)]}'
{"id":"openstack%2Fkeystone~966189","triplet_id":"openstack%2Fkeystone~master~I8365051f78cd807a8b98e738f4b273a3442c3b59","project":"openstack/keystone","branch":"master","attention_set":{},"removed_from_attention_set":{"16137":{"account":{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},"last_update":"2025-12-16 15:23:50.000000000","reason":"\u003cGERRIT_ACCOUNT_16137\u003e replied on the change","reason_account":{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"}},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-04-02 08:51:29.000000000","reason":"Change was abandoned"}},"hashtags":[],"change_id":"I8365051f78cd807a8b98e738f4b273a3442c3b59","subject":"Allow service user to get and list credentials","status":"ABANDONED","created":"2025-11-05 15:04:14.000000000","updated":"2026-04-02 08:51:29.000000000","total_comment_count":3,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"566d392cae82628524bd294f332345393eab8faa","_number":966189,"virtual_id_number":966189,"owner":{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:check","value":1,"date":"2025-11-11 13:26:34.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"CC":[{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2025-11-05 16:52:13.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2025-12-05 16:10:18.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"CC"}],"messages":[{"id":"68f10a1f5e8b31adc95b52236fbf14c904e9dddd","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},"date":"2025-11-05 15:04:14.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"ac52015f56c582092fba59f49fada00729f37c83","tag":"autogenerated:gerrit:setWorkInProgress","author":{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},"date":"2025-11-05 15:38:52.000000000","message":"Set Work In Progress","accounts_in_message":[],"_revision_number":1},{"id":"5dffbdf25826b509fdbb2fe9e2c9843e68757e5d","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-11-05 16:52:13.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/194c8d735f364fc9bb6f28973041cf1a\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/fdb18a4212b040529dca92b87b6c8a3c : SUCCESS in 17m 30s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/de572eb898c24d7b8cab4b5c311dc08d : FAILURE in 6m 30s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/03aff2e9e934414d9216ee6f68cc34b3 : SUCCESS in 13m 39s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/30d7e6c7fd204fa8830d35365df62dba : SUCCESS in 12m 04s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/7d6ff067b0174d0ca0fe896666b00b0e : SUCCESS in 12m 39s\n- grenade https://zuul.opendev.org/t/openstack/build/7a3050a34f7d40e6b120e18953ed25b6 : SUCCESS in 1h 00m 58s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/290621186e8545089dffb8e19d1c4cc5 : SUCCESS in 1h 44m 50s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/870ee4d26d044b90bb69b93637d0dc1a : SUCCESS in 14m 36s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/b7cafb9f830d4cc18841d919109cd470 : SUCCESS in 22m 23s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/39c261e448cc42848371b577a755fba6 : FAILURE in 19m 23s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/27a3763851cf44d49b218e5320483483 : FAILURE in 15m 06s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/a38bd32407e04da6971fbae0be1442c2 : SUCCESS in 15m 03s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/0120a592276343ab9f8c548d6c9229e9 : SUCCESS in 32m 17s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/c5aecae0400c4a1d97266428463a7af2 : SUCCESS in 27m 50s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/7b09b51fc38448879af3bf7950cc28fa : SUCCESS in 56m 10s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/1428afd6195b42ea9df7671556e6df72 : FAILURE in 42m 57s (non-voting)\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/e497ef21b4e84837943223eed708425d : RETRY_LIMIT in 5m 26s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"7a03a10b43d2e577778004e4053f36a3be7b4fdb","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-11-05 18:51:37.000000000","message":"Patch Set 1:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/092b582ff3a44d2fbf2cf3fd8bf42310\n\n- openstack-tox-py310-arm64 https://zuul.opendev.org/t/openstack/build/7c3eeb9f091f4cc79cc8adaedac9cf4f : SUCCESS in 29m 33s (non-voting)\n- openstack-tox-py312-arm64 https://zuul.opendev.org/t/openstack/build/b8a831753b0941ffb905fa402f78ea68 : SUCCESS in 18m 27s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/5470a587c474404582e9957fc975b479 : SUCCESS in 33m 41s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"d74aa4f8724fa2acf9a3a1b2f3798c4fa149c747","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},"date":"2025-11-11 11:42:00.