)]}'
{"id":"openstack%2Fkeystone~769220","triplet_id":"openstack%2Fkeystone~stable%2Fvictoria~I903d20fa41270499ca1c39d296120dd97cef5405","project":"openstack/keystone","branch":"stable/victoria","hashtags":[],"change_id":"I903d20fa41270499ca1c39d296120dd97cef5405","subject":"Use app cred user ID in policy enforcement","status":"MERGED","created":"2021-01-04 22:13:07.000000000","updated":"2021-01-26 16:24:02.000000000","submitted":"2021-01-26 16:18:47.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"769220","meta_rev_id":"5d1cad9f4c9299eb2ece0a1cc88eab8e532556fd","_number":769220,"virtual_id_number":769220,"owner":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},{"value":0,"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"value":0,"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2021-01-26 16:18:41.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"recommended":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"all":[{"value":1,"date":"2021-01-19 14:28:58.000000000","permitted_voting_range":{"min":1,"max":2},"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},{"value":2,"date":"2021-01-25 17:29:23.000000000","_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"value":2,"date":"2021-01-26 14:11:35.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","value":1,"default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"all":[{"value":0,"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},{"value":0,"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"value":1,"date":"2021-01-26 14:11:35.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2021-01-04 23:35:35.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2021-01-19 14:28:58.000000000","updated_by":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"reviewer":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"state":"REVIEWER"},{"updated":"2021-01-22 18:31:34.000000000","updated_by":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"reviewer":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"state":"REVIEWER"}],"messages":[{"id":"6b00802fd0e9234f244d47b8b93c5d952208cc70","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2021-01-04 22:13:07.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"67f9b0d0baece0e38a985672945b0dc8f483e19a","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2021-01-04 23:35:35.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/d28e0d40655542b49b0a0d7e9d80ad96 : SUCCESS in 14m 56s\n- openstack-tox-lower-constraints https://zuul.opendev.org/t/openstack/build/20dea9cafedd4e1d91ca18e247e76947 : FAILURE in 3m 54s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/59655898ad084b76979d35062f67dc16 : SUCCESS in 5m 30s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/1833209d4d7745c6a6d7cc823b4c2a32 : SUCCESS in 13m 38s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/bc4cf79627bd4776bcf61d0ba4217aa8 : SUCCESS in 13m 57s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/e43a0209d1e0420898c9252cd8970311 : SUCCESS in 13m 23s\n- grenade https://zuul.opendev.org/t/openstack/build/7a44d5740075412295bf34272556c339 : SUCCESS in 58m 06s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/8dd3695a1ac5419ab8e8b2119b72bff9 : SUCCESS in 1h 19m 56s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/1c3a783806c74367ab3197299bf820a4 : SUCCESS in 7m 44s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/1134d511e0e8440683a595dcd300df89 : SUCCESS in 34m 38s\n- keystone-dsvm-py3-functional-federation-ubuntu-focal https://zuul.opendev.org/t/openstack/build/e59e8ff219e845c5b4321dc39526eb9d : SUCCESS in 34m 54s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-focal-k2k https://zuul.opendev.org/t/openstack/build/61f549e9c618487ab6ddaf55f2cd0bdd : SUCCESS in 33m 31s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/8728ce5e73dc48c28d0f1b7838e4806d : FAILURE in 18m 28s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/1a76f68bbf1a4f1a869533bf2ce0e203 : FAILURE in 15m 41s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/bc6c7cb77eb24386b35556c43e14f5fb : SUCCESS in 1h 05m 23s\n- keystone-tox-protection https://zuul.opendev.org/t/openstack/build/2e06c21314c14f5d8cc24e88f14793ae : SUCCESS in 43m 54s","accounts_in_message":[],"_revision_number":1},{"id":"5904344617a99dfafecd9a0a27b65bee869d774a","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2021-01-08 16:49:25.000000000","message":"Patch Set 2: Patch Set 1 was rebased","accounts_in_message":[],"_revision_number":2},{"id":"03f149a400805ed9d22a66d1f90e5079fc765e16","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2021-01-08 22:18:51.