)]}'
{"id":"openstack%2Fkeystone~726016","triplet_id":"openstack%2Fkeystone~stable%2Fpike~I02f9836fbd4d7e629653977fc341476cfd89859e","project":"openstack/keystone","branch":"stable/pike","topic":"bug/1873290","hashtags":[],"change_id":"I02f9836fbd4d7e629653977fc341476cfd89859e","subject":"Ensure OAuth1 authorized roles are respected","status":"MERGED","created":"2020-05-06 22:37:14.000000000","updated":"2020-06-02 17:31:32.000000000","submitted":"2020-06-02 17:31:32.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"726016-1591119092051-2f67a625","meta_rev_id":"fb4fd9685f79bcd1dbb729c38c894dac40503303","_number":726016,"virtual_id_number":726016,"owner":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"value":0,"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"value":0,"_account_id":16310,"name":"Flávio","email":"framalho@suse.com","username":"flaviosr"},{"value":0,"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},{"value":0,"_account_id":6476,"name":"Thomas Goirand","email":"thomas@goirand.fr","username":"thomas-goirand"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2020-06-02 17:31:31.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},{"value":0,"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"all":[{"value":2,"date":"2020-06-02 15:02:04.000000000","_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"value":2,"date":"2020-06-02 15:44:04.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"value":0,"_account_id":16310,"name":"Flávio","email":"framalho@suse.com","username":"flaviosr"},{"value":0,"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},{"value":1,"date":"2020-05-17 20:05:50.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":6476,"name":"Thomas Goirand","email":"thomas@goirand.fr","username":"thomas-goirand"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},{"value":0,"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"all":[{"value":0,"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"value":1,"date":"2020-06-02 15:44:04.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"value":0,"_account_id":16310,"name":"Flávio","email":"framalho@suse.com","username":"flaviosr"},{"value":0,"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},{"value":0,"_account_id":6476,"name":"Thomas Goirand","email":"thomas@goirand.fr","username":"thomas-goirand"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},{"value":0,"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"_account_id":6476,"name":"Thomas Goirand","email":"thomas@goirand.fr","username":"thomas-goirand"},{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},{"_account_id":16310,"name":"Flávio","email":"framalho@suse.com","username":"flaviosr"},{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2020-05-07 02:12:29.000000000","updated_by":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"reviewer":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"state":"REVIEWER"},{"updated":"2020-05-08 11:51:53.000000000","updated_by":{"_account_id":16310,"name":"Flávio","email":"framalho@suse.com","username":"flaviosr"},"reviewer":{"_account_id":16310,"name":"Flávio","email":"framalho@suse.com","username":"flaviosr"},"state":"REVIEWER"},{"updated":"2020-05-10 12:11:12.000000000","updated_by":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"reviewer":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"state":"REVIEWER"},{"updated":"2020-05-17 20:05:50.000000000","updated_by":{"_account_id":6476,"name":"Thomas Goirand","email":"thomas@goirand.fr","username":"thomas-goirand"},"reviewer":{"_account_id":6476,"name":"Thomas Goirand","email":"thomas@goirand.fr","username":"thomas-goirand"},"state":"REVIEWER"},{"updated":"2020-06-02 15:02:04.000000000","updated_by":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"reviewer":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"state":"REVIEWER"},{"updated":"2020-06-02 15:44:04.000000000","updated_by":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"reviewer":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"state":"REVIEWER"},{"updated":"2020-06-02 17:31:31.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"a8298aa95c61fe7427bcf00a14eeb5a68be89784","author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"date":"2020-05-06 22:37:14.