)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"f7e030ae045bcab96230c983c279ea4490419faf","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"46107cad_18c8edf4","updated":"2026-03-19 16:38:12.000000000","message":"One can already get a system-scoped token as a federated user: https://review.opendev.org/c/openstack/keystone/+/981321/1/keystone/tests/unit/test_v3_federation.py","commit_id":"b901951ee9bbf2cca12a068c8874d670d79b4142"},{"author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"change_message_id":"5665c475fafa6376615afa0ab9b299e23d4c798e","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":2,"id":"4b560223_2098b1c9","updated":"2026-10-16 22:03:11.000000000","message":"What\u0027s the process to revisit this? I\u0027ve asked at some of the keystone meetings.","commit_id":"b901951ee9bbf2cca12a068c8874d670d79b4142"},{"author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"change_message_id":"5f72b4990ecbf14ea8f061b86e1c3738136e690d","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":2,"id":"99464026_b2e5144a","updated":"2026-10-21 15:43:56.000000000","message":"https://paste.opendev.org/show/bplFf1eyoRF5FfYTt5tH/ here\u0027s the backtrace","commit_id":"b901951ee9bbf2cca12a068c8874d670d79b4142"},{"author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"change_message_id":"494dafb5424e306e9a469d015c9e2fd1b9f23cad","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"6bb824f6_94e8f855","updated":"2026-03-19 12:59:25.000000000","message":"this is a very controversial proposal. We need to go through a careful evaluation with a spec and eventually a dedicated PTG discussion. I am strongly concerned about granting any admin capabilities through the federated login. I know for the project it is already there and I can\u0027t do anything about it, but I am not in favor of granting system scope over federation.","commit_id":"b901951ee9bbf2cca12a068c8874d670d79b4142"},{"author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"change_message_id":"4593bc6201d03a8f9148d2859dd3df7a1aa01f12","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"56ddfbfc_cf66e33d","in_reply_to":"46107cad_18c8edf4","updated":"2026-03-19 17:32:47.000000000","message":"https://review.opendev.org/c/openstack/keystone/+/981321 - better link","commit_id":"b901951ee9bbf2cca12a068c8874d670d79b4142"},{"author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"change_message_id":"fe3900770ab5cb22c3f807ea471e8dd747126b82","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":2,"id":"e118cce7_61dcb941","in_reply_to":"4b560223_2098b1c9","updated":"2026-10-16 22:24:36.000000000","message":"The process is like I said you multiple times: once there are full logs for the transaction causing the reported bug we will reconsider. Without providing requested information the discussion makes no sense and is absolutely not helpful to the health of the project.","commit_id":"b901951ee9bbf2cca12a068c8874d670d79b4142"},{"author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"change_message_id":"111fc403140e00fe72a38e6069e515e06cfcbfa1","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":2,"id":"d69abae8_1360eb37","in_reply_to":"6bb824f6_94e8f855","updated":"2026-08-18 17:08:41.000000000","message":"I absolutely want to grant system scope over federation. A system scope user would be one of my cloud admins. They would have admin access to the Ironic API. I would also want them to have access to make system level changes to neutron like the VLAN allocation ranges which today is gated by a simple project scoped role\u003dadmin in ANY project which is not ideal because a project level admin is definitely not a system level admin. I don\u0027t want credentials stored in keystone and I want to use our company\u0027s SSO and tie all operations back to an individual.","commit_id":"b901951ee9bbf2cca12a068c8874d670d79b4142"},{"author":{"_account_id":5890,"name":"Doug Goldstein","email":"cardoe@cardoe.com","username":"cardoe"},"change_message_id":"9bb8eac0f7ea2457b1f5ed54834fc9402d9d6c7d","unresolved":true,"context_lines":[],"source_content_type":"","patch_set":2,"id":"759ef640_330d47ad","in_reply_to":"d69abae8_1360eb37","updated":"2026-08-27 01:15:26.000000000","message":"Can we re-visit this? Since it\u0027s already possible to get a system-scoped token as a federated user there\u0027s no proposal that should need to be made. skyline is already attempting to do this as well which is leading to the crash.","commit_id":"b901951ee9bbf2cca12a068c8874d670d79b4142"}]}