)]}'
{"id":"openstack%2Fkeystone~725895","triplet_id":"openstack%2Fkeystone~stable%2Frocky~I39d0d705839fbe31ac518ac9a82959e108cb7c1d","project":"openstack/keystone","branch":"stable/rocky","topic":"SEC-bug-1873290-1872733-1872735-1872755-stable/rocky","hashtags":[],"change_id":"I39d0d705839fbe31ac518ac9a82959e108cb7c1d","subject":"Fix security issues with EC2 credentials","status":"MERGED","created":"2020-05-06 15:19:56.000000000","updated":"2020-05-13 17:18:50.000000000","submitted":"2020-05-13 17:14:36.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"725895-1589390076648-78abda74","meta_rev_id":"90823cb934684781c763644c3b5a8eff4eba7ac0","_number":725895,"virtual_id_number":725895,"owner":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},{"value":0,"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"value":0,"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"value":0,"date":"2020-05-13 11:32:00.000000000","_account_id":9542,"name":"Pavlo Shchelokovskyy","email":"pshchelokovskyy@mirantis.com","username":"pshchelo"},{"value":0,"_account_id":31882,"name":"Wander Way","email":"wanderwayout@gmail.com","username":"wanderway"},{"value":0,"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},{"value":0,"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},{"value":0,"_account_id":6476,"name":"Thomas Goirand","email":"thomas@goirand.fr","username":"thomas-goirand"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2020-05-13 17:14:36.000000000","post_submit":true,"permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"recommended":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"all":[{"value":1,"date":"2020-05-06 20:49:04.000000000","permitted_voting_range":{"min":1,"max":2},"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},{"value":0,"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"value":2,"date":"2020-05-07 14:00:37.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"value":0,"_account_id":9542,"name":"Pavlo Shchelokovskyy","email":"pshchelokovskyy@mirantis.com","username":"pshchelo"},{"value":0,"_account_id":31882,"name":"Wander Way","email":"wanderwayout@gmail.com","username":"wanderway"},{"value":1,"date":"2020-05-06 16:44:07.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},{"value":1,"date":"2020-05-06 19:34:40.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},{"value":1,"date":"2020-05-07 10:26:42.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":6476,"name":"Thomas Goirand","email":"thomas@goirand.fr","username":"thomas-goirand"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","value":1,"default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"all":[{"value":0,"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},{"value":1,"date":"2020-05-11 21:26:52.000000000","_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"value":0,"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"value":0,"_account_id":9542,"name":"Pavlo Shchelokovskyy","email":"pshchelokovskyy@mirantis.com","username":"pshchelo"},{"value":0,"date":"2020-05-06 15:23:11.000000000","_account_id":31882,"name":"Wander Way","email":"wanderwayout@gmail.com","username":"wanderway"},{"value":0,"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},{"value":0,"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},{"value":0,"_account_id":6476,"name":"Thomas Goirand","email":"thomas@goirand.fr","username":"thomas-goirand"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"date":"2020-05-06 15:23:11.000000000","_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"_account_id":6476,"name":"Thomas Goirand","email":"thomas@goirand.fr","username":"thomas-goirand"},{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"_account_id":9542,"name":"Pavlo Shchelokovskyy","email":"pshchelokovskyy@mirantis.com","username":"pshchelo"},{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":31882,"name":"Wander Way","email":"wanderwayout@gmail.com","username":"wanderway"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2020-05-06 15:23:11.000000000","updated_by":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"reviewer":{"_account_id":11022,"name":"Rodrigo Duarte