)]}'
{"id":"openstack%2Fkeystone~665231","triplet_id":"openstack%2Fkeystone~master~Ia8b35258b43213bd117df4275c907aac223342b3","project":"openstack/keystone","branch":"master","hashtags":[],"change_id":"Ia8b35258b43213bd117df4275c907aac223342b3","subject":"Implement system scope and default roles for token API","status":"MERGED","created":"2019-06-13 20:18:56.000000000","updated":"2019-06-19 14:14:12.000000000","submitted":"2019-06-19 14:13:12.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":5,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"665231-1560953592347-fc442d7a","meta_rev_id":"c50d882d9e0f76dbcba3a697c2534dd62b6c3055","_number":665231,"virtual_id_number":665231,"owner":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"value":0,"date":"2019-06-18 17:41:21.000000000","_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"value":2,"date":"2019-06-19 14:13:12.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"all":[{"value":2,"date":"2019-06-18 18:08:21.000000000","_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"value":0,"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2019-06-19 09:24:06.000000000","_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"},"all":[{"value":0,"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"value":0,"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":1,"date":"2019-06-19 09:24:06.000000000","_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2019-06-18 18:08:21.000000000","updated_by":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"reviewer":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"state":"REVIEWER"},{"updated":"2019-06-19 09:24:06.000000000","updated_by":{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"},"reviewer":{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"},"state":"REVIEWER"},{"updated":"2019-06-19 14:13:12.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"51d4a8b212677d4338136fc32446a52a880bbfce","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2019-06-13 20:18:56.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"dd83232c218b621f6c416a59adc4cd6e5eb62bb4","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2019-06-14 06:11:28.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttp://docs.openstack.org/infra/manual/developers.html#automated-testing\n\n\n- openstack-tox-cover http://logs.openstack.org/31/665231/1/check/openstack-tox-cover/a8adf57/cover/ : SUCCESS in 29m 02s\n- openstack-tox-lower-constraints http://logs.openstack.org/31/665231/1/check/openstack-tox-lower-constraints/6526bbb/ : FAILURE in 6m 10s\n- openstack-tox-pep8 http://logs.openstack.org/31/665231/1/check/openstack-tox-pep8/d90f534/ : FAILURE in 5m 02s\n- openstack-tox-py27 http://logs.openstack.org/31/665231/1/check/openstack-tox-py27/cc78044/ : SUCCESS in 30m 46s\n- openstack-tox-py36 http://logs.openstack.org/31/665231/1/check/openstack-tox-py36/fe60e62/ : SUCCESS in 23m 47s\n- openstack-tox-py37 http://logs.openstack.org/31/665231/1/check/openstack-tox-py37/24ae7d7/ : SUCCESS in 24m 38s\n- openstack-tox-docs http://logs.openstack.org/31/665231/1/check/openstack-tox-docs/4122af3/html/ : SUCCESS in 9m 36s\n- tempest-full http://logs.openstack.org/31/665231/1/check/tempest-full/79cffb5/ : SUCCESS in 1h 44m 36s\n- neutron-grenade http://logs.openstack.org/31/665231/1/check/neutron-grenade/8112fd2/ : SUCCESS in 55m 59s\n- grenade-py3 http://logs.openstack.org/31/665231/1/check/grenade-py3/88bd451/ : SUCCESS in 1h 18m 13s\n- tempest-full-py3 http://logs.openstack.org/31/665231/1/check/tempest-full-py3/571adb4/ : SUCCESS in 1h 34m 41s\n- build-openstack-releasenotes http://logs.openstack.org/31/665231/1/check/build-openstack-releasenotes/1b1f53b/html/ : SUCCESS in 11m 43s\n- keystone-dsvm-functional http://logs.openstack.org/31/665231/1/check/keystone-dsvm-functional/73f9f4f/ : SUCCESS in 30m 32s\n- keystone-dsvm-py3-functional http://logs.openstack.org/31/665231/1/check/keystone-dsvm-py3-functional/64a2f5e/ : SUCCESS in 31m 38s\n- keystone-dsvm-functional-federation-opensuse15 http://logs.openstack.org/31/665231/1/check/keystone-dsvm-functional-federation-opensuse15/e683e24/ : SUCCESS in 45m 55s (non-voting)\n- keystone-dsvm-py3-functional-federation-opensuse15 http://logs.openstack.org/31/665231/1/check/keystone-dsvm-py3-functional-federation-opensuse15/64ca8b0/ : SUCCESS in 35m 55s (non-voting)\n- keystoneclient-devstack-functional http://logs.openstack.org/31/665231/1/check/keystoneclient-devstack-functional/a627181/ : SUCCESS in 17m 32s (non-voting)\n- legacy-tempest-dsvm-ldap-domain-specific-driver http://logs.openstack.org/31/665231/1/check/legacy-tempest-dsvm-ldap-domain-specific-driver/40c15f2/ : SUCCESS in 1h 38m 40s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"9aedbad2d35c0bdf7e15278e7480119a422ecba3","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2019-06-14 13:25:21.000000000","message":"Uploaded patch set 2.","accounts_in_message":[],"_revision_number":2},{"id":"8dc3da7be837048b4a1bfef7b94aa0b0346b1f47","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2019-06-14 22:57:26.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttp://docs.openstack.org/infra/manual/developers.html#automated-testing\n\n\n- openstack-tox-cover http://logs.openstack.org/31/665231/2/check/openstack-tox-cover/1b40f9c/cover/ : SUCCESS in 33m 00s\n- openstack-tox-lower-constraints http://logs.openstack.org/31/665231/2/check/openstack-tox-lower-constraints/45437a1/ : FAILURE in 6m 12s\n- openstack-tox-pep8 http://logs.openstack.org/31/665231/2/check/openstack-tox-pep8/56c7362/ : SUCCESS in 7m 51s\n- openstack-tox-py27 http://logs.openstack.org/31/665231/2/check/openstack-tox-py27/db6928e/ : SUCCESS in 20m 30s\n- openstack-tox-py36 http://logs.openstack.org/31/665231/2/check/openstack-tox-py36/30f538d/ : SUCCESS in 23m 41s\n- openstack-tox-py37 http://logs.openstack.org/31/665231/2/check/openstack-tox-py37/9197a62/ : SUCCESS in 34m 17s\n- openstack-tox-docs http://logs.openstack.org/31/665231/2/check/openstack-tox-docs/5e24725/html/ : SUCCESS in 8m 17s\n- tempest-full http://logs.openstack.org/31/665231/2/check/tempest-full/fee2859/ : SUCCESS in 1h 51m 38s\n- neutron-grenade http://logs.openstack.org/31/665231/2/check/neutron-grenade/ad7176f/ : SUCCESS in 1h 04m 01s\n- grenade-py3 http://logs.openstack.org/31/665231/2/check/grenade-py3/dc45bf1/ : SUCCESS in 1h 04m 39s\n- tempest-full-py3 http://logs.openstack.org/31/665231/2/check/tempest-full-py3/b0b344c/ : SUCCESS in 1h 31m 12s\n- build-openstack-releasenotes http://logs.openstack.org/31/665231/2/check/build-openstack-releasenotes/220cdc0/html/ : SUCCESS in 12m 56s\n- keystone-dsvm-functional http://logs.openstack.org/31/665231/2/check/keystone-dsvm-functional/d97d155/ : SUCCESS in 29m 30s\n- keystone-dsvm-py3-functional http://logs.openstack.org/31/665231/2/check/keystone-dsvm-py3-functional/59709f6/ : SUCCESS in 34m 45s\n- keystone-dsvm-functional-federation-opensuse15 http://logs.openstack.org/31/665231/2/check/keystone-dsvm-functional-federation-opensuse15/4d0c70d/ : RETRY_LIMIT in 3m 16s (non-voting)\n- keystone-dsvm-py3-functional-federation-opensuse15 http://logs.openstack.org/31/665231/2/check/keystone-dsvm-py3-functional-federation-opensuse15/910da79/ : RETRY_LIMIT in 4m 41s (non-voting)\n- keystoneclient-devstack-functional http://logs.openstack.org/31/665231/2/check/keystoneclient-devstack-functional/5eef9f1/ : SUCCESS in 14m 10s (non-voting)\n- legacy-tempest-dsvm-ldap-domain-specific-driver http://logs.openstack.org/31/665231/2/check/legacy-tempest-dsvm-ldap-domain-specific-driver/071892f/ : SUCCESS in 1h 46m 55s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"f02a4112ea93d476cd2b7fb2f5516a7d9db246b3","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2019-06-17 15:58:33.000000000","message":"Uploaded patch set 3.","accounts_in_message":[],"_revision_number":3},{"id":"e7a290a76b03a4a7057cf32c9b8ffc7a988ec252","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2019-06-17 21:24:07.000000000","message":"Patch Set 3: Verified+1\n\nBuild succeeded (check pipeline).