)]}'
{"id":"openstack%2Fkeystone~676528","triplet_id":"openstack%2Fkeystone~master~I669cd1675dcc3663aecf0e5882a3e53a3d77c1e0","project":"openstack/keystone","branch":"master","topic":"trust-policies","hashtags":[],"change_id":"I669cd1675dcc3663aecf0e5882a3e53a3d77c1e0","subject":"Don\u0027t reveal trust existence to unauthorized users","status":"ABANDONED","created":"2019-08-14 22:43:49.000000000","updated":"2019-08-16 22:04:09.000000000","total_comment_count":8,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"c2056b68453095b80861b8ec65b28246c5506374","_number":676528,"virtual_id_number":676528,"owner":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},{"value":1,"date":"2019-08-15 22:23:16.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"value":2,"date":"2019-08-15 21:06:42.000000000","permitted_voting_range":{"min":-1,"max":1},"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},{"value":2,"date":"2019-08-16 05:59:03.000000000","permitted_voting_range":{"min":-1,"max":1},"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2019-08-16 08:54:32.000000000","permitted_voting_range":{"min":-1,"max":1},"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"all":[{"value":-1,"date":"2019-08-16 21:20:42.000000000","permitted_voting_range":{"min":-1,"max":0},"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"value":1,"date":"2019-08-16 21:05:46.000000000","_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2019-08-15 22:23:16.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2019-08-16 05:59:03.000000000","updated_by":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"reviewer":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"state":"REVIEWER"},{"updated":"2019-08-16 08:54:32.000000000","updated_by":{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"},"reviewer":{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"},"state":"REVIEWER"},{"updated":"2019-08-16 21:05:46.000000000","updated_by":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"reviewer":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"state":"REVIEWER"}],"messages":[{"id":"08f58af4d99d649fa5105da11a7094a167b90718","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2019-08-14 22:43:49.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"9a9aa5cd6e4b8f6ec85595dbb3f3fedabda98fdd","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2019-08-15 01:37:46.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttp://docs.openstack.org/infra/manual/developers.html#automated-testing\n\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/32b780f149584db0b91f1b3eef6412d9 : SUCCESS in 37m 41s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/892b0b0c831340d4b1721ea5112f6ff8 : SUCCESS in 32m 45s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/9bf9120ef8c34fcfb7b310fdae93175e : SUCCESS in 5m 44s\n- openstack-tox-py27 https://zuul.opendev.org/t/openstack/build/3155fb96e710440d9252935f69381d94 : SUCCESS in 32m 34s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/b2ed548d9bb74108a57631bad82c53de : SUCCESS in 27m 28s\n- openstack-tox-py37 https://zuul.opendev.org/t/openstack/build/015387b775954e46815759cee910b886 : SUCCESS in 26m 34s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/35109f3b524d451b84d2b5cf53a4e03b : SUCCESS in 8m 11s\n- tempest-full https://zuul.opendev.org/t/openstack/build/2839eec462d146da9ad86767585d6c0e : FAILURE in 1h 31m 58s\n- neutron-grenade https://zuul.opendev.org/t/openstack/build/5287a6a5cc9e4d96a814970472f015ce : FAILURE in 1h 04m 45s\n- grenade-py3 https://zuul.opendev.org/t/openstack/build/de7ebcdc801e4dcba3195a75fde1d5c3 : FAILURE in 56m 41s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/cb1eb52c73f247eba266df8e0c28cf9a : FAILURE in 1h 00m 21s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/619ce4f56b7040979e5692976f4fa010 : SUCCESS in 11m 00s\n- keystone-dsvm-functional https://zuul.opendev.org/t/openstack/build/db6cc1f0dbdd4dbf95a106e9c50ffc74 : SUCCESS in 31m 43s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/34d71dcc44a1421594ae13bcff82022a : SUCCESS in 35m 03s\n- keystone-dsvm-functional-federation-opensuse15 https://zuul.opendev.org/t/openstack/build/ea7eab749765433ea223168b63bde4ee : SUCCESS in 30m 31s (non-voting)\n- keystone-dsvm-py3-functional-federation-opensuse15 https://zuul.opendev.org/t/openstack/build/b20ed561ca4e4e77af3daabda487342c : SUCCESS in 36m 39s (non-voting)\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/ed981e1ce73b47cf97457ff313a071e0 : SUCCESS in 13m 51s (non-voting)\n- legacy-tempest-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/5db8391073104ab487ddfe0807bcbb18 : FAILURE in 1h 18m 44s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/20a4a517faa74df79e99d4f835e642c8 : FAILURE in 1h 02m 37s","accounts_in_message":[],"_revision_number":1},{"id":"933b793129f2ceff2a95b79f52576a5a4aac5199","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2019-08-15 17:00:34.000000000","message":"Uploaded patch set 2: Commit message was updated.","accounts_in_message":[],"_revision_number":2},{"id":"876614e926b0536c58c16cabbf26ea954a5981cb","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2019-08-15 18:07:55.000000000","message":"Uploaded patch set 3: Commit message was updated.","accounts_in_message":[],"_revision_number":3},{"id":"e622172e6ef467d46b54b94deb08a6529b63c085","author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"date":"2019-08-15 18:45:13.000000000","message":"Patch Set 3: Code-Review+2\n\n(3 comments)","accounts_in_message":[],"_revision_number":3},{"id":"66ee52a3f5b6450d81705e0eb4bc9ba04c829880","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2019-08-15 19:23:46.000000000","message":"Patch Set 3:\n\n(2 comments)","accounts_in_message":[],"_revision_number":3},{"id":"c71feb657afe9d7e25437e25042094691a4c8a27","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2019-08-15 20:01:02.000000000","message":"Patch Set 3: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttp://docs.openstack.org/infra/manual/developers.html#automated-testing\n\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/6b177b0f31834e438d1cb5c1985f822e : SUCCESS in 44m 57s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/7c9d2d1c2e774b18b52c4ac1a954c7e2 : SUCCESS in 34m 35s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/6cf83a7f3a2c4f11978799d25130b2ef : SUCCESS in 5m 59s\n- openstack-tox-py27 https://zuul.opendev.org/t/openstack/build/d64fd40f0a484cf284961076d75cf675 : SUCCESS in 24m 34s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/2b2211def4e54d1296db5a4b73e656d3 : SUCCESS in 32m 15s\n- openstack-tox-py37 https://zuul.opendev.org/t/openstack/build/4f61eac8b11d4862b46fe22faed24402 : SUCCESS in 21m 24s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/261eba34ef8e41d68b462a9f19ee8be8 : SUCCESS in 12m 18s\n- tempest-full https://zuul.opendev.org/t/openstack/build/11c2dcd6243b40c6afd091fcccf014ed : FAILURE in 1h 24m 34s\n- neutron-grenade https://zuul.opendev.org/t/openstack/build/df9d8d2fcf754723afed37c35816c8df : FAILURE in 39m 02s\n- grenade-py3 https://zuul.opendev.org/t/openstack/build/71e259098b2249c68fcedb2145c588c3 : FAILURE in 49m 36s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/f7d91079479a4a3aadcbdc915ed62a78 : FAILURE in 1h 10m 29s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/7ab71a592d7340bda52afe8b89638ba0 : SUCCESS in 14m 17s\n- keystone-dsvm-functional https://zuul.opendev.org/t/openstack/build/5202f8a87b044237932e3e02f6faf564 : SUCCESS in 34m 17s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/c0d923686e584e63b25168c7f4b74b10 : SUCCESS in 31m 28s\n- keystone-dsvm-functional-federation-opensuse15 https://zuul.opendev.org/t/openstack/build/0290b8f5127944c1823236b73f444cc9 : SUCCESS in 39m 56s (non-voting)\n- keystone-dsvm-py3-functional-federation-opensuse15 https://zuul.opendev.org/t/openstack/build/1b279600f7dc4c7c9f080a77ab6a826a : SUCCESS in 43m 23s (non-voting)\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/2ccad1d7903f4527bbca31264c7a1985 : SUCCESS in 19m 21s (non-voting)\n- legacy-tempest-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/7bcb54c07f334c6898c36ffc731f3137 : FAILURE in 1h 17m 13s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/d3b9cbfcc7a2480182a286e99af26d4d : FAILURE in 1h 04m 24s","accounts_in_message":[],"_revision_number":3},{"id":"b8f010bbb2911623e1bf266de699f0e2f45ae5b4","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2019-08-15 20:41:14.000000000","message":"Uploaded patch set 4.","accounts_in_message":[],"_revision_number":4},{"id":"09e5ab12553e788bcb2da23c10b4278f0d82d523","author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"date":"2019-08-15 21:06:42.000000000","message":"Patch Set 4: Code-Review+2\n\nStill +2, obviously pending zuul passing.","accounts_in_message":[],"_revision_number":4},{"id":"3137614aa6646b5951802a0e1bfa2b609b1c155b","author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"date":"2019-08-15 21:09:16.000000000","message":"Patch Set 4:\n\n(1 comment)","accounts_in_message":[],"_revision_number":4},{"id":"ad2e32b8d2444052f18cb47e81c35e3d243e6972","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2019-08-15 21:59:00.000000000","message":"Patch Set 4:\n\n(1 comment)","accounts_in_message":[],"_revision_number":4},{"id":"6ee9e4535b1a3c4d514cbb43234e3e1933a2df2e","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2019-08-15 22:23:16.000000000","message":"Patch Set 4: Verified+1\n\nBuild succeeded (check pipeline).