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/ff4127efa4024eb9a93b2c2e1ef80085 : SUCCESS in 17m 35s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/c634b210ee4a4988b746cbfc5d0e9ec2 : SUCCESS in 6m 14s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/914c0192fee94c4982bade16abbe1321 : SUCCESS in 23m 22s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/c2e5789e8c7c48ca97ed0f7b028a02ef : SUCCESS in 13m 48s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/ec9ce9c4e1074810860601bad7db7808 : SUCCESS in 16m 33s\n- grenade https://zuul.opendev.org/t/openstack/build/88aef5b79ffd45a2ad969e5bbb357191 : SUCCESS in 1h 05m 25s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/b86bd2478503448e89e3cf9ad40487cf : FAILURE in 1h 10m 44s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/4e32f1918f864cf68ec41423aee43c50 : SUCCESS in 6m 56s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/ae17cbb2a884427c864a160ba8f0809f : SUCCESS in 36m 01s\n- keystone-dsvm-py3-functional-federation-ubuntu-focal https://zuul.opendev.org/t/openstack/build/812fd1f3d0ff45bb984baa42d49d0dcb : SUCCESS in 43m 25s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-focal-k2k https://zuul.opendev.org/t/openstack/build/864e8bfb6f0247e89f7cf64c10375835 : SUCCESS in 36m 56s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/9cd27f3fc6214a28a3685a63553ac19f : SUCCESS in 17m 30s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/7d520407bbb944389b02e10615a434d9 : FAILURE in 12m 41s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/b125281552f646e7862525b3eb0cbed2 : SUCCESS in 50m 24s\n- keystone-tox-protection https://zuul.opendev.org/t/openstack/build/b964a93ae28f4c8c93f33e8c4d37fe80 : SUCCESS in 39m 11s","accounts_in_message":[],"_revision_number":2},{"id":"9f17212caae9595f592232ae871e168976f84e3e","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2021-01-11 14:03:04.000000000","message":"Patch Set 2:\n\nrecheck","accounts_in_message":[],"_revision_number":2},{"id":"abf8d5ffaf0c48dddd05ffebe452bcacf7aa5496","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2021-01-11 18:02:33.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/c59a2a2c965948159ebd021a7cbb2354 : SUCCESS in 16m 18s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/955a4c474c81479f8ccc7097e751052e : SUCCESS in 5m 31s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/86166d2a1244480e8b43fc32cb327817 : SUCCESS in 15m 30s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/5d0125b8503c4ba1a9a23d4d8863679d : SUCCESS in 18m 03s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/08b2068ee38248cb9e8e311c579d734c : SUCCESS in 12m 45s\n- grenade https://zuul.opendev.org/t/openstack/build/01b1bdae9b42414493b7757df141cf82 : SUCCESS in 59m 28s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/42d35a744ecc4ec982e3b58341533a11 : SUCCESS in 1h 20m 11s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/0b18aef4562b4dbe8c2f7820b0f307a0 : SUCCESS in 6m 20s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/cd2ad27628ff4a02993ada84dfb5f83a : SUCCESS in 39m 34s\n- keystone-dsvm-py3-functional-federation-ubuntu-focal https://zuul.opendev.org/t/openstack/build/703bddf9952842c6acfcc1bd586b4e2c : SUCCESS in 47m 50s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-focal-k2k https://zuul.opendev.org/t/openstack/build/580fda1ff482401fbe4b2144ca541928 : SUCCESS in 35m 51s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/dfa6048b53174980b18811430f86a9e9 : SUCCESS in 15m 48s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/b47530ddafeb4f3e8a6b92167100ab39 : FAILURE in 12m 29s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/7be4621951324affb24938c62461ff2a : SUCCESS in 59m 45s\n- keystone-tox-protection https://zuul.opendev.org/t/openstack/build/1347eef54fc74b8e8ffc2e29bd1b1202 : SUCCESS in 42m 09s","accounts_in_message":[],"_revision_number":2},{"id":"d7830958d126eacfad9d124d1b2bc428946732a5","author":{"_account_id":16465,"name":"Kristi Nikolla","email":"knikolla@bu.edu","username":"knikolla"},"date":"2021-01-19 14:28:58.000000000","message":"Patch Set 2: Code-Review+1","accounts_in_message":[],"_revision_number":2},{"id":"2ed069453ad77abbcb1dd78c9dd764d4cb361e82","author":{"_account_id":8482,"name":"Colleen Murphy","email":"colleen@gazlene.net","username":"krinkle"},"date":"2021-01-25 17:29:23.000000000","message":"Patch Set 2: Code-Review+2","accounts_in_message":[],"_revision_number":2},{"id":"ab7e7e928dec700eb4bb7a5fd21dfa8e5f90e13e","author":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"date":"2021-01-26 14:11:35.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":2},{"id":"643574eafeb9039db3c9c0b209ba4d48ee02c6b6","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2021-01-26 14:12:14.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"15260e66fab8ba52c8d28683c64e65b8abf2aa21","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2021-01-26 16:18:41.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/76bd4c0fe23444438186922173136987 : SUCCESS in 5m 19s\n- openstack-tox-py36 https://zuul.opendev.org/t/openstack/build/427aba3d2d0f4e57b22f926e7dd69349 : SUCCESS in 14m 32s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/6dac7a6440204faa8dcaebf6c8804053 : SUCCESS in 13m 25s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/ad2eb13c052a4c7abce51ea6c6de9c3a : SUCCESS in 12m 49s\n- grenade https://zuul.opendev.org/t/openstack/build/f9448abe733a492d9b5fce06eb40df87 : SUCCESS in 58m 02s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/d1704aa8daf7406a91354fd80b3408ab : SUCCESS in 1h 22m 10s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/ea64369a68f948c4abef6aef7bd37e37 : SUCCESS in 7m 16s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/7400e3b6705c42aebd60d24a83031123 : SUCCESS in 34m 27s\n- keystone-dsvm-py3-functional-federation-ubuntu-focal-k2k https://zuul.opendev.org/t/openstack/build/72feed34f25e48929f711e889afee6e9 : SUCCESS in 30m 05s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/03aec87e62884542bc2f4367a7ea76ff : SUCCESS in 55m 02s\n- keystone-tox-protection https://zuul.opendev.org/t/openstack/build/7a13e1c88bd6483a9aa00d0c4aece6a4 : SUCCESS in 45m 26s","accounts_in_message":[],"_revision_number":2},{"id":"6622aa5f1ab73adab86e385a8554c79f65c0df1c","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2021-01-26 16:18:47.000000000","message":"Change has been successfully merged by Zuul","accounts_in_message":[],"_revision_number":2},{"id":"5d1cad9f4c9299eb2ece0a1cc88eab8e532556fd","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2021-01-26 16:24:02.000000000","message":"Patch Set 2:\n\nBuild succeeded (promote pipeline).\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/daee0c12a7324611a5902ed6298db023 : SUCCESS in 1m 49s\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/52aab79264274b598d4ca994973ff11e : SUCCESS in 1m 23s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"66c3bd8d2575839a830bac072b1bac14f94a7b31","revisions":{"80832de6ced534bccbf7cfe24a6a01c8262c1779":{"kind":"REWORK","_number":1,"created":"2021-01-04 22:13:07.000000000","uploader":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"ref":"refs/changes/20/769220/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/20/769220/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/20/769220/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/20/769220/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/20/769220/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/20/769220/1"}}},"commit":{"parents":[{"commit":"a26a40d441e7f211fd68e0c1b9c779d965c19dea","subject":"Implement more robust connection handling for asynchronous LDAP calls","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a26a40d441e7f211fd68e0c1b9c779d965c19dea"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-02 17:22:49.000000000","tz":0},"committer":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2021-01-04 22:04:40.000000000","tz":0},"subject":"Use app cred user ID in policy enforcement","message":"Use app cred user ID in policy enforcement\n\nThe application credential policies use the `rule:owner` policy to allow\nusers to manage their own credentials. The policy engine pulled the\nuser_id attribute from the request path instead of the actual\napplication credential. This allowed for users to exploit the\nenforcement and view or delete application credentials they don\u0027t own.