\n\n- openstack-tox-cover http://logs.openstack.org/31/665231/3/check/openstack-tox-cover/80b00cc/cover/ : SUCCESS in 29m 35s\n- openstack-tox-lower-constraints http://logs.openstack.org/31/665231/3/check/openstack-tox-lower-constraints/f8ac852/ : SUCCESS in 29m 20s\n- openstack-tox-pep8 http://logs.openstack.org/31/665231/3/check/openstack-tox-pep8/38ba19a/ : SUCCESS in 6m 43s\n- openstack-tox-py27 http://logs.openstack.org/31/665231/3/check/openstack-tox-py27/28779d1/ : SUCCESS in 23m 37s\n- openstack-tox-py36 http://logs.openstack.org/31/665231/3/check/openstack-tox-py36/53f32b2/ : SUCCESS in 26m 43s\n- openstack-tox-py37 http://logs.openstack.org/31/665231/3/check/openstack-tox-py37/2df7503/ : SUCCESS in 25m 22s\n- openstack-tox-docs http://logs.openstack.org/31/665231/3/check/openstack-tox-docs/7ca0690/html/ : SUCCESS in 7m 27s\n- requirements-check http://logs.openstack.org/31/665231/3/check/requirements-check/fb431cb/ : SUCCESS in 3m 03s\n- tempest-full http://logs.openstack.org/31/665231/3/check/tempest-full/2bb8fb8/ : SUCCESS in 2h 02m 49s\n- neutron-grenade http://logs.openstack.org/31/665231/3/check/neutron-grenade/654b469/ : SUCCESS in 55m 29s\n- grenade-py3 http://logs.openstack.org/31/665231/3/check/grenade-py3/c94db87/ : SUCCESS in 1h 03m 18s\n- tempest-full-py3 http://logs.openstack.org/31/665231/3/check/tempest-full-py3/a5a5233/ : SUCCESS in 1h 37m 39s\n- build-openstack-releasenotes http://logs.openstack.org/31/665231/3/check/build-openstack-releasenotes/f8ae41c/html/ : SUCCESS in 12m 24s\n- keystone-dsvm-functional http://logs.openstack.org/31/665231/3/check/keystone-dsvm-functional/a949c8d/ : SUCCESS in 33m 11s\n- keystone-dsvm-py3-functional http://logs.openstack.org/31/665231/3/check/keystone-dsvm-py3-functional/e4ebab3/ : SUCCESS in 28m 26s\n- keystone-dsvm-functional-federation-opensuse15 http://logs.openstack.org/31/665231/3/check/keystone-dsvm-functional-federation-opensuse15/2cd8b67/ : SUCCESS in 51m 47s (non-voting)\n- keystone-dsvm-py3-functional-federation-opensuse15 http://logs.openstack.org/31/665231/3/check/keystone-dsvm-py3-functional-federation-opensuse15/d1f421b/ : SUCCESS in 41m 02s (non-voting)\n- keystoneclient-devstack-functional http://logs.openstack.org/31/665231/3/check/keystoneclient-devstack-functional/268acb7/ : SUCCESS in 15m 48s (non-voting)\n- legacy-tempest-dsvm-ldap-domain-specific-driver http://logs.openstack.org/31/665231/3/check/legacy-tempest-dsvm-ldap-domain-specific-driver/8930990/ : SUCCESS in 1h 22m 58s (non-voting)","accounts_in_message":[],"_revision_number":3},{"id":"e2842de35fcbce521e9afd97ed639f3c6dd83bfb","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2019-06-18 17:36:06.000000000","message":"Patch Set 3:\n\n(2 comments)","accounts_in_message":[],"_revision_number":3},{"id":"042b4038f4c54243d0e3692c46e5b837833e0410","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2019-06-18 17:41:21.000000000","message":"Patch Set 3:\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"19d9bea0fadea0f58c810ef146d9e9d111eba993","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2019-06-18 18:08:21.000000000","message":"Patch Set 3: Code-Review+2\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"c68b941378e0d7ab5f9086213f6e806dc767c5b1","author":{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"},"date":"2019-06-19 09:24:06.000000000","message":"Patch Set 3: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":3},{"id":"832dd024e7469b3ca73b07a11805b5fea3b4fa81","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2019-06-19 09:24:37.000000000","message":"Patch Set 3: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":3},{"id":"08a256a8d082517a2d6f83894d1512b7755dbd14","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2019-06-19 14:13:12.000000000","message":"Patch Set 3: Verified+2\n\nBuild succeeded (gate pipeline).\n\n- openstack-tox-lower-constraints http://logs.openstack.org/31/665231/3/gate/openstack-tox-lower-constraints/f62ff33/ : SUCCESS in 41m 17s\n- openstack-tox-pep8 http://logs.openstack.org/31/665231/3/gate/openstack-tox-pep8/ab06caf/ : SUCCESS in 6m 03s\n- openstack-tox-py27 http://logs.openstack.org/31/665231/3/gate/openstack-tox-py27/ee9c6dc/ : SUCCESS in 24m 29s\n- openstack-tox-py36 http://logs.openstack.org/31/665231/3/gate/openstack-tox-py36/5b7e3d3/ : SUCCESS in 25m 06s\n- openstack-tox-py37 http://logs.openstack.org/31/665231/3/gate/openstack-tox-py37/ef76448/ : SUCCESS in 24m 14s\n- openstack-tox-docs http://logs.openstack.org/31/665231/3/gate/openstack-tox-docs/f0d59cc/html/ : SUCCESS in 9m 12s\n- requirements-check http://logs.openstack.org/31/665231/3/gate/requirements-check/2c3e358/ : SUCCESS in 3m 28s\n- tempest-full http://logs.openstack.org/31/665231/3/gate/tempest-full/d546912/ : SUCCESS in 1h 37m 02s\n- neutron-grenade http://logs.openstack.org/31/665231/3/gate/neutron-grenade/edbc287/ : SUCCESS in 52m 20s\n- grenade-py3 http://logs.openstack.org/31/665231/3/gate/grenade-py3/1610287/ : SUCCESS in 1h 05m 43s\n- tempest-full-py3 