)]}'
{"id":"openstack%2Fkeystone~969994","triplet_id":"openstack%2Fkeystone~stable%2F2024.2~If5b83feabc670ced54ef12fe7826267af7e3419d","project":"openstack/keystone","branch":"stable/2024.2","attention_set":{},"removed_from_attention_set":{"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2025-12-12 17:59:07.000000000","reason":"Change was submitted"},"1004":{"account":{"_account_id":1004,"name":"Mohammed Naser","email":"mnaser@vexxhost.com","username":"mnaser"},"last_update":"2025-12-12 17:59:07.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"If5b83feabc670ced54ef12fe7826267af7e3419d","subject":"Invalidate token of user disabled in readonly backend","status":"MERGED","created":"2025-12-05 19:05:36.000000000","updated":"2025-12-12 18:00:41.000000000","submitted":"2025-12-12 17:59:07.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"969994","cherry_pick_of_change":969993,"cherry_pick_of_patch_set":1,"meta_rev_id":"d9e4c0c4293bcc4fdfb5a7c0332f413fbdbf91f0","_number":969994,"virtual_id_number":969994,"owner":{"_account_id":1004,"name":"Mohammed Naser","email":"mnaser@vexxhost.com","username":"mnaser"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2025-12-12 17:59:06.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":2,"date":"2025-12-12 15:57:44.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":2,"date":"2025-12-12 15:35:09.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":1,"date":"2025-12-12 15:57:44.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2025-12-05 19:05:36.000000000","updated_by":{"_account_id":1004,"name":"Mohammed Naser","email":"mnaser@vexxhost.com","username":"mnaser"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"CC"},{"updated":"2025-12-05 20:54:24.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2025-12-10 08:20:40.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"REVIEWER"},{"updated":"2025-12-12 15:57:44.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"}],"messages":[{"id":"62009b65ecdc102adb69bdad34cc8b01b017ab3e","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":1004,"name":"Mohammed Naser","email":"mnaser@vexxhost.com","username":"mnaser"},"date":"2025-12-05 19:05:36.000000000","message":"Patch Set 1: Cherry Picked from branch stable/2025.1.","accounts_in_message":[],"_revision_number":1},{"id":"08fe1ec5f3f87b2db85e70bae963c377e9ef9698","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-12-05 20:54:24.000000000","message":"Patch Set 1: Verified-1\n\n(4 comments)\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/eb24c773cc09469887a00f4d9c2bf935\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/7bebcd34a3bb4a07906cc0a09a52796e : SUCCESS in 15m 00s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/b791cf7e170d44378d7eca1a4e318de2 : FAILURE in 6m 20s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/e495720c6cf74006abf060af70495458 : SUCCESS in 13m 09s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/6c7797758f3f41f287b2493d8aee6e30 : SUCCESS in 10m 39s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/6a689df76eaf454a916f5ce87a878fb2 : SUCCESS in 12m 10s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/691a3f7b74ea489f994ab23dde8c7e23 : SUCCESS in 11m 09s\n- grenade https://zuul.opendev.org/t/openstack/build/ff4684b99dd34aa6b29eb250db749563 : SUCCESS in 58m 35s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/253a802da47f40f085c1e94859d1c6d8 : SUCCESS in 1h 38m 47s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/6cee84a4494d47729f9e13fc723a9e8d : SUCCESS in 12m 44s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/b22c920eda5b4bb1a2cc8e92d78a7add : SUCCESS in 24m 50s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/ee66622ac269419c92cd9456afc1edb1 : FAILURE in 36m 48s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/7c81626c79af43f8908d778bfcf06b12 : FAILURE in 27m 14s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/20ce19ac00f04096bda52f7b35f9c82f : SUCCESS in 22m 31s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/720ab1abb48f49e38278c687c7150a6a : SUCCESS in 14m 26s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/bf0a3e2361db47548d6f3db68752e726 : FAILURE in 20m 12s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/d916dea57457453bac69bdac3120573d : SUCCESS in 56m 22s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/1cd451e6f27a4cdb8c84fb8c0d3b5f5e : FAILURE in 5m 46s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"e9a2dc707923fdb05a29c38ec380f8d5fc71cd8d","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2025-12-10 08:20:40.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Verified-1\n","accounts_in_message":[],"_revision_number":2},{"id":"5948f7e89e861bdabf52f7b926f2c7ab35024ce8","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-12-10 10:07:02.