Sousa","email":"rodrigodsousa@gmail.com","username":"rodrigods"},"state":"REVIEWER"},{"updated":"2020-05-06 15:23:11.000000000","updated_by":{"_account_id":31882,"name":"Wander Way","email":"wanderwayout@gmail.com","username":"wanderway"},"reviewer":{"_account_id":31882,"name":"Wander Way","email":"wanderwayout@gmail.com","username":"wanderway"},"state":"REVIEWER"},{"updated":"2020-05-06 16:44:07.000000000","updated_by":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"reviewer":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"state":"REVIEWER"},{"updated":"2020-05-06 19:34:40.000000000","updated_by":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"reviewer":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"state":"REVIEWER"},{"updated":"2020-05-06 20:49:04.000000000","updated_by":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"reviewer":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"state":"REVIEWER"},{"updated":"2020-05-07 10:26:42.000000000","updated_by":{"_account_id":6476,"name":"Thomas Goirand","email":"thomas@goirand.fr","username":"thomas-goirand"},"reviewer":{"_account_id":6476,"name":"Thomas Goirand","email":"thomas@goirand.fr","username":"thomas-goirand"},"state":"REVIEWER"},{"updated":"2020-05-07 14:00:37.000000000","updated_by":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"reviewer":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"state":"REVIEWER"},{"updated":"2020-05-13 11:32:00.000000000","updated_by":{"_account_id":9542,"name":"Pavlo Shchelokovskyy","email":"pshchelokovskyy@mirantis.com","username":"pshchelo"},"reviewer":{"_account_id":9542,"name":"Pavlo Shchelokovskyy","email":"pshchelokovskyy@mirantis.com","username":"pshchelo"},"state":"REVIEWER"},{"updated":"2020-05-13 17:14:36.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"6be684773d7f1d68adb5eeb3db6c48d81e0d6619","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2020-05-06 15:19:56.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"dadd2fa91b95303bb146776f18c06f7889d7b96c","author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"date":"2020-05-06 16:44:07.000000000","message":"Patch Set 1: Code-Review+1","accounts_in_message":[],"_revision_number":1},{"id":"6ddddfdae2a5f61c965dab001968cae7bb3eb842","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-05-06 17:32:44.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/9e9e3430b1e248bd91df2a5fa0e31d3e : SUCCESS in 6m 35s\n- openstack-tox-py27 https://zuul.opendev.org/t/openstack/build/1f15f7559e6a43beab3805e18b0d1f5e : TIMED_OUT in 42m 30s\n- openstack-tox-py35 https://zuul.opendev.org/t/openstack/build/c9af669e401d408591a61f1424cf81cf : TIMED_OUT in 41m 35s\n- build-openstack-sphinx-docs https://zuul.opendev.org/t/openstack/build/7465c155d24e4405ae3067915c3966ed : SUCCESS in 8m 49s\n- tempest-full https://zuul.opendev.org/t/openstack/build/1d1bec8bab9c4ae1803de3f5b46566c4 : SUCCESS in 1h 26m 45s\n- neutron-grenade https://zuul.opendev.org/t/openstack/build/26c0046262c94e70a264c5dd51d348e3 : SUCCESS in 1h 08m 25s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/78520a5e685345eaa12aef1a736671e5 : SUCCESS in 1h 22m 43s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/6e8ff29c6797490f81d9bb915679c63e : SUCCESS in 17m 49s\n- keystone-dsvm-functional https://zuul.opendev.org/t/openstack/build/fb7b757d025d4b1c9f441f81a8da1765 : SUCCESS in 38m 53s\n- keystone-dsvm-functional-v3-only https://zuul.opendev.org/t/openstack/build/101beb5194fe422aac462377b4efbc16 : FAILURE in 29m 57s (non-voting)\n- keystone-dsvm-py35-functional-v3-only https://zuul.opendev.org/t/openstack/build/5af4a335397b4ea0bd3dcf11fc41af70 : FAILURE in 33m 37s (non-voting)\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/3d2fd6af486f44a0a2ad98b7b4fb8b5e : SUCCESS in 16m 02s\n- legacy-keystoneclient-dsvm-functional https://zuul.opendev.org/t/openstack/build/09350b895a4c4f02ac0c2a8f6f107b00 : SUCCESS in 41m 36s (non-voting)\n- openstack-tox-cover-keystone-xenial https://zuul.opendev.org/t/openstack/build/49c2a8c1d17a4b02bfbdbc638540d06d : POST_FAILURE in 22m 15s\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/84d2f0be3bb14e509ea5a1d0ed1e0fa7 : SUCCESS in 46m 24s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"7d2e762c54dcaab5458de479b3d65d949551ab83","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2020-05-06 17:34:28.000000000","message":"Patch Set 1:\n\nrecheck","accounts_in_message":[],"_revision_number":1},{"id":"6371c6b67287cd553d395c54905737d5be5e9cd6","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-05-06 19:12:51.