)]}'
{"id":"openstack%2Fkeystone~908935","triplet_id":"openstack%2Fkeystone~stable%2F2023.1~Iffbe11c57c61bbd1b045a6567a9249c12dff403c","project":"openstack/keystone","branch":"stable/2023.1","topic":"secure-rbac-stable/2023.2-stable/2023.1","attention_set":{},"removed_from_attention_set":{"7973":{"account":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"last_update":"2024-02-14 21:29:17.000000000","reason":"Change was submitted"},"7414":{"account":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"last_update":"2024-02-14 15:50:52.000000000","reason":"\u003cGERRIT_ACCOUNT_7414\u003e replied on the change","reason_account":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"}},"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2024-02-14 19:56:44.000000000","reason":"\u003cGERRIT_ACCOUNT_14250\u003e replied on the change","reason_account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}}},"hashtags":[],"change_id":"Iffbe11c57c61bbd1b045a6567a9249c12dff403c","subject":"Normalize policy checks for domain-scoped tokens","status":"MERGED","created":"2024-02-14 15:48:43.000000000","updated":"2024-02-14 21:30:41.000000000","submitted":"2024-02-14 21:29:17.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"908935-secure-rbac-stable/2023.2-stable/2023.1","cherry_pick_of_change":908807,"cherry_pick_of_patch_set":1,"meta_rev_id":"acd65c44bcdb84a077bff17469193d4bc7efcedc","_number":908935,"virtual_id_number":908935,"owner":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2024-02-14 21:29:17.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"all":[{"value":2,"date":"2024-02-14 15:50:52.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":2,"date":"2024-02-14 19:56:44.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":0,"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":1,"date":"2024-02-14 19:56:44.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2024-02-14 15:49:09.000000000","updated_by":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2024-02-14 15:49:09.000000000","updated_by":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"reviewer":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"state":"REVIEWER"},{"updated":"2024-02-14 16:45:50.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"CC"},{"updated":"2024-02-14 17:17:12.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"d779d8fb916b61d287b4ed556f7636dfb265a925","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"date":"2024-02-14 15:48:43.000000000","message":"Patch Set 1: Cherry Picked from branch stable/2023.2.","accounts_in_message":[],"_revision_number":1},{"id":"4ff7c6359cca60f5ab4419b66d44584d696f4fb4","author":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"date":"2024-02-14 15:50:52.000000000","message":"Patch Set 1: Code-Review+2","accounts_in_message":[],"_revision_number":1},{"id":"caeafc1a6c153d8e119b966f5f26c474b27ac8dc","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2024-02-14 16:45:50.000000000","message":"Patch Set 1:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/48a95e35211240ffa9587bc09fe8eef7\n\n- openstack-tox-py38-arm64 https://zuul.opendev.org/t/openstack/build/993f417d80ff4f4e9ac552e1ced0fb43 : SUCCESS in 56m 31s (non-voting)\n- openstack-tox-py39-arm64 https://zuul.opendev.org/t/openstack/build/2bfa3b947c114109a8a8cfb263698956 : SUCCESS in 17m 06s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"bbb152c00cfef7cf0f1c4b5e2afcc2d520cd32ec","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2024-02-14 17:17:12.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/d0ed36044e6f4f7098072395b8285d16\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/4ec1618681fd4526b548aacb48b6270f : SUCCESS in 15m 26s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/c0b528813a1344d9b8eadd917cef1459 : SUCCESS in 4m 58s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/4bed3a4315e24b5cafeedf839fae3c85 : SUCCESS in 10m 29s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/ce4d66e9ab9a4f949348dd55d18611b8 : SUCCESS in 9m 53s\n- grenade https://zuul.opendev.org/t/openstack/build/1f21631a87c04354a0c2c1a4b8f25314 : SUCCESS in 1h 03m 17s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/3a077bd4331142169fb31f631309c8f8 : SUCCESS in 1h 22m 46s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/f5a9d3b1f431470b95a542906d5a2c0c : SUCCESS in 31m 30s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/2d648bba8b4c47f99372e26e1da9b4a9 : SUCCESS in 58m 18s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-focal https://zuul.opendev.org/t/openstack/build/55216dffa928438aa7ab383bcce5ce56 : FAILURE in 25m 15s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-focal-k2k https://zuul.opendev.org/t/openstack/build/cc12ebb035574bb0a5fb75592cb581b8 : SUCCESS in 22m 31s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/190d34114e6348928b15fb5cfcb93ba8 : SUCCESS in 18m 19s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/3d6e27d7a2544de98b1c9b60772ea935 : FAILURE in 23m 32s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/71681bb7fdc14e3d9c567ab1a7f6600a : SUCCESS in 54m 37s","accounts_in_message":[],"_revision_number":1},{"id":"c9c11ce712a50c44fdd7800be4feb50cac948bd5","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2024-02-14 19:56:44.