)]}'
{"id":"openstack%2Fkeystone~978054","triplet_id":"openstack%2Fkeystone~master~I6687c3afb8c1613f0901b2fd84b5f41a9594e5aa","project":"openstack/keystone","branch":"master","topic":"fix-978054","attention_set":{},"removed_from_attention_set":{"7414":{"account":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"last_update":"2026-05-13 07:05:56.000000000","reason":"Change was marked work in progress"},"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-05-13 07:05:56.000000000","reason":"Change was marked work in progress"},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-05-13 07:05:56.000000000","reason":"Change was marked work in progress"}},"hashtags":[],"change_id":"I6687c3afb8c1613f0901b2fd84b5f41a9594e5aa","subject":"Clarify that access rules are not enforced on Keystone\u0027s own API","status":"NEW","created":"2026-02-26 09:45:27.000000000","updated":"2026-05-13 07:24:59.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":0,"unresolved_comment_count":0,"work_in_progress":true,"has_review_started":true,"meta_rev_id":"293594d54402e38265295e06654ecf46edde50bc","_number":978054,"virtual_id_number":978054,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"tag":"autogenerated:zuul:check","value":1,"date":"2026-05-13 07:24:59.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"reviewer_updates":[{"updated":"2026-02-26 09:45:54.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"REVIEWER"},{"updated":"2026-02-26 09:45:54.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"state":"REVIEWER"},{"updated":"2026-02-26 10:02:57.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"74da5e5cf79805204fc751b76f84356ce39ca04c","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-02-26 09:45:27.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"32050c5b18f50d0f2c6a4e35c4f06032d537c7b4","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-02-26 10:02:57.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/65f075978500429bbbd3d7835247a6fb\n\n- build-openstack-api-ref https://zuul.opendev.org/t/openstack/build/70a0743352344a5eb620c707b350a68c : SUCCESS in 5m 54s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/eb242712f81c44f8b51161838621ac30 : SUCCESS in 5m 01s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/a815b8c3096b4f618833b687e46c2e1d : FAILURE in 11m 30s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/c265dbc9f63b4db2aac5bc45808fe1ad : SUCCESS in 6m 53s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"d626e6284b066d9f79518473f9fc459fd765b4d1","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-04-13 11:42:31.000000000","message":"Patch Set 1:\n\nrecheck","accounts_in_message":[],"_revision_number":1},{"id":"fba41f27685a2f7976026483750f5ca79a2710bb","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-04-13 11:42:36.000000000","message":"Patch Set 1:\n\nrecheck","accounts_in_message":[],"_revision_number":1},{"id":"bee9564ea7ce124a74310d0a77cd85bd414baab3","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-13 12:34:25.000000000","message":"Patch Set 1:\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/03b9630962d34f749c9909ef7e2cb40a\n\n- build-openstack-api-ref https://zuul.opendev.org/t/openstack/build/1c0e1e273d09432180e7f34047877e4a : SUCCESS in 4m 49s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/37c5317515094bb6a973f5379bbb481c : SUCCESS in 5m 27s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/8e31c06cf4c64a0499f1a9d96cb1908e : FAILURE in 7m 31s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/bf6f420814cb4a6fb0a1f26c77728824 : SUCCESS in 6m 02s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"0851206b930ce4bb6ec588b3dd6c3f464ba80d86","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-13 07:05:56.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"293594d54402e38265295e06654ecf46edde50bc","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-13 07:24:59.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/bf8558784eb34372ab67d33b006c46de\n\n- build-openstack-api-ref https://zuul.opendev.org/t/openstack/build/f0f675d8157a44a885af50d7240d73c8 : SUCCESS in 5m 22s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/e09cf2e20c72473ebd5638a6db89657f : SUCCESS in 5m 00s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/b414c422a8e946d8a984964dd1ccb2e8 : SUCCESS in 13m 44s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/e3128fdf6f994eba8b2427b0260dcb14 : SUCCESS in 11m 47s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/37184e3fa7684b1e9792cbc72fb26432 : SUCCESS in 7m 11s (non-voting)","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"2187a2f6d386cc0dab64c6afdf2d52bddc529bf0","revisions":{"6fd1742e488e3590c74e31301097c48d3ee55f33":{"kind":"REWORK","_number":1,"created":"2026-02-26 09:45:27.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/54/978054/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/54/978054/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/54/978054/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/54/978054/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/54/978054/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/54/978054/1"}}},"commit":{"parents":[{"commit":"8d2df521e4b719e05d3f85c49ab00329249a6393","subject":"Merge \"Fix project policy allowing unauthorized access to root domains\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/8d2df521e4b719e05d3f85c49ab00329249a6393"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-02-26 09:40:15.000000000","tz":60},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-02-26 09:42:35.000000000","tz":60},"subject":"Clarify that access rules are not enforced on Keystone\u0027s own API","message":"Clarify that access rules are not enforced on Keystone\u0027s own API\n\nAccess rules are enforced by keystonemiddleware on downstream services\n(Nova, Cinder, Swift, etc.) and have no effect on Keystone\u0027s own\nidentity API endpoints, which are protected solely by role-based policy.\nThis was not stated in the documentation, which could lead users to\nbelieve that specifying \"service\": \"identity\" in an access rule would\nrestrict access to Keystone\u0027s API.\n\nChange-Id: I6687c3afb8c1613f0901b2fd84b5f41a9594e5aa\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nAssisted-by: Claude Sonnet 4.6 (1M context)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/6fd1742e488e3590c74e31301097c48d3ee55f33"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/6fd1742e488e3590c74e31301097c48d3ee55f33"}]},"branch":"refs/heads/master"},"2187a2f6d386cc0dab64c6afdf2d52bddc529bf0":{"kind":"REWORK","_number":2,"created":"2026-05-13 07:05:56.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/54/978054/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/54/978054/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/54/978054/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/54/978054/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/54/978054/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/54/978054/2"}}},"commit":{"parents":[{"commit":"8d2df521e4b719e05d3f85c49ab00329249a6393","subject":"Merge \"Fix project policy allowing unauthorized access to root domains\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/8d2df521e4b719e05d3f85c49ab00329249a6393"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-02-26 09:40:15.000000000","tz":60},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-13 07:05:36.000000000","tz":120},"subject":"Clarify that access rules are not enforced on Keystone\u0027s own API","message":"Clarify that access rules are not enforced on Keystone\u0027s own API\n\nAccess rules are enforced by keystonemiddleware on downstream services\n(Nova, Cinder, Swift, etc.) and have no effect on Keystone\u0027s own\nidentity API endpoints, which are protected solely by role-based policy.\nThis was not stated in the documentation, which could lead users to\nbelieve that specifying \"service\": \"identity\" in an access rule would\nrestrict access to Keystone\u0027s API.\n\nChange-Id: I6687c3afb8c1613f0901b2fd84b5f41a9594e5aa\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nAssisted-by: Claude Sonnet 4.6 (1M context)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/2187a2f6d386cc0dab64c6afdf2d52bddc529bf0"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/2187a2f6d386cc0dab64c6afdf2d52bddc529bf0"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY"},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}