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"0a336e3a0f734872ce0f450c917f27fe03e29b1a","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-05-06 23:20:23.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/dda0d991aa0e41feb4b373105cd2dcc3 : SUCCESS in 6m 22s\n- openstack-tox-py27 https://zuul.opendev.org/t/openstack/build/4e66ec302ae94d3fb5c319d79896ea3c : SUCCESS in 11m 41s\n- openstack-tox-py35 https://zuul.opendev.org/t/openstack/build/1183e9e810784095bc2758f08b0fa46f : SUCCESS in 18m 04s\n- build-openstack-sphinx-docs https://zuul.opendev.org/t/openstack/build/c4a07931e19045e4acf7e05db6747ab2 : SUCCESS in 8m 14s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/eddb0d84a98249229833e37ddacc9cc4 : SUCCESS in 22m 11s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/20c93c1af1934828aa6412197dbbfb3b : SUCCESS in 41m 53s","accounts_in_message":[],"_revision_number":1},{"id":"86ad1ebbd95502ac7d0da62622647777468ff8c8","author":{"_account_id":21420,"name":"Gage Hugo","email":"gagehugo@gmail.com","username":"ghugo"},"date":"2020-05-07 02:12:29.000000000","message":"Patch Set 1: Code-Review+1","accounts_in_message":[],"_revision_number":1},{"id":"43bb1012849bf304bd029e32a4ce5cd7c6bfb780","author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"date":"2020-05-07 05:08:09.000000000","message":"Uploaded patch set 2.","accounts_in_message":[],"_revision_number":2},{"id":"1fa913ab74fc442f7e75552e31866aeb690fe94d","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-05-07 05:30:56.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/f19c04e5a9db4c8e8c156299e38366d0 : SUCCESS in 6m 55s\n- openstack-tox-py27 https://zuul.opendev.org/t/openstack/build/34ced8a0473b452f8b0a1dd66d6a47c3 : SUCCESS in 17m 06s\n- openstack-tox-py35 https://zuul.opendev.org/t/openstack/build/74ddc412ef71481ab6fba9a8a8cea018 : SUCCESS in 21m 55s\n- build-openstack-sphinx-docs https://zuul.opendev.org/t/openstack/build/341af99207004d6c9a3cfdabe5fca4a0 : SUCCESS in 7m 19s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/9b7aa557466f4a6f8f7f304cbb0f471e : SUCCESS in 16m 47s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/bafcc7f042cd43038c9f32cc251817ff : SUCCESS in 15m 58s","accounts_in_message":[],"_revision_number":2},{"id":"bfaa030237f502d3cafc6ba2b6f34116a07d630e","author":{"_account_id":6476,"name":"Thomas Goirand","email":"thomas@goirand.fr","username":"thomas-goirand"},"date":"2020-05-07 10:28:06.000000000","message":"Patch Set 2: Code-Review+1","accounts_in_message":[],"_revision_number":2},{"id":"53b1193547879271572a4925d409e29282b76bd2","author":{"_account_id":16310,"name":"Flávio","email":"framalho@suse.com","username":"flaviosr"},"date":"2020-05-08 11:51:53.000000000","message":"Patch Set 2: Code-Review+1","accounts_in_message":[],"_revision_number":2},{"id":"e7dd76cf8e9c736711c55c25175dad0b7ecdd1d8","author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"date":"2020-05-08 14:47:08.000000000","message":"Patch Set 2: Code-Review-1\n\nI think that the commit message should be updated because it doesn\u0027t include the info for queens backport, while it includes backports for r-t.","accounts_in_message":[],"_revision_number":2},{"id":"d84e1770ae50f6784e86ae80571854f8d90cf363","author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"date":"2020-05-08 17:10:54.000000000","message":"Patch Set 3: Commit message was updated.","accounts_in_message":[],"_revision_number":3},{"id":"dd45493307e61d7a33751b4f3a6c0ed7f4028fac","author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"date":"2020-05-08 17:11:16.000000000","message":"Patch Set 3:\n\n\u003e I think that the commit message should be updated because it\n \u003e doesn\u0027t include the info for queens backport, while it includes\n \u003e backports for r-t.\n\ncommit msg updated, thanks for the reminder","accounts_in_message":[],"_revision_number":3},{"id":"1b43d5360a63b643e1838a53ec2d58e59411ec08","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-05-08 17:34:18.000000000","message":"Patch Set 3: Verified+1\n\nBuild succeeded (check pipeline).