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/eead1fca10634f66a80f6f358394a05b\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/08a4b67f7fe84b378ffb1eafb3a60d83 : SUCCESS in 13m 29s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/a953d7cfaf124cd7b60a7b8036a100e8 : SUCCESS in 3m 05s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/811605a71f574913bbababb0f63b67d5 : SUCCESS in 7m 01s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/f70c3772b8fa4fe3ae6c203176db0016 : SUCCESS in 9m 26s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/61731663ae1f4d68a07399a92b68c320 : SUCCESS in 11m 20s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/7325c0a9353b450fb919253f065021fd : SUCCESS in 6m 39s\n- grenade https://zuul.opendev.org/t/openstack/build/a114a0eb20c64c93ab4c1890ad0e5971 : SUCCESS in 27m 37s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/439a6d8fbf8d4fc28c832c0e582214db : SUCCESS in 1h 40m 52s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/e56863ca00384445aeda452831eb676a : SUCCESS in 7m 57s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/71a8ed3b975641e79d98cfc297f3f467 : SUCCESS in 17m 17s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/64a871b08b384c72a5e7b1a9c6b16447 : FAILURE in 18m 13s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/b9eb63ec72ea4a6788b8584571bb6951 : FAILURE in 23m 41s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/7490736267ae4122b6e23a1d725b4946 : SUCCESS in 20m 00s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/bbcb7404707246f09417ed78b838abd4 : SUCCESS in 15m 19s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/d11e31ef1ffe4da681b317a860bc31c9 : FAILURE in 18m 37s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/07541a04fe40472caaf1caf89ab69567 : SUCCESS in 57m 59s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/e0e5ea5af8d544d0a9eb04459e54ce9d : FAILURE in 5m 56s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"beebcc21febbbb84d837e23f16f1e0bd2664a1a3","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2025-12-12 15:35:09.000000000","message":"Patch Set 2: Code-Review+2","accounts_in_message":[],"_revision_number":2},{"id":"f6c5b118cacab8e9552fd88e480a1f165bafe1bd","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2025-12-12 15:57:44.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":2},{"id":"fd6123079ad9e29ad61075d4c02cb7494fb9af15","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-12-12 15:58:38.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"d0a85477714973a09f0e92c6ad8a8d4369a90f76","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-12-12 17:59:06.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/d3aae8274b404230aea86a60200955c0\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/b2b22debb90d49288f5bf3a791c683c3 : SUCCESS in 5m 43s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/90146b21f1b140269b7259e9264269bd : SUCCESS in 8m 01s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/80ce882ab8d8408db52589d549d54f63 : SUCCESS in 13m 06s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/8219589519734089a7d2d810bbdaa0f9 : SUCCESS in 12m 08s\n- grenade https://zuul.opendev.org/t/openstack/build/c3103320ffc2407397a105a5a60c0009 : SUCCESS in 30m 41s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/339d51870b24482db8b30e7dd683a225 : SUCCESS in 1h 41m 00s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/123cb274f395411aa63f5ef36284165e : SUCCESS in 13m 15s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/69f7375ce90f4e1788bbeedbf911e4a2 : SUCCESS in 13m 31s\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/5170f817f95747fc88d4e6423054741b : SUCCESS in 13m 31s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/b60c52dc48234e009feb3447876df5c2 : SUCCESS in 39m 59s","accounts_in_message":[],"_revision_number":2},{"id":"d0fe94c3704d8236cb22d827d0eecb7fab1ff6b4","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-12-12 17:59:07.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2},{"id":"d9e4c0c4293bcc4fdfb5a7c0332f413fbdbf91f0","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2025-12-12 18:00:41.000000000","message":"Patch Set 2:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/b68b25832b0b470ca91163d58e92ee23\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/67da82fb268048609fe2e4a3e0a5bcdf : SUCCESS in 1m 24s\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/f935cd2eb0174dbeb06be77d3405dd76 : SUCCESS in 54s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"489e170f8161dac7c8388a9bd5864078a1338cc9","revisions":{"0c4ad461724ded8a7ed96dd9f7de89be83bba0fc":{"kind":"REWORK","_number":1,"created":"2025-12-05 19:05:36.000000000","uploader":{"_account_id":1004,"name":"Mohammed Naser","email":"mnaser@vexxhost.com","username":"mnaser"},"ref":"refs/changes/94/969994/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/94/969994/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/94/969994/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/94/969994/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/94/969994/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/94/969994/1"}}},"commit":{"parents":[{"commit":"f73299cd71633b6f462ad4f59c038b6ac9e62695","subject":"Merge \"Fix