\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/d50cc77bce3e41e18e6c761ed3f59d3b : SUCCESS in 33m 08s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/e67d8a66466f445c8a0087cd554116ad : SUCCESS in 30m 28s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/55b01779e0e5432488593a4f5774c291 : SUCCESS in 7m 17s\n- openstack-tox-py27 https://zuul.opendev.org/t/openstack/build/f60ab31b428d438f9670310ae9afb2af : SUCCESS in 29m 33s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/c48c25e19b3749b78cd5c106dc2f8167 : SUCCESS in 30m 25s\n- openstack-tox-py37 https://zuul.opendev.org/t/openstack/build/0c2ac5cc0d9a4ce6881952487def5619 : SUCCESS in 26m 17s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/f5969d48b4da48ceb37285a830390d4a : SUCCESS in 12m 16s\n- tempest-full https://zuul.opendev.org/t/openstack/build/59091e3b87564fae9dd8914a87f61537 : SUCCESS in 1h 35m 25s\n- neutron-grenade https://zuul.opendev.org/t/openstack/build/83eee1b6f593466ea58afe9ac15f88ac : SUCCESS in 54m 57s\n- grenade-py3 https://zuul.opendev.org/t/openstack/build/5bfd19e92671411aa42d885ed48721a1 : SUCCESS in 1h 07m 05s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/2b0bbe7e7eb0446c8e0a9663b4d728ee : SUCCESS in 1h 20m 57s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/fa2dca4e79a0420ea0bba4b19258828b : SUCCESS in 12m 33s\n- keystone-dsvm-functional https://zuul.opendev.org/t/openstack/build/3fe64de97c1b4645be5be33d35350d08 : SUCCESS in 36m 56s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/c9ca90e1f6204678b0d44bc104886451 : SUCCESS in 37m 51s\n- keystone-dsvm-functional-federation-opensuse15 https://zuul.opendev.org/t/openstack/build/5332fb17f0df4132a768d80d21b1a122 : SUCCESS in 43m 33s (non-voting)\n- keystone-dsvm-py3-functional-federation-opensuse15 https://zuul.opendev.org/t/openstack/build/f5996f17e3db4740b6a8e83c040fef28 : SUCCESS in 37m 11s (non-voting)\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/3cc5a71d7c064aa69d6ee0ba0c6ec74c : SUCCESS in 19m 46s (non-voting)\n- legacy-tempest-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/98079f378f3f44479bf6f95a5ba57275 : SUCCESS in 1h 35m 48s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/6bf4875f53a24f3faf9be8e2fd846902 : SUCCESS in 1h 20m 49s","accounts_in_message":[],"_revision_number":4},{"id":"d56c70451dd89a60419782c6f268022eb13eca76","author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"date":"2019-08-16 05:59:03.000000000","message":"Patch Set 4: Code-Review+2\n\n(1 comment)","accounts_in_message":[],"_revision_number":4},{"id":"35dd9256f922fc6c8e9f416bad5bb528210ce2e4","author":{"_account_id":15054,"name":"wangxiyuan","email":"wangxiyuan1007@gmail.com","username":"wangxiyuan"},"date":"2019-08-16 08:54:32.000000000","message":"Patch Set 4: Code-Review+2","accounts_in_message":[],"_revision_number":4},{"id":"65e32ac620db9bb734d7e661c52418021e26feea","author":{"_account_id":2903,"name":"Morgan Fainberg","email":"morgan.fainberg@gmail.com","username":"mdrnstm"},"date":"2019-08-16 21:05:46.000000000","message":"Patch Set 4: Workflow+1","accounts_in_message":[],"_revision_number":4},{"id":"63d79053cff687fbcbcb2664e7f42f2c0b841904","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2019-08-16 21:20:42.000000000","message":"Patch Set 4: Workflow-1\n\nThere\u0027s disagreement on whether the bug is valid https://launchpad.net/bugs/1840288","accounts_in_message":[],"_revision_number":4},{"id":"2ab6f78bf5cd983d729486bb098e78041715f95b","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2019-08-16 22:04:09.000000000","message":"Abandoned\n\nAs discussed in the bug report, the information leak is not severe enough to warrant changing the API behavior, so abandoning this.","accounts_in_message":[],"_revision_number":4}],"current_revision_number":4,"current_revision":"fcab1cdd2af88c32851bcaec346117e5ca9c4ad6","revisions":{"1d89cde11aabeb6b90005264f50ead7629b2411a":{"kind":"REWORK","_number":1,"created":"2019-08-14 