\n\nThis commit attempts to resolve the issue by updating the flask\nparameters before they\u0027re translated to policy arguments and target\ndata, prior to policy enforcement.\n\nChange-Id: I903d20fa41270499ca1c39d296120dd97cef5405\nCloses-Bug: 1901207\n(cherry picked from commit 2d7bf10a5a145ed3b6e34c3cb95e05fb7e33e0d1)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/80832de6ced534bccbf7cfe24a6a01c8262c1779"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/80832de6ced534bccbf7cfe24a6a01c8262c1779"}]},"branch":"refs/heads/stable/victoria"},"66c3bd8d2575839a830bac072b1bac14f94a7b31":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2021-01-08 16:49:25.000000000","uploader":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"},"ref":"refs/changes/20/769220/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/20/769220/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/20/769220/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/20/769220/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/20/769220/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/20/769220/2"}}},"commit":{"parents":[{"commit":"66594899804a34281a7a9c088d2aa39c7816ec7c","subject":"Update TOX_CONSTRAINTS_FILE for stable/victoria","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/66594899804a34281a7a9c088d2aa39c7816ec7c"}]}],"author":{"name":"Lance Bragstad","email":"lbragstad@gmail.com","date":"2020-11-02 17:22:49.000000000","tz":0},"committer":{"name":"Lance Bragstad","email":"lbragstad@redhat.com","date":"2021-01-08 16:49:25.000000000","tz":0},"subject":"Use app cred user ID in policy enforcement","message":"Use app cred user ID in policy enforcement\n\nThe application credential policies use the `rule:owner` policy to allow\nusers to manage their own credentials. The policy engine pulled the\nuser_id attribute from the request path instead of the actual\napplication credential. This allowed for users to exploit the\nenforcement and view or delete application credentials they don\u0027t own.\n\nThis commit attempts to resolve the issue by updating the flask\nparameters before they\u0027re translated to policy arguments and target\ndata, prior to policy enforcement.\n\nChange-Id: I903d20fa41270499ca1c39d296120dd97cef5405\nCloses-Bug: 1901207\n(cherry picked from commit 2d7bf10a5a145ed3b6e34c3cb95e05fb7e33e0d1)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/66c3bd8d2575839a830bac072b1bac14f94a7b31"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/66c3bd8d2575839a830bac072b1bac14f94a7b31"}]},"branch":"refs/heads/stable/victoria","description":"Rebase"}},"requirements":[],"submit_records":[{"status":"CLOSED","labels":[{"label":"Verified","status":"OK","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"OK","applied_by":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"}},{"label":"Workflow","status":"OK","applied_by":{"_account_id":5046,"name":"Lance Bragstad","email":"lbragstad@redhat.com","username":"ldbragst"}}]}],"submit_requirements":[{"name":"Verified","status":"SATISFIED","is_legacy":true,"submittability_expression_result":{"expression":"label:Verified\u003dCustom-Rule","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dCustom-Rule"],"failing_atoms":[],"atom_explanations":{}}},{"name":"Workflow","status":"SATISFIED","is_legacy":true,"submittability_expression_result":{"expression":"label:Workflow\u003dCustom-Rule","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dCustom-Rule"],"failing_atoms":[],"atom_explanations":{}}},{"name":"Code-Review","status":"SATISFIED","is_legacy":true,"submittability_expression_result":{"expression":"label:Code-Review\u003dCustom-Rule","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dCustom-Rule"],"failing_atoms":[],"atom_explanations":{}}}]}