http://logs.openstack.org/31/665231/3/gate/tempest-full-py3/e0bd470/ : SUCCESS in 1h 42m 40s\n- build-openstack-releasenotes http://logs.openstack.org/31/665231/3/gate/build-openstack-releasenotes/95a869c/html/ : SUCCESS in 11m 18s\n- keystone-dsvm-functional http://logs.openstack.org/31/665231/3/gate/keystone-dsvm-functional/7b0f799/ : SUCCESS in 53m 20s\n- keystone-dsvm-py3-functional http://logs.openstack.org/31/665231/3/gate/keystone-dsvm-py3-functional/ed7ffaf/ : SUCCESS in 39m 00s","accounts_in_message":[],"_revision_number":3},{"id":"f3c4b2d49d987fc25684b41a5a584baad0224962","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2019-06-19 14:13:12.000000000","message":"Change has been successfully merged by Zuul","accounts_in_message":[],"_revision_number":3},{"id":"c50d882d9e0f76dbcba3a697c2534dd62b6c3055","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2019-06-19 14:14:12.000000000","message":"Patch Set 3:\n\n(1 comment)","accounts_in_message":[],"_revision_number":3}],"current_revision_number":3,"current_revision":"092570fc5ef43497c29cf174bfff43323a49fb58","revisions":{"5b917ab33b3899357c9e619ad5947c03800ede3f":{"kind":"REWORK","_number":1,"created":"2019-06-13 20:18:56.000000000","uploader":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"ref":"refs/changes/31/665231/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/31/665231/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/31/665231/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/31/665231/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/31/665231/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/31/665231/1"}}},"commit":{"parents":[{"commit":"4f16676797175f559fb5f53d7250219d767ab5ea","subject":"Merge \"Report correct domain in federated user token\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/4f16676797175f559fb5f53d7250219d767ab5ea"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2019-06-13 20:12:56.000000000","tz":0},"committer":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2019-06-13 20:17:42.000000000","tz":0},"subject":"Implement system scope and default roles for token API","message":"Implement system scope and default roles for token API\n\nThis commit adds protection testing for the token API along with\nchanges to default policies to properly consume system-scope and\ndefault roles.\n\nOriginally, this work was going to include the ability for project and\ndomain administrator to validate, check, or revoke tokens within the\ncontext of their authorization (e.g., a domain administrator could\nrevoke tokens on projects within their domain). This seems like extra\nwork for not much benefit since we\u0027re using bearer tokens. The holder\nof the token can do anything with that token, which means they can\nvalidate it or revoke it without using their own token. Adding\nproject and domain administrator support seems unnecessary given the\nexisting functionality. If someone comes forward asking for this\nfunctionality, we can re-evaluate the effort. For now, this patch is\nlimited to system user support, allowing them to validate, check, and\nrevoke any token in the system. Service users can still validate\ntokens on behalf of users. Users can do anything they wish with their\nown tokens.\n\nChange-Id: Ia8b35258b43213bd117df4275c907aac223342b3\nCloses-Bug: 1818844\nCloses-Bug: 1750676\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/5b917ab33b3899357c9e619ad5947c03800ede3f"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/5b917ab33b3899357c9e619ad5947c03800ede3f"}]},"branch":"refs/heads/master"},"b1a1c9d33720003d909dfd6d17e4b284158b8c2f":{"kind":"REWORK","_number":2,"created":"2019-06-14 13:25:21.000000000","uploader":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"ref":"refs/changes/31/665231/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/31/665231/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/31/665231/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/31/665231/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/31/665231/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/31/665231/2"}}},"commit":{"parents":[{"commit":"4f16676797175f559fb5f53d7250219d767ab5ea","subject":"Merge \"Report correct domain in federated user token\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/4f16676797175f559fb5f53d7250219d767ab5ea"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2019-06-13 20:12:56.000000000","tz":0},"committer":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2019-06-14 13:25:12.000000000","tz":0},"subject":"Implement system scope and default roles for token API","message":"Implement system scope and default roles for token API\n\nThis commit adds protection testing for the token API along with\nchanges to default policies to properly consume system-scope and\ndefault roles.