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/1e5e9a9239cc4cf59cc36903602d87ff : SUCCESS in 5m 46s\n- openstack-tox-py27 https://zuul.opendev.org/t/openstack/build/ae3876159f0549f7bea83709b66cc90a : SUCCESS in 14m 47s\n- openstack-tox-py35 https://zuul.opendev.org/t/openstack/build/5362b97c0c7f4f319f805cd2b74d9939 : SUCCESS in 12m 51s\n- build-openstack-sphinx-docs https://zuul.opendev.org/t/openstack/build/ecb54e3dd7904ae583486412a91faf88 : SUCCESS in 8m 12s\n- tempest-full https://zuul.opendev.org/t/openstack/build/2b8d60010e1949c39f4e18802eedacd3 : SUCCESS in 1h 33m 23s\n- neutron-grenade https://zuul.opendev.org/t/openstack/build/d317c3c634f5415d8a18c2cb47f1deb4 : SUCCESS in 57m 33s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/f3c17ca1d68440e4bceeed975adf2893 : SUCCESS in 1h 12m 21s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/7b392c3ce00e4e5fb14c3040e824aca0 : SUCCESS in 16m 10s\n- keystone-dsvm-functional https://zuul.opendev.org/t/openstack/build/d0649de441a341d0a9d7556eae9a6418 : SUCCESS in 37m 06s\n- keystone-dsvm-functional-v3-only https://zuul.opendev.org/t/openstack/build/b2b3307e397745c4a581588b55d08ab1 : FAILURE in 42m 04s (non-voting)\n- keystone-dsvm-py35-functional-v3-only https://zuul.opendev.org/t/openstack/build/0e48d48f04d04a2abb68723f3f0b910e : FAILURE in 33m 56s (non-voting)\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/0fc1c17e453e4927812e62d134b79f46 : SUCCESS in 14m 34s\n- legacy-keystoneclient-dsvm-functional https://zuul.opendev.org/t/openstack/build/52cb1699132e4f47b15dd6568ceb30c9 : SUCCESS in 36m 38s (non-voting)\n- openstack-tox-cover-keystone-xenial https://zuul.opendev.org/t/openstack/build/434904590a814cd2bf4ea2246135a407 : SUCCESS in 21m 04s\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/271533da38c34ea59b9360dbcfc944c5 : SUCCESS in 44m 19s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"58ea8dd2bdeaaacceee154abd48bc4d859bea198","author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"date":"2020-05-06 19:34:40.000000000","message":"Patch Set 1: Code-Review+1","accounts_in_message":[],"_revision_number":1},{"id":"a3bfb69d3b6326b7de8033057428954442b9929d","author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"date":"2020-05-06 20:49:04.000000000","message":"Patch Set 1: Code-Review+1","accounts_in_message":[],"_revision_number":1},{"id":"df00b2b344cb4578b1b3afd92cdc437e8a92c892","author":{"_account_id":6476,"name":"Thomas Goirand","email":"thomas@goirand.fr","username":"thomas-goirand"},"date":"2020-05-07 10:26:42.000000000","message":"Patch Set 1: Code-Review+1","accounts_in_message":[],"_revision_number":1},{"id":"cbb6a3b8560f41f5d9056d43af0a8876e1811eaa","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2020-05-07 14:00:37.000000000","message":"Patch Set 1: Code-Review+2","accounts_in_message":[],"_revision_number":1},{"id":"a8ab8e370316e0fb195c966b2e38cc67c5ecac97","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2020-05-11 21:26:52.000000000","message":"Patch Set 1: Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"5e0c93017dd033e69259ef8dda9d2284245ac29b","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-05-11 21:27:13.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"73702991a98985cfd8a0f74ad01a4b9d3d696d05","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-05-11 23:56:10.000000000","message":"Patch Set 1: Verified-2\n\nThis change depends on a change that failed to merge.","accounts_in_message":[],"_revision_number":1},{"id":"870b6b3c995d0d05c2c927e86bf776a5876a58bb","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2020-05-12 01:51:12.000000000","message":"Patch Set 1:\n\nrecheck","accounts_in_message":[],"_revision_number":1},{"id":"48320841f8ad4d888a86d281e47136eeaece4c38","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-05-12 03:22:13.