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"d804329d0b647c1c594c743738bf0b23f2ca8a18","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2024-02-14 19:57:15.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"3b2f48aa08152d21ebb34e0106568d54489ad3f6","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2024-02-14 21:29:17.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/f6d89023261c48368ab8f30b2b34ba2e\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/db872bbec7a74cc792599cab0291d131 : SUCCESS in 5m 04s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/814311c66ba4443ca3852ea70382f487 : SUCCESS in 13m 10s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/05d98bb3a5c74400afde38d780604777 : SUCCESS in 12m 02s\n- grenade https://zuul.opendev.org/t/openstack/build/1a8752f021ad4b11b5ad7fee248fd6a7 : SUCCESS in 1h 00m 18s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/a796cffd273144d88ddea3aa9c968bf1 : SUCCESS in 1h 19m 30s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/7fbce4213cc34e5da2d8d58cd13dd247 : SUCCESS in 36m 43s\n- keystone-dsvm-py3-functional-federation-ubuntu-focal-k2k https://zuul.opendev.org/t/openstack/build/d891d75b4a1c4f84b63123c9f7bb624f : SUCCESS in 20m 32s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/2e82196b908c4b51bc63864ce2ae0e50 : SUCCESS in 35m 05s","accounts_in_message":[],"_revision_number":1},{"id":"4f7f5442fa527d06da7cb6f9947473c62750ee10","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2024-02-14 21:29:17.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1},{"id":"acd65c44bcdb84a077bff17469193d4bc7efcedc","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2024-02-14 21:30:41.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/f8349d71eb7a4e1898d9db371171f3b8\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/134388dbd7a14638a6d2f23f2261d153 : SUCCESS in 1m 05s","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"828519f4636a3c4a5c77975b970833e0ae62955c","revisions":{"828519f4636a3c4a5c77975b970833e0ae62955c":{"kind":"REWORK","_number":1,"created":"2024-02-14 15:48:43.000000000","uploader":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"ref":"refs/changes/35/908935/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/35/908935/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/35/908935/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/35/908935/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/35/908935/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/35/908935/1"}}},"commit":{"parents":[{"commit":"1c2d5178852155e3c6ce19352a03e9fb57c6c5f6","subject":"Allow users with \"admin\" role to get projects","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/1c2d5178852155e3c6ce19352a03e9fb57c6c5f6"}]}],"author":{"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","date":"2024-02-08 20:36:38.000000000","tz":-360},"committer":{"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","date":"2024-02-14 15:48:43.000000000","tz":0},"subject":"Normalize policy checks for domain-scoped tokens","message":"Normalize policy checks for domain-scoped tokens\n\nThis patch fixes an inconsistency in the policies for role_assignment\nwhere the target object used for policy enforcement was being created\nwith different properties depending on the request query string.\n\nThis required policies to be written in two differnt ways to validate\ndomain IDs for domain-scoped requests.  e.g. checking for domain reader\nwas using both:\n\n    role:reader and domain_id:%(target.domain_id)s\n\nand\n\n    role:reader and domain_id:%(target.project.domain_id)s\n\nWith the former only being populated for GET /v3/role_assignments and\nthe latter only being populated for GET\n/v3/role_assignments?scope.project.id\u003dSOME_ID\n\nThis patch fixes the target object so that only target.domain_id needs\nto be checked for domain-scoped tokens.\n\nChange-Id: Iffbe11c57c61bbd1b045a6567a9249c12dff403c\n(cherry picked from commit 7dc175a41f92e3f01cf26912431d0f2c98a03b32)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/828519f4636a3c4a5c77975b970833e0ae62955c"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/828519f4636a3c4a5c77975b970833e0ae62955c"}]},"branch":"refs/heads/stable/2023.1"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{}}}]}