\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/3f5a1563c7fb4e4db648df6bd3a2a1ee : SUCCESS in 6m 00s\n- openstack-tox-py27 https://zuul.opendev.org/t/openstack/build/6c32e4ea41844d2d97463e435f94276f : SUCCESS in 14m 27s\n- openstack-tox-py35 https://zuul.opendev.org/t/openstack/build/c347e54c6a4d410b8304c316c08a4383 : SUCCESS in 19m 13s\n- build-openstack-sphinx-docs https://zuul.opendev.org/t/openstack/build/3840960f91fd414bba63625a8817a03c : SUCCESS in 7m 28s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/26270a971f884cadab290935d3077b67 : SUCCESS in 19m 10s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/8c47544f106b4e62a4673aaef828fcc8 : SUCCESS in 13m 07s","accounts_in_message":[],"_revision_number":3},{"id":"b6ec79af2cdbb5ea2edc8503ec600f4051c5ba05","author":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"date":"2020-05-10 12:11:12.000000000","message":"Patch Set 3: Code-Review-1\n\nThe same as the other patch. The description about conflicts is not properly updated.","accounts_in_message":[],"_revision_number":3},{"id":"d78d675226d2228cd8cf42cf9eaf935b639b55d1","author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"date":"2020-05-11 16:41:48.000000000","message":"Patch Set 4: Commit message was updated.","accounts_in_message":[],"_revision_number":4},{"id":"e4f3c7d23fb0e31818904deba89562679b9acb17","author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"date":"2020-05-11 16:42:46.000000000","message":"Patch Set 5: Commit message was updated.","accounts_in_message":[],"_revision_number":5},{"id":"a44f645a2e376cf2dcbb71b28b00b63cc8dc104c","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-05-11 19:32:30.000000000","message":"Patch Set 5: Verified+1\n\nBuild succeeded (check pipeline).\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/a5751e73300a42a1a8af5fcd6ddb69a9 : SUCCESS in 7m 07s\n- openstack-tox-py27 https://zuul.opendev.org/t/openstack/build/2d3182ef52424463b2ad11eb30580ce1 : SUCCESS in 31m 58s\n- openstack-tox-py35 https://zuul.opendev.org/t/openstack/build/316aea1af4de41288630a322fc5143d7 : SUCCESS in 31m 13s\n- build-openstack-sphinx-docs https://zuul.opendev.org/t/openstack/build/fd184fd5b1e54eaf8fb80c36c923d4de : SUCCESS in 8m 08s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/e9c0c72710cb4d64b691a5f69f7082d1 : SUCCESS in 18m 33s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/a3a61ad383714ac2aa7a704b3faba14e : SUCCESS in 17m 18s","accounts_in_message":[],"_revision_number":5},{"id":"e95c9f2a2235fc677946eb6bae03da7cc20a4b78","author":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"date":"2020-05-14 17:27:45.000000000","message":"Uploaded patch set 6.","accounts_in_message":[],"_revision_number":6},{"id":"224277687034b0e3f160c76d9ee4dd489c269ac5","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-05-14 17:49:57.000000000","message":"Patch Set 6: Verified+1\n\nBuild succeeded (check pipeline).\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/b4519180206b4bd2b133f707d7a2eced : SUCCESS in 6m 54s\n- openstack-tox-py27 https://zuul.opendev.org/t/openstack/build/7ff6f4e9be9b4fe8b55f5a025e3b0540 : SUCCESS in 21m 05s\n- openstack-tox-py35 https://zuul.opendev.org/t/openstack/build/1262b988caf64a2ab5c4b9aa09bcb9b2 : SUCCESS in 18m 52s\n- build-openstack-sphinx-docs https://zuul.opendev.org/t/openstack/build/7e39ab660d1d43689a1a3f4372b56c47 : SUCCESS in 10m 18s\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/8db17ded4e154179886e9bd5f5dd6459 : SUCCESS in 21m 12s","accounts_in_message":[],"_revision_number":6},{"id":"e8d47cf884c228e5f9fd44ef37a3cdbb4584e06c","author":{"_account_id":6476,"name":"Thomas Goirand","email":"thomas@goirand.fr","username":"thomas-goirand"},"date":"2020-05-17 20:05:50.000000000","message":"Patch Set 6: Code-Review+1","accounts_in_message":[],"_revision_number":6},{"id":"ecb51fc62533ab525dbb79ffa5b54f5588c24b6d","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2020-06-02 15:02:04.000000000","message":"Patch Set 6: Code-Review+2","accounts_in_message":[],"_revision_number":6},{"id":"bb2576ef084a0b5c021267f362abfe580ca1b57e","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2020-06-02 15:44:04.000000000","message":"Patch Set 6: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":6},{"id":"a35099df3e757cb18e4f381df184070c0073883c","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-06-02 15:44:28.000000000","message":"Patch Set 6: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":6},{"id":"ef4797f9860faabb878fd3977cdf2803af69419e","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-06-02 17:31:31.000000000","message":"Patch Set 6: Verified+2\n\nBuild succeeded (gate pipeline).