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/bb687f26493e4be6b455843a41e6cb03 : SUCCESS in 8m 55s\n- openstack-tox-py27 https://zuul.opendev.org/t/openstack/build/52c7b12cd969485b9ed44916bf5808e6 : SUCCESS in 19m 48s\n- openstack-tox-py35 https://zuul.opendev.org/t/openstack/build/fcf1ac4e113a443692f915cba002ac35 : SUCCESS in 13m 00s\n- build-openstack-sphinx-docs https://zuul.opendev.org/t/openstack/build/d2e189ce77f04d1995c829a589040593 : SUCCESS in 9m 45s\n- tempest-full https://zuul.opendev.org/t/openstack/build/f60da8a5eaf547eb84cf00cf9a6a8a1e : SUCCESS in 1h 24m 38s\n- neutron-grenade https://zuul.opendev.org/t/openstack/build/e2e5b911d5e341ce80ac2da226d9f534 : SUCCESS in 55m 36s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/5228ebcfa2194747ae0fcda09f60a348 : SUCCESS in 1h 25m 44s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/7ed59794bda742b0a3094f0e0fc26422 : SUCCESS in 15m 52s\n- keystone-dsvm-functional https://zuul.opendev.org/t/openstack/build/3c5e581129824ab2998e8d6a600c46f8 : SUCCESS in 31m 55s\n- keystone-dsvm-functional-v3-only https://zuul.opendev.org/t/openstack/build/81430c8b531c448b9c596d3e9baa8318 : FAILURE in 31m 44s (non-voting)\n- keystone-dsvm-py35-functional-v3-only https://zuul.opendev.org/t/openstack/build/a17a635b594a46eb9640950ae14f983f : FAILURE in 30m 45s (non-voting)\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/5dd963edc3ea4eed8da2cb3a0dc6642c : SUCCESS in 22m 14s\n- legacy-keystoneclient-dsvm-functional https://zuul.opendev.org/t/openstack/build/9433951640104dd0931b38a8c1a93b33 : SUCCESS in 30m 44s (non-voting)\n- openstack-tox-cover-keystone-xenial https://zuul.opendev.org/t/openstack/build/9040afe872d94f19954aa878328c2836 : SUCCESS in 22m 44s\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/e4d51f730a0a4a29bbc86c26c21ae7d4 : SUCCESS in 37m 48s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"618800e553e037d7fac06cc1251dfe68e5ea0c50","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-05-13 04:38:57.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"d4fa1913ce7037903cc079031e73fbd9aff792cc","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-05-13 06:16:21.000000000","message":"Patch Set 1: Verified-2\n\nBuild failed (gate pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/9055e3a9e93c4a0481c85d9741f87bdf : SUCCESS in 6m 46s\n- openstack-tox-py27 https://zuul.opendev.org/t/openstack/build/9fd9ced609714ddabb625e8e66af9cdc : TIMED_OUT in 41m 06s\n- openstack-tox-py35 https://zuul.opendev.org/t/openstack/build/7fdca5a4baba4b2b9d965ee324a66031 : TIMED_OUT in 40m 57s\n- build-openstack-sphinx-docs https://zuul.opendev.org/t/openstack/build/f29a06a4592f4551aa860dd952b8fd67 : SUCCESS in 9m 18s\n- tempest-full https://zuul.opendev.org/t/openstack/build/b85d865124214d71a40a0161b359951d : SUCCESS in 1h 10m 42s\n- neutron-grenade https://zuul.opendev.org/t/openstack/build/98eefe9c53f3471484f957c4de17501f : SUCCESS in 50m 11s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/40ba320057b544ad83c8136136d4ba93 : SUCCESS in 1h 18m 47s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/bc62aa1cb7ae4ecbab597ba641e3245a : SUCCESS in 18m 27s\n- keystone-dsvm-functional https://zuul.opendev.org/t/openstack/build/a555a14d56f14751a33a7baad5f5f3d2 : SUCCESS in 25m 28s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/197b210249d14601bce6a0e0bf1dbd15 : SUCCESS in 15m 45s","accounts_in_message":[],"_revision_number":1},{"id":"0c61ff5cb04fbbe8df620b92b04291aac5d4ae6f","author":{"_account_id":9542,"name":"Pavlo Shchelokovskyy","email":"pshchelokovskyy@mirantis.com","username":"pshchelo"},"date":"2020-05-13 11:32:00.000000000","message":"Patch Set 1:\n\nrecheck","accounts_in_message":[],"_revision_number":1},{"id":"3c739b68a47a89b690b21def6189bee47ad5ac86","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-05-13 14:51:14.