)]}'
{"id":"openstack%2Fkeystone~983656","triplet_id":"openstack%2Fkeystone~master~I9506557609ff7edaa6a961f356f9b8e19faaefc3","project":"openstack/keystone","branch":"master","attention_set":{},"removed_from_attention_set":{"7414":{"account":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"last_update":"2026-04-22 22:42:38.000000000","reason":"Change was submitted"},"13478":{"account":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"last_update":"2026-04-22 22:42:38.000000000","reason":"Change was submitted"},"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-04-21 09:45:37.000000000","reason":"\u003cGERRIT_ACCOUNT_14250\u003e replied on the change","reason_account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-04-22 22:42:38.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"I9506557609ff7edaa6a961f356f9b8e19faaefc3","subject":"Block app cred tokens from authorizing OAuth1 requests","status":"MERGED","created":"2026-04-07 21:57:03.000000000","updated":"2026-04-23 01:35:23.000000000","submitted":"2026-04-22 22:42:38.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":2,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"983656","meta_rev_id":"9c0dfcc9e056a0a3fdad59b58f3c3f402fb03f6b","_number":983656,"virtual_id_number":983656,"owner":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-04-22 22:42:37.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"all":[{"value":2,"date":"2026-04-22 19:05:06.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":2,"date":"2026-04-22 19:06:46.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":1,"date":"2026-04-22 19:05:06.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":0,"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":1,"date":"2026-04-22 19:06:46.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"reviewers":{"REVIEWER":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"}],"CC":[{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-04-07 22:25:06.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"CC"},{"updated":"2026-04-08 00:06:34.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-04-08 17:06:35.000000000","updated_by":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"reviewer":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"state":"CC"},{"updated":"2026-04-08 17:06:35.000000000","updated_by":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"reviewer":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"state":"CC"},{"updated":"2026-04-08 17:06:35.000000000","updated_by":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"REVIEWER"},{"updated":"2026-04-08 17:06:35.000000000","updated_by":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2026-04-21 11:16:22.000000000","updated_by":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"reviewer":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"state":"REVIEWER"},{"updated":"2026-04-21 15:58:30.000000000","updated_by":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"reviewer":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"state":"REVIEWER"}],"messages":[{"id":"1193abc020b709b2dc4e2d156a1b5cb8737ad79e","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"date":"2026-04-07 21:57:03.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"ec3ded4f8b5dce4adb23c21fa669edc0be21fb72","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-07 22:25:06.000000000","message":"Patch Set 1:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/2f7691e90ccc44dc8de06841e52a4fd5\n\n- openstack-tox-py310-arm64 https://zuul.opendev.org/t/openstack/build/3c162478aeef410eb279b5f72aa37d6a : SUCCESS in 15m 18s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/0f21f2dcd2c54cab95fdbf572a8da4db : SUCCESS in 17m 14s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/49fe6b67ab924f0fa3917a3cc6b8ea34 : SUCCESS in 26m 17s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"bb674937477669bc4a16dd806d4e356c7b0829e1","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-08 00:06:34.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/683eafd9c76c4b3aa5e8ee4d4b0955d0\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/f1fde62adfe44aeaa9d1ebd46bb248c0 : SUCCESS in 18m 07s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/3a0a947b1a464b728c3d0da02a6dacf2 : SUCCESS in 3m 11s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/50b87b3378c847f0b024919596196aa4 : FAILURE in 13m 34s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/acbce9b4558047f6ad5cd9dc84b69469 : SUCCESS in 11m 02s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/f0639ec12e834ed88f04c3efa43f0396 : SUCCESS in 13m 53s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/61a0f0d67dcb4d0291eaeada7acb52b5 : SUCCESS in 14m 04s\n- grenade https://zuul.opendev.org/t/openstack/build/b7cb496eb3f241ceae88570824d1998d : SUCCESS in 1h 06m 10s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/e966427597514c0e88d87729dc270c9f : SUCCESS in 2h 04m 04s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/491011b7aca047f4b67ade856224aad4 : SUCCESS in 18m 21s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/7033129d53d84279924b491a93e3103e : SUCCESS in 30m 26s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/c5d6171f37de49d1afb9c48046e3a46c : FAILURE in 20m 40s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/eb8f9d2ec3714998bdbbe0d306304e39 : FAILURE in 27m 39s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/f3cb9284974a42b0b0eb662c7d262e43 : SUCCESS in 30m 47s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/519799a40acf4abdbc659b61c63473b4 : SUCCESS in 33m 21s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/feb0ff3ba73740b9b8b7cb4dc28cc5d8 : SUCCESS in 38m 09s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/c04300061e1342359bfa1b24bd1951ac : SUCCESS in 1h 02m 20s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/d2f7181bb7d34820803ec2f382fb6552 : FAILURE in 44m 15s (non-voting)\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/cd6194495bdb437cb79f4158638ffcd0 : SUCCESS in 7m 05s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"5a602895cc042d493e4d72d9e2fbf900f44d0709","author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"date":"2026-04-08 07:49:29.000000000","message":"Patch Set 1:\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"e8931003265f5b30706a31a290f43ecc40da98e3","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-08 08:16:32.000000000","message":"Patch Set 1:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/3e43b2d5b1ad43db873c58f5e87630d1\n\n- openstack-tox-py310-arm64 https://zuul.opendev.org/t/openstack/build/46181659a31c4a53bb77d24f429314b3 : SUCCESS in 16m 28s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/8a2c994138774a66ad46db1f06a64405 : SUCCESS in 14m 17s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/722716523cb4412d893b886af1cb9af7 : SUCCESS in 20m 42s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"a86f5b4e080c6ca0ef9f93c10ae31a3361e31692","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-08 10:00:13.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/de7e34cec27a4134be223df8d6e4c32f\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/15b00a4740584ed9954b5fdca3d938d5 : SUCCESS in 20m 59s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/c1e135fa4203413586649e05a180761b : SUCCESS in 5m 22s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/853d57183165488f812a752b1680beeb : SUCCESS in 12m 21s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/8598011bb55a4538bde25387e47e16a4 : SUCCESS in 7m 52s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/4f7a89ec7e124f7fa75daf24617aedf1 : SUCCESS in 14m 33s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/3620fa36d1344939bc3e02c74766ed2c : SUCCESS in 14m 56s\n- grenade https://zuul.opendev.org/t/openstack/build/960bb8a3696e48cfa02950f4a649bcd2 : SUCCESS in 1h 01m 19s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/40fbdc93107545ec93539bc10cdaf66f : SUCCESS in 2h 04m 56s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/be4394bc8f074c088077f704e7d34005 : SUCCESS in 17m 16s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/e69ab87958d44ee8a424ad1a90ad691f : SUCCESS in 32m 16s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/68c35064ce2d47189fe8d5ee31e322af : FAILURE in 20m 17s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/497d7d2e8fe54781972052d64076517c : FAILURE in 27m 39s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/e9ddff6b289843cca4f2576a128dc144 : SUCCESS in 32m 32s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/c9e1efeaa70544b3af16787ea073b379 : SUCCESS in 36m 43s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/7bab03f80753497eba99832172d5a112 : SUCCESS in 40m 59s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/2dcb09c6be8640788f8d18bd95aa1a7c : SUCCESS in 1h 14m 13s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/c19492a68ebb463db95614ffd25324de : FAILURE in 44m 51s (non-voting)\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/b56476c9397249feab2890ec0e8fc62a : SUCCESS in 6m 53s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"d87d27a034eac13f7a9b785c8ab028008094873e","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-04-21 09:45:37.000000000","message":"Patch Set 1: Code-Review+2","accounts_in_message":[],"_revision_number":1},{"id":"9c47eb9b64efebb18cf2ecb04fd88e3afeaac04b","author":{"_account_id":28619,"name":"Dmitriy Rabotyagov","email":"noonedeadpunk@gmail.com","username":"noonedeadpunk"},"date":"2026-04-21 11:16:22.000000000","message":"Patch Set 1: Code-Review+1\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"57c0a865fbc67f8715ba81483011f7ba1790d3d9","author":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"date":"2026-04-21 15:58:30.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"07c78ea3a2a10ddc9f6ef76a20f46e643f56bcb1","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-22 17:25:23.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"d777590ec3cdcbebc32efcb2e9e777229d757689","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-04-22 19:05:06.000000000","message":"Uploaded patch set 2: Patch Set 1 was rebased.