)]}'
{"id":"openstack%2Fkeystone~969993","triplet_id":"openstack%2Fkeystone~stable%2F2025.1~If5b83feabc670ced54ef12fe7826267af7e3419d","project":"openstack/keystone","branch":"stable/2025.1","attention_set":{},"removed_from_attention_set":{"7414":{"account":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"last_update":"2025-12-12 17:58:52.000000000","reason":"Change was submitted"},"1004":{"account":{"_account_id":1004,"name":"Mohammed Naser","email":"mnaser@vexxhost.com","username":"mnaser"},"last_update":"2025-12-12 17:58:52.000000000","reason":"Change was submitted"},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2025-12-10 08:21:08.000000000","reason":"\u003cGERRIT_ACCOUNT_27900\u003e replied on the change","reason_account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}}},"hashtags":[],"change_id":"If5b83feabc670ced54ef12fe7826267af7e3419d","subject":"Invalidate token of user disabled in readonly backend","status":"MERGED","created":"2025-12-05 19:05:13.000000000","updated":"2025-12-12 18:00:48.000000000","submitted":"2025-12-12 17:58:52.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"969993","cherry_pick_of_change":969992,"cherry_pick_of_patch_set":1,"meta_rev_id":"00fa31b3c7cdc19cf59a251adf81d8eba3b5dd40","_number":969993,"virtual_id_number":969993,"owner":{"_account_id":1004,"name":"Mohammed Naser","email":"mnaser@vexxhost.com","username":"mnaser"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2025-12-12 17:58:51.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":2,"date":"2025-12-12 15:56:30.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":2,"date":"2025-12-10 08:21:08.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":1,"date":"2025-12-05 21:02:50.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":1,"date":"2025-12-12 15:56:30.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"}],"reviewers":{"REVIEWER":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2025-12-05 19:05:13.000000000","updated_by":{"_account_id":1004,"name":"Mohammed Naser","email":"mnaser@vexxhost.com","username":"mnaser"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"CC"},{"updated":"2025-12-05 20:53:49.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2025-12-05 21:02:43.000000000","updated_by":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"reviewer":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"state":"CC"},{"updated":"2025-12-05 21:02:43.000000000","updated_by":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"REVIEWER"},{"updated":"2025-12-05 21:02:50.000000000","updated_by":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"reviewer":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"state":"REVIEWER"},{"updated":"2025-12-05 21:02:50.000000000","updated_by":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"reviewer":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"state":"REVIEWER"},{"updated":"2025-12-12 15:56:30.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"}],"messages":[{"id":"a2fb1c0088844ca2601c519e280a3b3ea30b53fe","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1004,"name":"Mohammed Naser","email":"mnaser@vexxhost.com","username":"mnaser"},"date":"2025-12-05 19:05:13.000000000","message":"Patch Set 1: Cherry Picked from branch stable/2025.2.","accounts_in_message":[],"_revision_number":1},{"id":"7a14ba2a1680056cde4570d9174b0ee3b4c1c41d","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-12-05 20:53:49.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/683325a0b4314b7a84555b8fc2383ba9\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/cdd9d2fdc8ca4a44b618c616f1b68488 : SUCCESS in 17m 27s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/5e2fe7cd37a246dc807b54631d1db5cb : SUCCESS in 6m 10s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/86ef6bb1048a4b779b5669f30d6c7032 : SUCCESS in 12m 42s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/b7c9c03b2a90481faeefcd524153e1c7 : SUCCESS in 8m 31s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/ce200534b1014776a2d7208aed7a06b7 : SUCCESS in 13m 40s\n- grenade https://zuul.opendev.org/t/openstack/build/b721da7cb8d346d4af4a1f94e94ff174 : SUCCESS in 1h 01m 00s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/4de074067baf4138847fe5240702356c : SUCCESS in 1h 43m 18s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/785b8cb3fd6d4db89262ac295b37e02d : SUCCESS in 13m 10s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/f40f096ef78943838a383d7857be58eb : SUCCESS in 29m 53s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/7535fdfac2eb441b98e66e77fcdd2d68 : FAILURE in 38m 45s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/e9cbcab464604340bd5065c67690b24d : FAILURE in 23m 18s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/f0096bc9cd3843599e6ab86ccad1e668 : SUCCESS in 31m 46s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/82e09caac3484dd68c4821a96f34f1f8 : SUCCESS in 16m 54s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/43a2d44c27be41cf871e0eab54f79a5c : SUCCESS in 37m 55s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/a9c1c3f78f0941b0b98e0143553f9bb2 : SUCCESS in 1h 03m 14s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/a56a4549688040a7837f8cd0e63060cb : SUCCESS in 6m 30s (non-voting)\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/4af48c3df2414d6080cb588bedcdf9cc : SUCCESS in 31m 21s","accounts_in_message":[],"_revision_number":1},{"id":"49f0e165478ae3ccf1dfe88c887ee3adf3305770","author":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"date":"2025-12-05 21:02:50.000000000","message":"Patch Set 1: Code-Review+1","accounts_in_message":[],"_revision_number":1},{"id":"dfb6b300aaba0ce8fad0bbfe986b3e49e1594d72","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2025-12-10 08:21:08.000000000","message":"Patch Set 1: Code-Review+2","accounts_in_message":[],"_revision_number":1},{"id":"04b80b9e4580170c077c3a2b6bfd1e1ebb7b89ce","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2025-12-12 15:56:30.