DB migrations after alembic integration\" into stable/2024.2","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/f73299cd71633b6f462ad4f59c038b6ac9e62695"}]}],"author":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2025-11-10 15:01:18.000000000","tz":60},"committer":{"name":"Mohammed Naser","email":"mnaser@vexxhost.com","date":"2025-12-05 19:05:36.000000000","tz":0},"subject":"Invalidate token of user disabled in readonly backend","message":"Invalidate token of user disabled in readonly backend\n\nWe support custom identity plugins. They (and also LDAP backend) may be\nconsidered as a read-only (not supporting user data modification through\nKeystone API). When a user of such backend is disabled in the remote\nsystem Keystone will never learn about that and as such tokens for those\nusers will remain active. They cannot be renewed, but still they stay\nvalid.\nIn order to address this situation we need to do additional steps in the\ntoken validation and identify the current state of the user in the\nbackend. Due to the use of the token caching it is not possible to reuse\nnormal token validation functionality (it will never gets invalidated as\nsuch). In order to keep performance impact as low as possible modify the\ntoken validation as following:\n- regular checks\n- revocation check\n- if token is still active and revoke check passed fetch current user\n  data. When user is disabled - log a warning (explaining the situation)\n  and raise `UserDisabled` exception.\n\nSince Keystone also does not receive a message when user is reactivated\n(i.e. it was accidentally disabled) we cannot use the same approach as\nfor regular user disabling and generate a token revocation event. This\nwould cause the user to be locked out until the revocation event\nexpires.\n\nCloses-bug: #2122615\nChange-Id: If5b83feabc670ced54ef12fe7826267af7e3419d\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit c63efe1df102bcd6d39361bef45baf4ecdb7f1bd)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/0c4ad461724ded8a7ed96dd9f7de89be83bba0fc"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/0c4ad461724ded8a7ed96dd9f7de89be83bba0fc"}]},"branch":"refs/heads/stable/2024.2"},"489e170f8161dac7c8388a9bd5864078a1338cc9":{"kind":"REWORK","_number":2,"created":"2025-12-10 08:20:40.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/94/969994/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/94/969994/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/94/969994/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/94/969994/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/94/969994/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/94/969994/2"}}},"commit":{"parents":[{"commit":"f73299cd71633b6f462ad4f59c038b6ac9e62695","subject":"Merge \"Fix DB migrations after alembic integration\" into stable/2024.2","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/f73299cd71633b6f462ad4f59c038b6ac9e62695"}]}],"author":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2025-11-10 15:01:18.000000000","tz":60},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2025-12-10 08:20:28.000000000","tz":60},"subject":"Invalidate token of user disabled in readonly backend","message":"Invalidate token of user disabled in readonly backend\n\nWe support custom identity plugins. They (and also LDAP backend) may be\nconsidered as a read-only (not supporting user data modification through\nKeystone API). When a user of such backend is disabled in the remote\nsystem Keystone will never learn about that and as such tokens for those\nusers will remain active. They cannot be renewed, but still they stay\nvalid.\nIn order to address this situation we need to do additional steps in the\ntoken validation and identify the current state of the user in the\nbackend. Due to the use of the token caching it is not possible to reuse\nnormal token validation functionality (it will never gets invalidated as\nsuch). In order to keep performance impact as low as possible modify the\ntoken validation as following:\n- regular checks\n- revocation check\n- if token is still active and revoke check passed fetch current user\n  data. When user is disabled - log a warning (explaining the situation)\n  and raise `UserDisabled` exception.\n\nSince Keystone also does not receive a message when user is reactivated\n(i.e. it was accidentally disabled) we cannot use the same approach as\nfor regular user disabling and generate a token revocation event. This\nwould cause the user to be locked out until the revocation event\nexpires.\n\nCloses-bug: #2122615\nChange-Id: If5b83feabc670ced54ef12fe7826267af7e3419d\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit c63efe1df102bcd6d39361bef45baf4ecdb7f1bd)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/489e170f8161dac7c8388a9bd5864078a1338cc9"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/489e170f8161dac7c8388a9bd5864078a1338cc9"}]},"branch":"refs/heads/stable/2024.2"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{}}}]}