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/fda952605d4545038546cce0313f22cc : SUCCESS in 6m 12s\n- openstack-tox-py27 https://zuul.opendev.org/t/openstack/build/b42d9c44915444a7b85a9180dd3d2881 : SUCCESS in 13m 53s\n- openstack-tox-py35 https://zuul.opendev.org/t/openstack/build/eb4bca569e394b6993e031e5c5abaf1d : SUCCESS in 13m 17s\n- build-openstack-sphinx-docs https://zuul.opendev.org/t/openstack/build/a392a556afe347cf88be36af90abf84e : SUCCESS in 9m 16s\n- tempest-full https://zuul.opendev.org/t/openstack/build/fed20cc901654b9aa30cb3a4b3d2eb86 : SUCCESS in 1h 36m 25s\n- neutron-grenade https://zuul.opendev.org/t/openstack/build/45d8fd4c2c124ebb9a330fbd1ff85440 : SUCCESS in 1h 08m 36s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/ab78b6ebc854465fbf88779bcf4e0972 : SUCCESS in 1h 21m 27s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/e09c4e606bab42c9a2c46b71cdfdf691 : SUCCESS in 20m 34s\n- keystone-dsvm-functional https://zuul.opendev.org/t/openstack/build/2a94cab972804365bb9d458eb843c851 : SUCCESS in 35m 54s\n- keystone-dsvm-functional-v3-only https://zuul.opendev.org/t/openstack/build/1814666131904d9480a3fff89d803ba7 : FAILURE in 31m 32s (non-voting)\n- keystone-dsvm-py35-functional-v3-only https://zuul.opendev.org/t/openstack/build/0aceb96d0e824f60b9adffc425847342 : FAILURE in 31m 46s (non-voting)\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/01a72f350af44e47b0021e14e1349006 : SUCCESS in 15m 12s\n- legacy-keystoneclient-dsvm-functional https://zuul.opendev.org/t/openstack/build/2c48a23335194d5aa2e02f2e8df64a89 : SUCCESS in 34m 06s (non-voting)\n- openstack-tox-cover-keystone-xenial https://zuul.opendev.org/t/openstack/build/8d87795fdf9044c5a5f310a0b9586461 : SUCCESS in 16m 31s\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/efc7164e65984ec0a3f9e91824cb336f : SUCCESS in 42m 29s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"c5a242e57e17fd0c1febe6f65f80a26546ea331f","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-05-13 14:51:39.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"8b5c30d516b39315bcb00bd89a9479688bb95d86","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-05-13 17:14:36.000000000","message":"Change has been successfully merged by Zuul","accounts_in_message":[],"_revision_number":1},{"id":"c10ce94704251ec890b9509f2922d1b0ba9f3193","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-05-13 17:14:36.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/b17731e7637040e09a1063356b3cd0b1 : SUCCESS in 6m 31s\n- openstack-tox-py27 https://zuul.opendev.org/t/openstack/build/cb2ae5a23f0147f2bd3fc4395d1c61b8 : SUCCESS in 14m 00s\n- openstack-tox-py35 https://zuul.opendev.org/t/openstack/build/fb9c32cba31948048661150183f67983 : SUCCESS in 14m 02s\n- build-openstack-sphinx-docs https://zuul.opendev.org/t/openstack/build/590f177d3d4844389e9b2830f42e77e7 : SUCCESS in 8m 08s\n- tempest-full https://zuul.opendev.org/t/openstack/build/1e2d4ac771b248e7a166202a84b31a4b : SUCCESS in 1h 18m 57s\n- neutron-grenade https://zuul.opendev.org/t/openstack/build/0d20222b6d02483baad34a84ed65cabc : SUCCESS in 52m 25s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/b59215311f524333ae707ee6156da2b3 : SUCCESS in 1h 18m 12s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/6b80b02246604064b94bd33e7ccbfe94 : SUCCESS in 19m 58s\n- keystone-dsvm-functional https://zuul.opendev.org/t/openstack/build/34a1e635fd99402d991339fd0da7f9cf : SUCCESS in 34m 37s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/6ea8996709b14f9289f5042dea8ca3f4 : SUCCESS in 19m 10s","accounts_in_message":[],"_revision_number":1},{"id":"b0d5758cf5d3d735c4c059712d22a5947c9413b4","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-05-13 17:18:50.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\n\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/c69e85ff36f74c74a0021d5b86bc9ba4 : SUCCESS in 1m 17s","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"53d1ccb8a1bdbb5aa0efaacf9739b1a6f436e191","revisions":{"53d1ccb8a1bdbb5aa0efaacf9739b1a6f436e191":{"kind":"REWORK","_number":1,"created":"2020-05-06 15:19:56.000000000","uploader":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"ref":"refs/changes/95/725895/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/95/725895/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/95/725895/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/95/725895/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/95/725895/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/95/725895/1"}}},"commit":{"parents":[{"commit":"10bc689a6796f85c44d19e0c18f0e37b0a87474c","subject":"Ensure