22:43:49.000000000","uploader":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"ref":"refs/changes/28/676528/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/28/676528/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/28/676528/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/28/676528/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/28/676528/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/28/676528/1"}}},"commit":{"parents":[{"commit":"6dc9b685959d390cecf087fda4ab09a46807927f","subject":"Merge \"Suppress policy deprecation warnings in unit tests\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/6dc9b685959d390cecf087fda4ab09a46807927f"}]}],"author":{"name":"Colleen Murphy","email":"colleen.murphy@suse.de","date":"2019-08-14 22:16:53.000000000","tz":-420},"committer":{"name":"Colleen Murphy","email":"colleen.murphy@suse.de","date":"2019-08-14 22:39:35.000000000","tz":-420},"subject":"Don\u0027t reveal trust existence to unauthorized users","message":"Don\u0027t reveal trust existence to unauthorized users\n\nWithout this patch, any user regardless of their relation to a trust can\nGET /OS-TRUST/trusts/{trust_id} and find out whether a trust with that\nID exists: if the return code is a 404, it does not exist, whereas if it\nis a 403, it exists. This violates security principles and can be used\nas part of a privilege escalation attack. This change ensure that the\nintended access control is enforced and does not disclose the\nnon-existence of a trust to unauthorized users.\n\nSince we don\u0027t use microversions and don\u0027t intend to update the major\nAPI version, this could be read as violating the API SIG\u0027s guidelines on\nAPI changes for interoperability[1]. However, the security impact is\nsevere enough that this change is warranted.\n\n[1] https://specs.openstack.org/openstack/api-sig/guidelines/api_interoperability.html#evaluating-api-changes\n\nChange-Id: I669cd1675dcc3663aecf0e5882a3e53a3d77c1e0\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/1d89cde11aabeb6b90005264f50ead7629b2411a"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/1d89cde11aabeb6b90005264f50ead7629b2411a"}]},"branch":"refs/heads/master"},"a004bca87f2c898183368f7427ef2500e2963d50":{"kind":"NO_CODE_CHANGE","_number":2,"created":"2019-08-15 17:00:34.000000000","uploader":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"ref":"refs/changes/28/676528/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/28/676528/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/28/676528/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/28/676528/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/28/676528/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/28/676528/2"}}},"commit":{"parents":[{"commit":"6dc9b685959d390cecf087fda4ab09a46807927f","subject":"Merge \"Suppress policy deprecation warnings in unit tests\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/6dc9b685959d390cecf087fda4ab09a46807927f"}]}],"author":{"name":"Colleen Murphy","email":"colleen.murphy@suse.de","date":"2019-08-14 22:16:53.000000000","tz":-420},"committer":{"name":"Colleen Murphy","email":"colleen.murphy@suse.de","date":"2019-08-15 17:00:00.000000000","tz":-420},"subject":"Don\u0027t reveal trust existence to unauthorized users","message":"Don\u0027t reveal trust existence to unauthorized users\n\nWithout this patch, any user regardless of their relation to a trust can\nGET /OS-TRUST/trusts/{trust_id} and find out whether a trust with that\nID exists: if the return code is a 404, it does not exist, whereas if it\nis a 403, it exists. This violates security principles and can be used\nas part of a privilege escalation attack. This change ensure that the\nintended access control is enforced and does not disclose the\nnon-existence of a trust to unauthorized users.\n\nSince we don\u0027t use microversions and don\u0027t intend to update the major\nAPI version, this could be read as violating the API SIG\u0027s guidelines on\nAPI changes for interoperability[1]. However, the security impact is\nsevere enough that this change is warranted.