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Verified-1\n","accounts_in_message":[],"_revision_number":2},{"id":"8f3cec4fe1d9dff9ded6eef9d6b51b22041d2f3e","tag":"autogenerated:gerrit:setReadyForReview","author":{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},"date":"2025-11-11 11:42:12.000000000","message":"Set Ready For Review","accounts_in_message":[],"_revision_number":2},{"id":"3b4c590848a6b1f699bc85a77a926e5d1a498a2c","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-11-11 12:22:05.000000000","message":"Patch Set 2:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/02d6ac348ad149fbbc26eae0c3dc63ad\n\n- openstack-tox-py310-arm64 https://zuul.opendev.org/t/openstack/build/3603466d6811446793c28c0ab7ca76c9 : SUCCESS in 30m 57s (non-voting)\n- openstack-tox-py312-arm64 https://zuul.opendev.org/t/openstack/build/a434f7a2d78e4dab98ea190d77af9085 : SUCCESS in 16m 43s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/0138abf5251f409b92e1c6989b474b8e : SUCCESS in 25m 03s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"f1f1b20c1d389628e06aa4f705d4d54d00a8a5f5","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-11-11 13:26:34.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/3f567e59644c4861b708a599978047d5\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/1a5b7b55bd604bc6870277f6e348b46e : SUCCESS in 17m 31s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/ea75e765940d40e0bb854378109b3ea5 : SUCCESS in 6m 24s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/e5a5cd340eb34500bef6b3fd7c546e16 : SUCCESS in 13m 11s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/4ffdc4d0262d4d699fdb162c36c9f44a : SUCCESS in 14m 28s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/32536f37b43e4c4985886078da68667d : SUCCESS in 16m 39s\n- grenade https://zuul.opendev.org/t/openstack/build/46722037166c4bcc8da5b8193b94aaaa : SUCCESS in 57m 06s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/a042c1c5c66b4fcd93ac2a4e4e3adbd2 : SUCCESS in 1h 39m 17s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/6a087bb6b8fb463d808ce19eda524940 : SUCCESS in 12m 05s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/b71b23328454406487a190fa87ea2955 : SUCCESS in 15m 13s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/11c2caac3df94a229c0c98d5aa54d635 : SUCCESS in 29m 52s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/9ad1239be9e84cd99f951c3e4cde7937 : FAILURE in 13m 07s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/be1254d528394709b0f6ce5ecc1fd85f : FAILURE in 26m 06s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/0fb77df4389c429b8495be250f44128d : SUCCESS in 28m 41s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/bcb26269a9784890aaeed5e9d9f74528 : SUCCESS in 32m 38s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/85d8a8c3e7944f9a995216334bf6d8c1 : SUCCESS in 37m 38s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/001c17cd66f746d899b9e51102787bfb : SUCCESS in 1h 00m 32s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/7236fb32ac014cb284851603d69a3f69 : FAILURE in 41m 18s (non-voting)\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/5cd2945431fa46138d90764bb940cc07 : SUCCESS in 6m 45s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"a03ace8fcbb30b70da6602ef7c7681dce0bb7dcc","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2025-12-05 16:10:18.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"62a0fb395b1ca6edc046d5ba6479890b1a9f6eec","author":{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},"date":"2025-12-16 15:23:50.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"066c6a3b208ddf97399c6547ff560e10a46f4d5a","author":{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},"date":"2025-12-16 15:25:06.