OAuth1 authorized roles are respected","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/10bc689a6796f85c44d19e0c18f0e37b0a87474c"}]}],"author":{"name":"Colleen Murphy","email":"colleen.murphy@suse.com","date":"2020-04-14 23:47:44.000000000","tz":-420},"committer":{"name":"Colleen Murphy","email":"colleen.murphy@suse.com","date":"2020-05-06 15:19:20.000000000","tz":-420},"subject":"Fix security issues with EC2 credentials","message":"Fix security issues with EC2 credentials\n\nThis change addresses several issues in the creation and use of EC2/S3\ncredentials with keystone tokens.\n\n1. Disable altering credential owner attributes or metadata\n\nWithout this patch, an authenticated user can create an EC2 credential\nfor themself for a project they have a role on, then update the\ncredential to target a user and project completely unrelated to them. In\nthe worst case, this could be the admin user and a project the admin\nuser has a role assignment on. A token granted for an altered credential\nlike this would allow the user to masquerade as the victim user. This\npatch ensures that when updating a credential, the new form of the\ncredential is one the acting user has access to: if the system admin\nuser is changing the credential, the new user ID or project ID could be\nanything, but regular users may only change the credential to be one\nthat they still own.\n\nRelatedly, when a user uses an application credential or a trust to\ncreate an EC2 credential, keystone automatically adds the trust ID or\napplication credential ID as metadata in the EC2 access blob so that it\nknows how the token can be scoped when it is used. Without this patch, a\nuser who has created a credential in this way can update the access blob\nto remove or alter this metadata and escalate their privileges to be\nfully authorized for the trustor\u0027s, application credential creator\u0027s, or\nOAuth1 access token authorizor\u0027s privileges on the project. This patch\nfixes the issue by simply disallowing updates to keystone-controlled\nmetadata in the credential.\n\n2. Respect token roles when creating EC2 credentials\n\nWithout this patch, a trustee, an application credential user, or an\nOAuth1 access token holder could create an EC2 credential or an\napplication credential using any roles the trustor, application\ncredential creator, or access token authorizor had on the project,\nregardless of whether the creator had delegated only a limited subset of\nroles. This was because the trust_id attribute of the EC2 access blob\nwas ignored, and no metadata for the application credential or access\ntoken was recorded either. This change ensures that the access\ndelegation resource is recorded in the metadata of the EC2 credential\nwhen created and passed to the token provider when used for\nauthentication so that the token provider can look up the correct roles\nfor the request.\n\nConflicts (six removal in  e2d83ae9, pep8 fixes in e2d83ae9):\n      keystone/api/credentials.py\n      keystone/tests/unit/test_v3_application_credential.py\n      keystone/tests/unit/test_v3_credential.py\n\nConflicts due to flask reorg:\n\tkeystone/api/_shared/EC2_S3_Resource.py\n\tkeystone/api/credentials.py\n\tkeystone/api/users.py\n\tkeystone/tests/unit/test_v3_credential.py\n\nMoved the test_update_credential_non_owner unit test to\nCredentialSelfServiceTestCase since in this branch the default policies\nare not affected by #1872733.\n\nChange-Id: I39d0d705839fbe31ac518ac9a82959e108cb7c1d\nCloses-bug: #1872733\nCloses-bug: #1872755\nCloses-bug: #1872735\n(cherry picked from commit 37e9907a176dad6843819b1bec4946c3aecc4548)\n(cherry picked from commit 2f2736ebb267c757ad77fcf25ee0aaeefab2a09d)\n(cherry picked from commit 27caafe3daa552663719954f2cd6713dd4493178)\n(cherry picked from commit bfba75fc3c5c8f119f74dbf31347e008824a2134)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/53d1ccb8a1bdbb5aa0efaacf9739b1a6f436e191"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/53d1ccb8a1bdbb5aa0efaacf9739b1a6f436e191"}]},"branch":"refs/heads/stable/rocky"}},"requirements":[],"submit_records":[],"submit_requirements":[]}