\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/0b99ef2e327d4c3c91964c136a5ce6b2 : SUCCESS in 5m 59s\n- openstack-tox-py27 https://zuul.opendev.org/t/openstack/build/608fc7e8ee094abfb6f69859ba73cefb : SUCCESS in 12m 04s\n- openstack-tox-py35 https://zuul.opendev.org/t/openstack/build/82a63c0da8534ebf879949f537e0164b : SUCCESS in 14m 37s\n- build-openstack-sphinx-docs https://zuul.opendev.org/t/openstack/build/d57e6ea85cd247119ef4997896d87a58 : SUCCESS in 8m 47s","accounts_in_message":[],"_revision_number":6},{"id":"70312fbdcab2b51a867be3abff0579f5fa8fdacb","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2020-06-02 17:31:32.000000000","message":"Change has been successfully merged by Zuul","accounts_in_message":[],"_revision_number":6}],"current_revision_number":6,"current_revision":"7653847a04e56555b8d172a3d5c76a95533cdec7","revisions":{"3793663458106279a6a0098edc11fabe38240b9a":{"kind":"REWORK","_number":1,"created":"2020-05-06 22:37:14.000000000","uploader":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"ref":"refs/changes/16/726016/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/16/726016/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/16/726016/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/16/726016/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/16/726016/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/16/726016/1"}}},"commit":{"parents":[{"commit":"5ba1b6ace597e9ce5fd25edac874c73abfabf743","subject":"Import LDAP job into project","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/5ba1b6ace597e9ce5fd25edac874c73abfabf743"}]}],"author":{"name":"Colleen Murphy","email":"colleen.murphy@suse.com","date":"2020-04-17 03:35:46.000000000","tz":-420},"committer":{"name":"Guang Yee","email":"guang.yee@suse.com","date":"2020-05-06 22:09:35.000000000","tz":-420},"subject":"Ensure OAuth1 authorized roles are respected","message":"Ensure OAuth1 authorized roles are respected\n\nWithout this patch, when an OAuth1 request token is authorized with a\nlimited set of roles, the roles for the access token are ignored when\nthe user uses it to request a keystone token. This means that user of an\naccess token can use it to escallate their role assignments beyond what\nwas authorized by the creator. This patch fixes the issue by ensuring\nthe token model accounts for an OAuth1-scoped token and correctly\npopulating the roles for it.\n\nModified to work with older test helper function:\n\n  keystone/tests/unit/test_v3_oauth1.py\n\nChange-Id: I02f9836fbd4d7e629653977fc341476cfd89859e\nCloses-bug: #1873290\n(cherry picked from commit 6c73690f779a42a5c62914b6bc37f0ac2f41a3e3)\n(cherry picked from commit ba89d27793c2d3a26ad95642660fa9bd820ed3be)\n(cherry picked from commit 5ff52dbaa2082991d229d8557a8e4b65256d6c53)\n(cherry picked from commit 2483a578a80a916d9f5acd672d85830385b236e2)\n(cherry picked from commit 10bc689a6796f85c44d19e0c18f0e37b0a87474c)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3793663458106279a6a0098edc11fabe38240b9a"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3793663458106279a6a0098edc11fabe38240b9a"}]},"branch":"refs/heads/stable/pike"},"89ce7e48c1070070a7a2d7e72825f8e615de5a9a":{"kind":"REWORK","_number":2,"created":"2020-05-07 05:08:09.000000000","uploader":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"ref":"refs/changes/16/726016/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/16/726016/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/16/726016/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/16/726016/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/16/726016/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/16/726016/2"}}},"commit":{"parents":[{"commit":"5ba1b6ace597e9ce5fd25edac874c73abfabf743","subject":"Import LDAP job into