\n\nOriginally, this work was going to include the ability for project and\ndomain administrator to validate, check, or revoke tokens within the\ncontext of their authorization (e.g., a domain administrator could\nrevoke tokens on projects within their domain). This seems like extra\nwork for not much benefit since we\u0027re using bearer tokens. The holder\nof the token can do anything with that token, which means they can\nvalidate it or revoke it without using their own token. Adding\nproject and domain administrator support seems unnecessary given the\nexisting functionality. If someone comes forward asking for this\nfunctionality, we can re-evaluate the effort. For now, this patch is\nlimited to system user support, allowing them to validate, check, and\nrevoke any token in the system. Service users can still validate\ntokens on behalf of users. Users can do anything they wish with their\nown tokens.\n\nChange-Id: Ia8b35258b43213bd117df4275c907aac223342b3\nCloses-Bug: 1818844\nCloses-Bug: 1750676\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/b1a1c9d33720003d909dfd6d17e4b284158b8c2f"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/b1a1c9d33720003d909dfd6d17e4b284158b8c2f"}]},"branch":"refs/heads/master"},"092570fc5ef43497c29cf174bfff43323a49fb58":{"kind":"REWORK","_number":3,"created":"2019-06-17 15:58:33.000000000","uploader":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"ref":"refs/changes/31/665231/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/31/665231/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/31/665231/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/31/665231/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/31/665231/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/31/665231/3"}}},"commit":{"parents":[{"commit":"4f16676797175f559fb5f53d7250219d767ab5ea","subject":"Merge \"Report correct domain in federated user token\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/4f16676797175f559fb5f53d7250219d767ab5ea"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2019-06-13 20:12:56.000000000","tz":0},"committer":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2019-06-17 15:57:51.000000000","tz":0},"subject":"Implement system scope and default roles for token API","message":"Implement system scope and default roles for token API\n\nThis commit adds protection testing for the token API along with\nchanges to default policies to properly consume system-scope and\ndefault roles.\n\nOriginally, this work was going to include the ability for project and\ndomain administrator to validate, check, or revoke tokens within the\ncontext of their authorization (e.g., a domain administrator could\nrevoke tokens on projects within their domain). This seems like extra\nwork for not much benefit since we\u0027re using bearer tokens. The holder\nof the token can do anything with that token, which means they can\nvalidate it or revoke it without using their own token. Adding\nproject and domain administrator support seems unnecessary given the\nexisting functionality. If someone comes forward asking for this\nfunctionality, we can re-evaluate the effort. For now, this patch is\nlimited to system user support, allowing them to validate, check, and\nrevoke any token in the system. Service users can still validate\ntokens on behalf of users. Users can do anything they wish with their\nown tokens.\n\nThis commit also bumps the minimum version of oslo.log so that we can\nuse the official TRAIN deprecated release marker.\n\nChange-Id: Ia8b35258b43213bd117df4275c907aac223342b3\nCloses-Bug: 1818844\nCloses-Bug: 1750676\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/092570fc5ef43497c29cf174bfff43323a49fb58"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/092570fc5ef43497c29cf174bfff43323a49fb58"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[],"submit_requirements":[]}