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"566d392cae82628524bd294f332345393eab8faa","tag":"autogenerated:gerrit:abandon","author":{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},"date":"2026-04-02 08:51:29.000000000","message":"Abandoned\n\nrecommended approach is using a custom keystone role for now","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"bb0745a204f7941e935dedc2bb98d0eb4f8472d1","revisions":{"eac6744fb74c6c2f6b7faf7258e4c682f92af86d":{"kind":"REWORK","_number":1,"created":"2025-11-05 15:04:14.000000000","uploader":{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},"ref":"refs/changes/89/966189/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/89/966189/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/966189/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/966189/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/966189/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/89/966189/1"}}},"commit":{"parents":[{"commit":"5a8e4443d8607cc96de38c5609a9ed979f11f944","subject":"Add service user authentication to ec2 and s3 endpoints","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/5a8e4443d8607cc96de38c5609a9ed979f11f944"}]}],"author":{"name":"Tobias Urdin","email":"tobias.urdin@binero.com","date":"2025-11-05 15:00:06.000000000","tz":60},"committer":{"name":"Tobias Urdin","email":"tobias.urdin@binero.com","date":"2025-11-05 15:00:06.000000000","tz":60},"subject":"wip: Allow service user to get credential policies","message":"wip: Allow service user to get credential policies\n\nThis is a WIP.\n\nThis updates the policies for retrieving a credential\nand EC2 credential for a service user.\n\nThe EC2 credential endpoint is used by Ceph RadosGW\nto retrieve the credential for an authenticated user\nso that it can cache the secret [1].\n\nThis also allows the service user for credential as\nthat is more lightweight (less DB calls) than\nretrieving the EC2 credential and is something that\nCeph RadosGW might user in the future per [2].\n\n[1] https://github.com/ceph/ceph/blob/10cb3fef5e14b85ffcbeb638b7d41a471b61f019/src/rgw/rgw_auth_keystone.cc#L507-L511\n[2] https://github.com/ceph/ceph/pull/63283\n\nChange-Id: I8365051f78cd807a8b98e738f4b273a3442c3b59\nSigned-off-by: Tobias Urdin \u003ctobias.urdin@binero.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/eac6744fb74c6c2f6b7faf7258e4c682f92af86d"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/eac6744fb74c6c2f6b7faf7258e4c682f92af86d"}]},"branch":"refs/heads/master"},"bb0745a204f7941e935dedc2bb98d0eb4f8472d1":{"kind":"REWORK","_number":2,"created":"2025-11-11 11:42:00.000000000","uploader":{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},"ref":"refs/changes/89/966189/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/89/966189/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/966189/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/966189/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/89/966189/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/89/966189/2"}}},"commit":{"parents":[{"commit":"7c78b226bdee95c7842575878a1b6bfa1f755e5b","subject":"Fix the protection tests for creds and ec2 creds","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/7c78b226bdee95c7842575878a1b6bfa1f755e5b"}]}],"author":{"name":"Tobias Urdin","email":"tobias.urdin@binero.com","date":"2025-11-11 11:37:36.000000000","tz":60},"committer":{"name":"Tobias Urdin","email":"tobias.urdin@binero.com","date":"2025-11-11 11:41:49.000000000","tz":60},"subject":"Allow service user to get and list credentials","message":"Allow service user to get and list credentials\n\nThis updates the policies for retrieving and\nlisting credentials and EC2 credential for a\nservice user.\n\nThe EC2 credential endpoint is used by Ceph RadosGW\nto retrieve the credential for an authenticated user\nso that it can cache the secret [1].\n\nThis also allows the service user for credential as\nthat is more lightweight (less DB calls) than\nretrieving the EC2 credential and is something that\nCeph RadosGW might user in the future per [2].\n\n[1] https://github.com/ceph/ceph/blob/10cb3fef5e14b85ffcbeb638b7d41a471b61f019/src/rgw/rgw_auth_keystone.cc#L507-L511\n[2] https://github.com/ceph/ceph/pull/63283\n\nChange-Id: I8365051f78cd807a8b98e738f4b273a3442c3b59\nSigned-off-by: Tobias Urdin \u003ctobias.urdin@binero.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/bb0745a204f7941e935dedc2bb98d0eb4f8472d1"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/bb0745a204f7941e935dedc2bb98d0eb4f8472d1"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{}}}]}