project","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/5ba1b6ace597e9ce5fd25edac874c73abfabf743"}]}],"author":{"name":"Colleen Murphy","email":"colleen.murphy@suse.com","date":"2020-04-17 03:35:46.000000000","tz":-420},"committer":{"name":"Guang Yee","email":"guang.yee@suse.com","date":"2020-05-07 05:08:08.000000000","tz":-420},"subject":"Ensure OAuth1 authorized roles are respected","message":"Ensure OAuth1 authorized roles are respected\n\nWithout this patch, when an OAuth1 request token is authorized with a\nlimited set of roles, the roles for the access token are ignored when\nthe user uses it to request a keystone token. This means that user of an\naccess token can use it to escallate their role assignments beyond what\nwas authorized by the creator. This patch fixes the issue by ensuring\nthe token model accounts for an OAuth1-scoped token and correctly\npopulating the roles for it.\n\nModified to work with older test helper function:\n\n  keystone/tests/unit/test_v3_oauth1.py\n\nChange-Id: I02f9836fbd4d7e629653977fc341476cfd89859e\nCloses-bug: #1873290\n(cherry picked from commit 6c73690f779a42a5c62914b6bc37f0ac2f41a3e3)\n(cherry picked from commit ba89d27793c2d3a26ad95642660fa9bd820ed3be)\n(cherry picked from commit 5ff52dbaa2082991d229d8557a8e4b65256d6c53)\n(cherry picked from commit 2483a578a80a916d9f5acd672d85830385b236e2)\n(cherry picked from commit 10bc689a6796f85c44d19e0c18f0e37b0a87474c)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/89ce7e48c1070070a7a2d7e72825f8e615de5a9a"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/89ce7e48c1070070a7a2d7e72825f8e615de5a9a"}]},"branch":"refs/heads/stable/pike"},"a9e96788178fc6f96d8fc3f78dc38bcdc1c9a369":{"kind":"NO_CODE_CHANGE","_number":3,"created":"2020-05-08 17:10:54.000000000","uploader":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"ref":"refs/changes/16/726016/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/16/726016/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/16/726016/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/16/726016/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/16/726016/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/16/726016/3"}}},"commit":{"parents":[{"commit":"5ba1b6ace597e9ce5fd25edac874c73abfabf743","subject":"Import LDAP job into project","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/5ba1b6ace597e9ce5fd25edac874c73abfabf743"}]}],"author":{"name":"Colleen Murphy","email":"colleen.murphy@suse.com","date":"2020-04-17 03:35:46.000000000","tz":-420},"committer":{"name":"guang-yee","email":"gyee@suse.com","date":"2020-05-08 17:10:49.000000000","tz":0},"subject":"Ensure OAuth1 authorized roles are respected","message":"Ensure OAuth1 authorized roles are respected\n\nWithout this patch, when an OAuth1 request token is authorized with a\nlimited set of roles, the roles for the access token are ignored when\nthe user uses it to request a keystone token. This means that user of an\naccess token can use it to escallate their role assignments beyond what\nwas authorized by the creator. This patch fixes the issue by ensuring\nthe token model accounts for an OAuth1-scoped token and correctly\npopulating the roles for it.\n\nModified to work with older test helper function:\n\n  keystone/tests/unit/test_v3_oauth1.py\n\nChange-Id: I02f9836fbd4d7e629653977fc341476cfd89859e\nCloses-bug: #1873290\n(cherry picked from commit 6c73690f779a42a5c62914b6bc37f0ac2f41a3e3)\n(cherry picked from commit ba89d27793c2d3a26ad95642660fa9bd820ed3be)\n(cherry picked from commit 5ff52dbaa2082991d229d8557a8e4b65256d6c53)\n(cherry picked from commit 2483a578a80a916d9f5acd672d85830385b236e2)\n(cherry picked from commit 10bc689a6796f85c44d19e0c18f0e37b0a87474c)\n(cherry picked from commit d590441ce6897a7a169db7262eb17bcd5d90bcd2)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a9e96788178fc6f96d8fc3f78dc38bcdc1c9a369"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a9e96788178fc6f96d8fc3f78dc38bcdc1c9a369"}]},"branch":"refs/heads/stable/pike"},"0a579cb88e95ff311e4a007a4d7914b975a25ea2":{"kind":"NO_CODE_CHANGE","_number":4,"created":"2020-05-11 