n- keystone-dsvm-py3-functional-federation-opensuse15 http://logs.openstack.org/61/561061/3/check/keystone-dsvm-py3-functional-federation-opensuse15/e0b9e17/ : SUCCESS in 48m 16s (non-voting)\n- keystoneclient-devstack-functional http://logs.openstack.org/61/561061/3/check/keystoneclient-devstack-functional/50a00ca/ : SUCCESS in 17m 10s (non-voting)\n- legacy-tempest-dsvm-ldap-domain-specific-driver http://logs.openstack.org/61/561061/3/check/legacy-tempest-dsvm-ldap-domain-specific-driver/f5dcf98/ : SUCCESS in 1h 47m 12s (non-voting)","accounts_in_message":[],"_revision_number":3},{"id":"9b47ade4782bf58ce088fa5d671fc62a5c7b61ab","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2019-04-26 18:34:18.000000000","message":"Patch Set 3: Code-Review-1\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"d6f9c77640b7e2286b425689e3e449cccbb70cb7","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2019-04-28 15:50:25.000000000","message":"Patch Set 3:\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"2ce5a6884e692f2e2a447512f5786c32f85cb4e8","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2019-04-28 16:52:35.000000000","message":"Patch Set 3:\n\n(5 comments)","accounts_in_message":[],"_revision_number":3},{"id":"09921a77435b885004c460c47fcafbf165ada946","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2019-04-28 22:22:30.000000000","message":"Patch Set 3:\n\n(2 comments)","accounts_in_message":[],"_revision_number":3},{"id":"5b635077b1daa2baada80b9e13ed3c28c4bb2e51","author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"date":"2020-01-28 17:17:24.000000000","message":"Removed reviewer Morgan Fainberg with the following votes:\n\n* Code-Review+2 by Morgan Fainberg \u003cmorgan.fainberg@gmail.com\u003e\n","accounts_in_message":[],"_revision_number":3},{"id":"635096e4d274189f4c0f7c4ece4080e6ae419742","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"date":"2021-09-30 00:53:24.000000000","message":"Patch Set 4: Patch Set 3 was rebased","accounts_in_message":[],"_revision_number":4},{"id":"5351054c1795a0df234b9ec2bbb7bb62c7df2846","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2021-09-30 01:56:47.000000000","message":"Patch Set 4:\n\nBuild succeeded (ARM64 pipeline).\n\n- openstack-tox-py38-arm64 https://zuul.opendev.org/t/openstack/build/ea0683bbb5ca49e897e37d2c71504717 : TIMED_OUT in 1h 01m 24s (non-voting)\n- openstack-tox-py39-arm64 https://zuul.opendev.org/t/openstack/build/d72576fe4cca4dab9c6bd41233e1887f : TIMED_OUT in 1h 01m 24s (non-voting)","accounts_in_message":[],"_revision_number":4},{"id":"449ce71a3be3f61fe8a0de62d176cca4770df72d","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2021-09-30 02:18:51.000000000","message":"Patch Set 4: Verified+1\n\nBuild succeeded (check pipeline).\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/4bbc79daae684abbb837fad350df5a43 : SUCCESS in 21m 01s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/b7c39aa6829c4b3886bf22a460963663 : SUCCESS in 6m 39s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/fa22d60ed0c44d1aafb14fd5649f0802 : SUCCESS in 17m 25s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/6b37ff38f7a24ec7b972496963b4626a : SUCCESS in 17m 52s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/273230aded0c43ccaee86c34a750d0e1 : SUCCESS in 13m 57s\n- grenade https://zuul.opendev.org/t/openstack/build/b2d7307465034ad2bf177615d1d151c7 : SUCCESS in 50m 56s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/9a549629bae44b41875896d47b943431 : SUCCESS in 1h 23m 12s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/58305a1cd2b14792a9bdfc23e02915c5 : SUCCESS in 8m 50s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/50a744a4dd8a4440aacff386c1e83b21 : SUCCESS in 38m 07s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/7cc9a4d8e35c4aac93af861a2ce0c1ff : SUCCESS in 36m 13s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-focal https://zuul.opendev.org/t/openstack/build/1b07849ab59c42eab0d39f514bb732a1 : SUCCESS in 30m 25s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-focal-k2k https://zuul.opendev.org/t/openstack/build/42cf177053684a14a6f61e91c5881865 : SUCCESS in 27m 13s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/18d19d26914848cca3d5fe50c7ecb81c : SUCCESS in 12m 21s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/856c517a93454c7b904cb28794cbbadb : FAILURE in 16m 47s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/75485b21caf74102bcff15a0a416d42f : SUCCESS in 47m 09s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/54911f7458d24c4ca585e133f0d9f9c3 : SUCCESS in 40m 39s","accounts_in_message":[],"_revision_number":4},{"id":"27261cd55e939830b4e7eecd53dac17ccf6b9f3e","tag":"autogenerated:gerrit:abandon","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2021-11-22 21:31:34.000000000","message":"Abandoned\n\nI\u0027m going to abandon this since I don\u0027t have the cycles to clean this up. If/when another API version happens, this can be considered then.","accounts_in_message":[],"_revision_number":4}],"current_revision_number":4,"current_revision":"36bc4b20fbe6c26b07eca06fc5447ef8500457bf","revisions":{"07e9636fdef2a73fad906432bafd8179d3effd27":{"kind":"REWORK","_number":1,"created":"2018-04-12 22:01:44.000000000","uploader":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"ref":"refs/changes/61/561061/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/61/561061/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/61/561061/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/61/561061/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/61/561061/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/61/561061/1"}}},"commit":{"parents":[{"commit":"96a883a5ad37a922218b6d33eec7baa206622620","subject":"Use consistent role schema in token response validation","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/96a883a5ad37a922218b6d33eec7baa206622620"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2018-04-12 21:59:36.000000000","tz":0},"committer":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2018-04-12 21:59:36.000000000","tz":0},"subject":"Make role reference across token scopes consistent","message":"Make role reference across token scopes consistent\n\nThis change makes it so that trust scoped tokens only emit the\nrole `id` and `name` when building a token response, just like\nany other token scope. This prevents unwanted data leakage if\nor when the role object is extended.\n\nChange-Id: I0ac38434ee8d2640aa5d861f75896a20af9cf9f6\nCloses-Bug: 1763510\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/07e9636fdef2a73fad906432bafd8179d3effd27"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/07e9636fdef2a73fad906432bafd8179d3effd27"}]},"branch":"refs/heads/master"},"03c2bfcd9017081ad5cddaa1e954853e1d87deed":{"kind":"REWORK","_number":2,"created":"2019-04-19 14:59:28.000000000","uploader":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"ref":"refs/changes/61/561061/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/61/561061/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/61/561061/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/61/561061/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/61/561061/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/61/561061/2"}}},"commit":{"parents":[{"commit":"cfb1da81232f90511a4d4cee58e0db6384e04cf3","subject":"Merge \"Replace support matrix ext with common library\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/cfb1da81232f90511a4d4cee58e0db6384e04cf3"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2018-04-12 21:59:36.000000000","tz":0},"committer":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2019-04-19 14:55:08.000000000","tz":0},"subject":"Make role reference across token scopes consistent","message":"Make role reference across token scopes consistent\n\nThis change makes it so that trust scoped tokens only emit the\nrole `id` and `name` when building a token response, just like\nany other token scope. This prevents unwanted data leakage if\nor when the role object is extended.\n\nThis bug was likely introduced during the implementation of\ndomain-specific roles, which added the `domain_id` key to the role\nobject. Additionally, the token provider code never validated role\nobjects when building token reponse bodies, which led to the new key\nbeing exposed via the token API unintentionally. This shouldn\u0027t happen\nin the future because the token model is simpler and it builds the\n`role` object it expects, per the API contract as opposed to just\nusing internal keystone objects.