\n\n[1] https://specs.openstack.org/openstack/api-sig/guidelines/api_interoperability.html#evaluating-api-changes\n\nCloses-bug: #1840288\n\nChange-Id: I669cd1675dcc3663aecf0e5882a3e53a3d77c1e0\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a004bca87f2c898183368f7427ef2500e2963d50"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a004bca87f2c898183368f7427ef2500e2963d50"}]},"branch":"refs/heads/master"},"d0baa0bafa885c6f5a7cc929326cf13fb97788e9":{"kind":"NO_CODE_CHANGE","_number":3,"created":"2019-08-15 18:07:55.000000000","uploader":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"ref":"refs/changes/28/676528/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/28/676528/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/28/676528/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/28/676528/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/28/676528/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/28/676528/3"}}},"commit":{"parents":[{"commit":"6dc9b685959d390cecf087fda4ab09a46807927f","subject":"Merge \"Suppress policy deprecation warnings in unit tests\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/6dc9b685959d390cecf087fda4ab09a46807927f"}]}],"author":{"name":"Colleen Murphy","email":"colleen.murphy@suse.de","date":"2019-08-14 22:16:53.000000000","tz":-420},"committer":{"name":"Colleen Murphy","email":"colleen.murphy@suse.de","date":"2019-08-15 18:07:43.000000000","tz":-420},"subject":"Don\u0027t reveal trust existence to unauthorized users","message":"Don\u0027t reveal trust existence to unauthorized users\n\nWithout this patch, any user regardless of their relation to a trust can\nGET /OS-TRUST/trusts/{trust_id} and find out whether a trust with that\nID exists: if the return code is a 404, it does not exist, whereas if it\nis a 403, it exists. This violates security principles and can be used\nas part of a privilege escalation attack. This change ensure that the\nintended access control is enforced and does not disclose the\nnon-existence of a trust to unauthorized users.\n\nSince we don\u0027t use microversions and don\u0027t intend to update the major\nAPI version, this could be read as violating the API SIG\u0027s guidelines on\nAPI changes for interoperability[1]. However, the security impact is\nsevere enough that this change is warranted.\n\n[1] https://specs.openstack.org/openstack/api-sig/guidelines/api_interoperability.html#evaluating-api-changes\n\nCloses-bug: #1840288\nDepends-on: https://review.opendev.org/676745\n\nChange-Id: I669cd1675dcc3663aecf0e5882a3e53a3d77c1e0\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/d0baa0bafa885c6f5a7cc929326cf13fb97788e9"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/d0baa0bafa885c6f5a7cc929326cf13fb97788e9"}]},"branch":"refs/heads/master"},"fcab1cdd2af88c32851bcaec346117e5ca9c4ad6":{"kind":"REWORK","_number":4,"created":"2019-08-15 20:41:14.000000000","uploader":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"ref":"refs/changes/28/676528/4","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/28/676528/4","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/28/676528/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/28/676528/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/28/676528/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/28/676528/4"}}},"commit":{"parents":[{"commit":"6dc9b685959d390cecf087fda4ab09a46807927f","subject":"Merge \"Suppress policy deprecation warnings in unit tests\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/6dc9b685959d390cecf087fda4ab09a46807927f"}]}],"author":{"name":"Colleen Murphy","email":"colleen.murphy@suse.de","date":"2019-08-14 22:16:53.000000000","tz":-420},"committer":{"name":"Colleen Murphy","email":"colleen.murphy@suse.de","date":"2019-08-15 20:41:08.000000000","tz":-420},"subject":"Don\u0027t reveal trust existence to unauthorized users","message":"Don\u0027t reveal trust existence to unauthorized users\n\nWithout this patch, any user regardless of their relation to a trust can\nGET /OS-TRUST/trusts/{trust_id} and find out whether a trust with that\nID exists: if the return code is a 404, it does not exist, whereas if it\nis a 403, it exists. This violates security principles and can be used\nas part of a privilege escalation attack. This change ensure that the\nintended access control is enforced and does not disclose the\nnon-existence of a trust to unauthorized users.\n\nSince we don\u0027t use microversions and don\u0027t intend to update the major\nAPI version, this could be read as violating the API SIG\u0027s guidelines on\nAPI changes for interoperability[1]. However, the security impact is\nsevere enough that this change is warranted.\n\n[1] https://specs.openstack.org/openstack/api-sig/guidelines/api_interoperability.html#evaluating-api-changes\n\nCloses-bug: #1840288\nDepends-on: https://review.opendev.org/676745\n\nChange-Id: I669cd1675dcc3663aecf0e5882a3e53a3d77c1e0\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/fcab1cdd2af88c32851bcaec346117e5ca9c4ad6"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/fcab1cdd2af88c32851bcaec346117e5ca9c4ad6"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[],"submit_requirements":[]}