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"93f0e9dae4bb3bbed01d0e88f2728234c8f09de6","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-12-12 15:57:08.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"32efd47ca32d37dec57309ab71a6b48a1c417c86","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-12-12 17:58:51.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/f03326affd5c40cda28c3838aaf02a98\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/af322098316847f186fd8de04efbb039 : SUCCESS in 3m 40s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/e2634e5f4b504ee79000cb324c38507a : SUCCESS in 12m 32s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/c7aa7d680b6c4b50aa707f2bcb639775 : SUCCESS in 12m 30s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/d36a222495c642cfb6dd82e8b9bac35c : SUCCESS in 10m 28s\n- grenade https://zuul.opendev.org/t/openstack/build/874b367bd69f44faa56f1232b939dd4e : SUCCESS in 31m 46s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/68ce80cf0dfe4864a89a0b29114941c8 : SUCCESS in 1h 07m 40s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/9c1f38cca3a343dcad6f44ba200c08e8 : SUCCESS in 12m 24s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/ac684def2da24b609ce1328749d3d103 : SUCCESS in 29m 49s\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/ea07e3d267104628aee4a5b9c85d791f : SUCCESS in 26m 41s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/38945c2efcdf4b2b93d2f06bf94c5296 : SUCCESS in 52m 06s","accounts_in_message":[],"_revision_number":1},{"id":"11681dc6b89e72b78e075e65b8137dd06d792b07","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-12-12 17:58:52.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1},{"id":"00fa31b3c7cdc19cf59a251adf81d8eba3b5dd40","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-12-12 18:00:48.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/e38ea0c225f14931a6fb7a380e44cb22\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/2f0cb8571e0448509df3737786e1e13c : SUCCESS in 52s\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/65be56d96d074f0da6187be9a439eeac : SUCCESS in 46s","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"9036c5c6952cf0fd4a6bfedf4bac850cb7bb8c08","revisions":{"9036c5c6952cf0fd4a6bfedf4bac850cb7bb8c08":{"kind":"REWORK","_number":1,"created":"2025-12-05 19:05:13.000000000","uploader":{"_account_id":1004,"name":"Mohammed Naser","email":"mnaser@vexxhost.com","username":"mnaser"},"ref":"refs/changes/93/969993/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/93/969993/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/93/969993/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/93/969993/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/93/969993/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/93/969993/1"}}},"commit":{"parents":[{"commit":"b633bb8a50db0c86bf9cb39135cdf828b6690f19","subject":"Bytes-vs-str mismatch causes repeated ID mapping creates on list","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/b633bb8a50db0c86bf9cb39135cdf828b6690f19"}]}],"author":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2025-11-10 15:01:18.000000000","tz":60},"committer":{"name":"Mohammed Naser","email":"mnaser@vexxhost.com","date":"2025-12-05 19:05:13.000000000","tz":0},"subject":"Invalidate token of user disabled in readonly backend","message":"Invalidate token of user disabled in readonly backend\n\nWe support custom identity plugins. They (and also LDAP backend) may be\nconsidered as a read-only (not supporting user data modification through\nKeystone API). When a user of such backend is disabled in the remote\nsystem Keystone will never learn about that and as such tokens for those\nusers will remain active. They cannot be renewed, but still they stay\nvalid.\nIn order to address this situation we need to do additional steps in the\ntoken validation and identify the current state of the user in the\nbackend. Due to the use of the token caching it is not possible to reuse\nnormal token validation functionality (it will never gets invalidated as\nsuch). In order to keep performance impact as low as possible modify the\ntoken validation as following:\n- regular checks\n- revocation check\n- if token is still active and revoke check passed fetch current user\n  data. When user is disabled - log a warning (explaining the situation)\n  and raise `UserDisabled` exception.\n\nSince Keystone also does not receive a message when user is reactivated\n(i.e. it was accidentally disabled) we cannot use the same approach as\nfor regular user disabling and generate a token revocation event. This\nwould cause the user to be locked out until the revocation event\nexpires.\n\nCloses-bug: #2122615\nChange-Id: If5b83feabc670ced54ef12fe7826267af7e3419d\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit c63efe1df102bcd6d39361bef45baf4ecdb7f1bd)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/9036c5c6952cf0fd4a6bfedf4bac850cb7bb8c08"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/9036c5c6952cf0fd4a6bfedf4bac850cb7bb8c08"}]},"branch":"refs/heads/stable/2025.1"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{}}}]}