\n\nChange-Id: I0ac38434ee8d2640aa5d861f75896a20af9cf9f6\nCloses-Bug: 1763510\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/03c2bfcd9017081ad5cddaa1e954853e1d87deed"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/03c2bfcd9017081ad5cddaa1e954853e1d87deed"}]},"branch":"refs/heads/master"},"09bb40154da96aa56a6189889dfde850538cd5b8":{"kind":"TRIVIAL_REBASE","_number":3,"created":"2019-04-25 07:35:35.000000000","uploader":{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"},"ref":"refs/changes/61/561061/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/61/561061/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/61/561061/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/61/561061/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/61/561061/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/61/561061/3"}}},"commit":{"parents":[{"commit":"f185d6630e2ea7cd3ccef5322f2ad78aad1ef982","subject":"Merge \"Fix werkzeug imports for version 0.15.x\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/f185d6630e2ea7cd3ccef5322f2ad78aad1ef982"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2018-04-12 21:59:36.000000000","tz":0},"committer":{"name":"wangxiyuan","email":"wangxiyuan@huawei.com","date":"2019-04-25 07:35:35.000000000","tz":0},"subject":"Make role reference across token scopes consistent","message":"Make role reference across token scopes consistent\n\nThis change makes it so that trust scoped tokens only emit the\nrole `id` and `name` when building a token response, just like\nany other token scope. This prevents unwanted data leakage if\nor when the role object is extended.\n\nThis bug was likely introduced during the implementation of\ndomain-specific roles, which added the `domain_id` key to the role\nobject. Additionally, the token provider code never validated role\nobjects when building token reponse bodies, which led to the new key\nbeing exposed via the token API unintentionally. This shouldn\u0027t happen\nin the future because the token model is simpler and it builds the\n`role` object it expects, per the API contract as opposed to just\nusing internal keystone objects.\n\nChange-Id: I0ac38434ee8d2640aa5d861f75896a20af9cf9f6\nCloses-Bug: 1763510\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/09bb40154da96aa56a6189889dfde850538cd5b8"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/09bb40154da96aa56a6189889dfde850538cd5b8"}]},"branch":"refs/heads/master"},"36bc4b20fbe6c26b07eca06fc5447ef8500457bf":{"kind":"TRIVIAL_REBASE","_number":4,"created":"2021-09-30 00:53:24.000000000","uploader":{"_account_id":2218,"name":"Adam Young","email":"adam@younglogic.com","username":"ayoung"},"ref":"refs/changes/61/561061/4","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/61/561061/4","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/61/561061/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/61/561061/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/61/561061/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/61/561061/4"}}},"commit":{"parents":[{"commit":"cf5f1e5651052be52f17beeb400ac433303a9602","subject":"Merge \"Replace deprecated import of ABCs from collections\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/cf5f1e5651052be52f17beeb400ac433303a9602"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2018-04-12 21:59:36.000000000","tz":0},"committer":{"name":"Adam Young","email":"adam@younglogic.com","date":"2021-09-30 00:53:24.000000000","tz":0},"subject":"Make role reference across token scopes consistent","message":"Make role reference across token scopes consistent\n\nThis change makes it so that trust scoped tokens only emit the\nrole `id` and `name` when building a token response, just like\nany other token scope. This prevents unwanted data leakage if\nor when the role object is extended.\n\nThis bug was likely introduced during the implementation of\ndomain-specific roles, which added the `domain_id` key to the role\nobject. Additionally, the token provider code never validated role\nobjects when building token reponse bodies, which led to the new key\nbeing exposed via the token API unintentionally. This shouldn\u0027t happen\nin the future because the token model is simpler and it builds the\n`role` object it expects, per the API contract as opposed to just\nusing internal keystone objects.\n\nChange-Id: I0ac38434ee8d2640aa5d861f75896a20af9cf9f6\nCloses-Bug: 1763510\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/36bc4b20fbe6c26b07eca06fc5447ef8500457bf"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/36bc4b20fbe6c26b07eca06fc5447ef8500457bf"}]},"branch":"refs/heads/master","description":"Rebase"}},"requirements":[],"submit_records":[],"submit_requirements":[]}