16:41:48.000000000","uploader":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"ref":"refs/changes/16/726016/4","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/16/726016/4","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/16/726016/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/16/726016/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/16/726016/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/16/726016/4"}}},"commit":{"parents":[{"commit":"5ba1b6ace597e9ce5fd25edac874c73abfabf743","subject":"Import LDAP job into project","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/5ba1b6ace597e9ce5fd25edac874c73abfabf743"}]}],"author":{"name":"Colleen Murphy","email":"colleen.murphy@suse.com","date":"2020-04-17 03:35:46.000000000","tz":-420},"committer":{"name":"guang-yee","email":"gyee@suse.com","date":"2020-05-11 16:41:43.000000000","tz":0},"subject":"Ensure OAuth1 authorized roles are respected","message":"Ensure OAuth1 authorized roles are respected\n\nWithout this patch, when an OAuth1 request token is authorized with a\nlimited set of roles, the roles for the access token are ignored when\nthe user uses it to request a keystone token. This means that user of an\naccess token can use it to escallate their role assignments beyond what\nwas authorized by the creator. This patch fixes the issue by ensuring\nthe token model accounts for an OAuth1-scoped token and correctly\npopulating the roles for it.\n\nModified to work with older test helper function:\n\n  keystone/tests/unit/test_v3_oauth1.py\n  \nConflicts:\n\n  keystone/models/token_model.py\n\n  The keystone token model was refactored in the Rocky release. This\n  commit only backports the test so that we have test coverage against\n  the bug and proves there wasn\u0027t a regression in Queens. As such, the\n  code changes to token_model.py (where the bug was introduced) are not\n  applicable to Queens.\n\nChange-Id: I02f9836fbd4d7e629653977fc341476cfd89859e\nCloses-bug: #1873290\n(cherry picked from commit 6c73690f779a42a5c62914b6bc37f0ac2f41a3e3)\n(cherry picked from commit ba89d27793c2d3a26ad95642660fa9bd820ed3be)\n(cherry picked from commit 5ff52dbaa2082991d229d8557a8e4b65256d6c53)\n(cherry picked from commit 2483a578a80a916d9f5acd672d85830385b236e2)\n(cherry picked from commit 10bc689a6796f85c44d19e0c18f0e37b0a87474c)\n(cherry picked from commit d590441ce6897a7a169db7262eb17bcd5d90bcd2)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/0a579cb88e95ff311e4a007a4d7914b975a25ea2"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/0a579cb88e95ff311e4a007a4d7914b975a25ea2"}]},"branch":"refs/heads/stable/pike"},"8c4e23771ce2996a8f630b37e3d294368e854f4b":{"kind":"NO_CODE_CHANGE","_number":5,"created":"2020-05-11 16:42:46.000000000","uploader":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"ref":"refs/changes/16/726016/5","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/16/726016/5","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/16/726016/5 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/16/726016/5 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/16/726016/5 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/16/726016/5"}}},"commit":{"parents":[{"commit":"5ba1b6ace597e9ce5fd25edac874c73abfabf743","subject":"Import LDAP job into project","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/5ba1b6ace597e9ce5fd25edac874c73abfabf743"}]}],"author":{"name":"Colleen Murphy","email":"colleen.murphy@suse.com","date":"2020-04-17 03:35:46.000000000","tz":-420},"committer":{"name":"guang-yee","email":"gyee@suse.com","date":"2020-05-11 16:42:41.000000000","tz":0},"subject":"Ensure OAuth1 authorized roles are respected","message":"Ensure OAuth1 authorized roles are respected\n\nWithout this patch, when an OAuth1 request token is authorized with a\nlimited set of roles, the roles for the access token are ignored when\nthe user uses it to request a keystone token. This means that user of an\naccess token can use it to escallate their role assignments beyond what\nwas authorized by the creator. This patch fixes the issue by ensuring\nthe token model accounts for an OAuth1-scoped token and correctly\npopulating the roles for it.