)]}'
{"id":"openstack%2Fkeystone~969992","triplet_id":"openstack%2Fkeystone~stable%2F2025.2~If5b83feabc670ced54ef12fe7826267af7e3419d","project":"openstack/keystone","branch":"stable/2025.2","attention_set":{},"removed_from_attention_set":{"7414":{"account":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"last_update":"2025-12-12 17:38:01.000000000","reason":"Change was submitted"},"1004":{"account":{"_account_id":1004,"name":"Mohammed Naser","email":"mnaser@vexxhost.com","username":"mnaser"},"last_update":"2025-12-12 17:38:01.000000000","reason":"Change was submitted"},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2025-12-10 08:21:55.000000000","reason":"removed on reply"}},"hashtags":[],"change_id":"If5b83feabc670ced54ef12fe7826267af7e3419d","subject":"Invalidate token of user disabled in readonly backend","status":"MERGED","created":"2025-12-05 19:04:50.000000000","updated":"2025-12-12 17:38:01.000000000","submitted":"2025-12-12 17:38:01.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"969992","cherry_pick_of_change":966583,"cherry_pick_of_patch_set":7,"meta_rev_id":"d526e6d038a75628bafa304fb2d7bf0703db62a7","_number":969992,"virtual_id_number":969992,"owner":{"_account_id":1004,"name":"Mohammed Naser","email":"mnaser@vexxhost.com","username":"mnaser"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2025-12-12 17:38:01.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":2,"date":"2025-12-12 15:51:26.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":2,"date":"2025-12-10 08:21:55.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":1,"date":"2025-12-05 21:02:37.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":1,"date":"2025-12-12 15:51:26.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"}],"reviewers":{"REVIEWER":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2025-12-05 19:04:50.000000000","updated_by":{"_account_id":1004,"name":"Mohammed Naser","email":"mnaser@vexxhost.com","username":"mnaser"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"CC"},{"updated":"2025-12-05 20:43:55.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2025-12-05 21:02:30.000000000","updated_by":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"reviewer":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"state":"CC"},{"updated":"2025-12-05 21:02:30.000000000","updated_by":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"REVIEWER"},{"updated":"2025-12-05 21:02:37.000000000","updated_by":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"reviewer":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"state":"REVIEWER"},{"updated":"2025-12-05 21:02:37.000000000","updated_by":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"reviewer":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"state":"REVIEWER"},{"updated":"2025-12-12 15:51:26.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"}],"messages":[{"id":"ab5761ae8192a4462a4d6d0fca84d43a62649771","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1004,"name":"Mohammed Naser","email":"mnaser@vexxhost.com","username":"mnaser"},"date":"2025-12-05 19:04:50.000000000","message":"Patch Set 1: Cherry Picked from branch master.","accounts_in_message":[],"_revision_number":1},{"id":"af2e4451672d3895bf94c080d19d48afd95db840","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-12-05 20:43:55.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/e293f901cc5d457ca607d23e5b35e6ec\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/76a15b08495f4535ab896c444e78ec9c : SUCCESS in 17m 09s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/f865679169904e26a54902fc68069d88 : SUCCESS in 6m 32s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/7b312fbbab754867b6da7ad235c5fb5a : SUCCESS in 10m 41s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/980d3ae9af1d4d97b7dc17b3f0e3af6c : SUCCESS in 8m 31s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/b6dec908679e4ee893c81fca7e75dfc8 : SUCCESS in 9m 36s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/9de6e0d3764e4290874baf49a2707429 : SUCCESS in 14m 39s\n- grenade https://zuul.opendev.org/t/openstack/build/5fc7acd429fc4e5f8f7ea0f56f168a3e : SUCCESS in 30m 41s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/804eb56cdcf14bd888e6e74da36f5f04 : SUCCESS in 1h 33m 26s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/f57a648ec31041cd8204f6d6c963cdb6 : SUCCESS in 10m 00s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/d312e3024a604e52ad201f9e68f493a7 : SUCCESS in 10m 52s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/9a2f3b8af2bd446fa787d0d9b03e2b54 : SUCCESS in 21m 12s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/f56b33c3446349869c259c3ca5b19b04 : FAILURE in 6m 57s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/28223113b2104a0d80afed22b5d0d023 : FAILURE in 16m 50s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/67cd173a1a7c4297a1f3cec9b7c0680d : SUCCESS in 31m 27s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/3bb5b54e08f84d12b9ab0f7728ecd467 : SUCCESS in 30m 45s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/74d5ae61b22c4cf393e773e1d508958b : SUCCESS in 18m 53s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/4be817e129cb4c40b9062478bf7f55d8 : SUCCESS in 55m 43s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/2447e6b1da474589a8a4c0f18fb419df : FAILURE in 41m 11s (non-voting)\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/1f97beb36dc6402da6d28c6fdb931e8c : SUCCESS in 8m 00s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"d4bf4427eb6457b4e08e6186d7c4a7f14e1c79d9","author":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"date":"2025-12-05 21:02:37.000000000","message":"Patch Set 1: Code-Review+1","accounts_in_message":[],"_revision_number":1},{"id":"8bc8e9094858f10fd9d23a2f50ca3e98cb9a0c21","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2025-12-10 08:21:55.000000000","message":"Patch Set 1: Code-Review+2","accounts_in_message":[],"_revision_number":1},{"id":"0658a34da0dc6a4c3081ef324bec7b5f633bf739","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2025-12-12 15:51:26.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"2df9949ea43d6b6b46f863903884962314f45346","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-12-12 15:51:59.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"842d1fc5d7cd9a5f14380a0edee2a6749a6d165c","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-12-12 17:38:01.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/50b1f918a3d34171b5dcc9be5e358573\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/f532f7930aa8441caa2a442f7a3aef6a : SUCCESS in 6m 10s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/643519e1701b4378845f4e44d739e9d3 : SUCCESS in 12m 38s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/141f5238775b442bad3e26746eb58dc1 : SUCCESS in 12m 15s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/ca3a950880d449e89721b1e4215d2b28 : SUCCESS in 12m 47s\n- grenade https://zuul.opendev.org/t/openstack/build/c4a82d8ca9ce4e31886cd9f7c1b5757b : SUCCESS in 31m 56s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/ea6b5695194c4df49267c3d2297d5327 : SUCCESS in 1h 38m 04s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/887c8a15026d488588080cfac916e9e1 : SUCCESS in 8m 23s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/14ede52b473941c2a7899f06c038db90 : SUCCESS in 14m 27s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/5b95e1f9eeb4408e9396fec5d2934457 : SUCCESS in 12m 37s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/db489f35ca6245f0956f88345a9baa9e : SUCCESS in 57m 55s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/f47832c71e464e50b59c35b9c85a91ff : FAILURE in 34m 43s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"d526e6d038a75628bafa304fb2d7bf0703db62a7","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-12-12 17:38:01.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"2ee76fa47097262491f32c43653b7363cced3b66","revisions":{"2ee76fa47097262491f32c43653b7363cced3b66":{"kind":"REWORK","_number":1,"created":"2025-12-05 19:04:50.000000000","uploader":{"_account_id":1004,"name":"Mohammed Naser","email":"mnaser@vexxhost.com","username":"mnaser"},"ref":"refs/changes/92/969992/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/92/969992/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/92/969992/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/92/969992/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/92/969992/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/92/969992/1"}}},"commit":{"parents":[{"commit":"47f155b242586a4ee479cb50b03aeecaa2d3b63a","subject":"Bytes-vs-str mismatch causes repeated ID mapping creates on list","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/47f155b242586a4ee479cb50b03aeecaa2d3b63a"}]}],"author":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2025-11-10 15:01:18.000000000","tz":60},"committer":{"name":"Mohammed Naser","email":"mnaser@vexxhost.com","date":"2025-12-05 19:04:50.000000000","tz":0},"subject":"Invalidate token of user disabled in readonly backend","message":"Invalidate token of user disabled in readonly backend\n\nWe support custom identity plugins. They (and also LDAP backend) may be\nconsidered as a read-only (not supporting user data modification through\nKeystone API). When a user of such backend is disabled in the remote\nsystem Keystone will never learn about that and as such tokens for those\nusers will remain active. They cannot be renewed, but still they stay\nvalid.\nIn order to address this situation we need to do additional steps in the\ntoken validation and identify the current state of the user in the\nbackend. Due to the use of the token caching it is not possible to reuse\nnormal token validation functionality (it will never gets invalidated as\nsuch). In order to keep performance impact as low as possible modify the\ntoken validation as following:\n- regular checks\n- revocation check\n- if token is still active and revoke check passed fetch current user\n  data. When user is disabled - log a warning (explaining the situation)\n  and raise `UserDisabled` exception.\n\nSince Keystone also does not receive a message when user is reactivated\n(i.e. it was accidentally disabled) we cannot use the same approach as\nfor regular user disabling and generate a token revocation event. This\nwould cause the user to be locked out until the revocation event\nexpires.\n\nCloses-bug: #2122615\nChange-Id: If5b83feabc670ced54ef12fe7826267af7e3419d\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit c63efe1df102bcd6d39361bef45baf4ecdb7f1bd)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/2ee76fa47097262491f32c43653b7363cced3b66"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/2ee76fa47097262491f32c43653b7363cced3b66"}]},"branch":"refs/heads/stable/2025.2"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{}}}]}