\n\nModified to work with older test helper function:\n\n  keystone/tests/unit/test_v3_oauth1.py\n\nConflicts:\n\n  keystone/models/token_model.py\n\n  The keystone token model was refactored in the Rocky release. This\n  commit only backports the test so that we have test coverage against\n  the bug and proves there wasn\u0027t a regression in Queens. As such, the\n  code changes to token_model.py (where the bug was introduced) are not\n  applicable to Pike.\n\nChange-Id: I02f9836fbd4d7e629653977fc341476cfd89859e\nCloses-bug: #1873290\n(cherry picked from commit 6c73690f779a42a5c62914b6bc37f0ac2f41a3e3)\n(cherry picked from commit ba89d27793c2d3a26ad95642660fa9bd820ed3be)\n(cherry picked from commit 5ff52dbaa2082991d229d8557a8e4b65256d6c53)\n(cherry picked from commit 2483a578a80a916d9f5acd672d85830385b236e2)\n(cherry picked from commit 10bc689a6796f85c44d19e0c18f0e37b0a87474c)\n(cherry picked from commit d590441ce6897a7a169db7262eb17bcd5d90bcd2)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/8c4e23771ce2996a8f630b37e3d294368e854f4b"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/8c4e23771ce2996a8f630b37e3d294368e854f4b"}]},"branch":"refs/heads/stable/pike"},"7653847a04e56555b8d172a3d5c76a95533cdec7":{"kind":"REWORK","_number":6,"created":"2020-05-14 17:27:45.000000000","uploader":{"_account_id":1916,"name":"Guang Yee","email":"gyee@suse.com","username":"guang-yee"},"ref":"refs/changes/16/726016/6","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/16/726016/6","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/16/726016/6 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/16/726016/6 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/16/726016/6 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/16/726016/6"}}},"commit":{"parents":[{"commit":"5ba1b6ace597e9ce5fd25edac874c73abfabf743","subject":"Import LDAP job into project","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/5ba1b6ace597e9ce5fd25edac874c73abfabf743"}]}],"author":{"name":"Colleen Murphy","email":"colleen.murphy@suse.com","date":"2020-04-17 03:35:46.000000000","tz":-420},"committer":{"name":"Guang Yee","email":"guang.yee@suse.com","date":"2020-05-14 17:27:19.000000000","tz":-420},"subject":"Ensure OAuth1 authorized roles are respected","message":"Ensure OAuth1 authorized roles are respected\n\nWithout this patch, when an OAuth1 request token is authorized with a\nlimited set of roles, the roles for the access token are ignored when\nthe user uses it to request a keystone token. This means that user of an\naccess token can use it to escallate their role assignments beyond what\nwas authorized by the creator. This patch fixes the issue by ensuring\nthe token model accounts for an OAuth1-scoped token and correctly\npopulating the roles for it.\n\nModified to work with older test helper function:\n\n  keystone/tests/unit/test_v3_oauth1.py\n\nConflicts:\n\n  keystone/models/token_model.py\n\n  The keystone token model was refactored in the Rocky release. This\n  commit only backports the test so that we have test coverage against\n  the bug and proves there wasn\u0027t a regression in Queens. As such, the\n  code changes to token_model.py (where the bug was introduced) are not\n  applicable to Pike.\n\n  releasenotes/notes/bug-1873290-ff7f8e4cee15b75a.yaml\n\n  Removed the release note since there isn\u0027t anything to signal to\n  operators regarding a vulnerability. We\u0027re only adding test coverage\n  to prove that stable/queens isn\u0027t vulnerable.\n\nChange-Id: I02f9836fbd4d7e629653977fc341476cfd89859e\nCloses-bug: #1873290\n(cherry picked from commit 6c73690f779a42a5c62914b6bc37f0ac2f41a3e3)\n(cherry picked from commit ba89d27793c2d3a26ad95642660fa9bd820ed3be)\n(cherry picked from commit 5ff52dbaa2082991d229d8557a8e4b65256d6c53)\n(cherry picked from commit 2483a578a80a916d9f5acd672d85830385b236e2)\n(cherry picked from commit 10bc689a6796f85c44d19e0c18f0e37b0a87474c)\n(cherry picked from commit d590441ce6897a7a169db7262eb17bcd5d90bcd2)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/7653847a04e56555b8d172a3d5c76a95533cdec7"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/7653847a04e56555b8d172a3d5c76a95533cdec7"}]},"branch":"refs/heads/stable/pike"}},"requirements":[],"submit_records":[],"submit_requirements":[]}