\n\nCopied Votes:\n* Code-Review+1, Code-Review+2 (copy condition: \"**changekind:TRIVIAL_REBASE** OR is:MIN\")\n\nOutdated Votes:\n* Workflow+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"d2bdb752c694fb2cd2e99f56be92fe2eaf2a224f","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-04-22 19:06:46.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":2},{"id":"e84c32c66739daad3c5150a68bba3ca4904c08ed","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-22 20:49:15.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/5c741299eaca49329e918274a59a0785\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/dbd096a13c9746e9b576d7257b244caa : SUCCESS in 15m 41s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/41e04287872245c8a0f6850597296b27 : SUCCESS in 6m 57s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/4e5a248ae76e4f02b73ba8a38f8b20b7 : SUCCESS in 12m 21s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/beac9655d6ef45848e657f28641ef595 : SUCCESS in 11m 08s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/8194497aea5147b3879738481557dcc0 : SUCCESS in 15m 16s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/0cc2894dc515432e86f6d6333a2eb481 : SUCCESS in 14m 19s\n- grenade https://zuul.opendev.org/t/openstack/build/f335731e0a3f40c1a5b4b658396470bf : SUCCESS in 57m 23s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/81ea11e955924f5e9ac82a17a99b7198 : SUCCESS in 1h 39m 50s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/4f7d03a884ea42d4b55e27f8b74493db : SUCCESS in 17m 00s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/4c65fc5d2514474398cef40a83ea20b8 : SUCCESS in 25m 18s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/a18716fb43fa40ad988a8fc5b1b6ddcf : FAILURE in 11m 42s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/aa3e2b69f4d0425bb56e271c4667aed2 : FAILURE in 18m 35s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/c9f675d6073f4fb8b31f5998a673783f : SUCCESS in 29m 06s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/a6a74c4d0e884b028a75af8f677e38f0 : SUCCESS in 32m 13s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/3bb371680ffb4aeabde8c85dd04ca299 : SUCCESS in 31m 30s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/2ab15d3444634f15b3e357d4d9f1dfe3 : SUCCESS in 1h 08m 35s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/3ab784f0422d4b2ab86fd0304c3c5f3d : FAILURE in 33m 55s (non-voting)\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/6661657dc1eb43f8b4388e4fdc3581e5 : SUCCESS in 7m 05s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"f4ab9ee43195099f19f56f698b8997eae896516c","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-22 20:50:09.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"d3d2013f18fe6df17bb236ad8b70ddfef0265ba6","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-22 22:42:37.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/f530d5158e6346f4bb65845faee3ddf2\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/4e36b8d3f7654b84b92bd88bb5bff9a7 : SUCCESS in 6m 15s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/72bb0b1dd73d44dfb88f8698e94a5353 : SUCCESS in 12m 49s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/9bd74839cdc64670af6cbeb2a7ff2260 : SUCCESS in 13m 11s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/57d0715df8504da3bb8042d1384d6090 : SUCCESS in 15m 19s\n- grenade https://zuul.opendev.org/t/openstack/build/10081abd72154f55b6a77e01ad1a900e : SUCCESS in 1h 04m 18s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/711164579a2647dab6ebca0de3093cd5 : SUCCESS in 1h 46m 23s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/495cc638f48c460589697867f7d7a054 : SUCCESS in 33m 45s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/4992b5fb453a499785d6398e59541537 : SUCCESS in 33m 37s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/9113d1a9e9d34f9f9ecf4abced798e48 : SUCCESS in 59m 47s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/3f368748c5924a46a29baf06a5365439 : FAILURE in 46m 45s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"bf480a9360640b90ff9204b44abe0c0a3d30f42e","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-22 22:42:38.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2},{"id":"2674289c54249c8e8af95d2d39e38ee748b9049c","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-22 22:44:53.000000000","message":"Patch Set 2:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/342e0d6ac13d487291b2cbccd19ae2f8\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/d154187744e44bf4863e6410b4c5590d : SUCCESS in 1m 08s","accounts_in_message":[],"_revision_number":2},{"id":"9c0dfcc9e056a0a3fdad59b58f3c3f402fb03f6b","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-23 01:35:23.000000000","message":"Patch Set 2:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/f18e5f7ff45a422cabb13369b615853c\n\n- openstack-tox-py310-arm64 https://zuul.opendev.org/t/openstack/build/b3b33f4621f047b2bc076490accbe771 : SUCCESS in 22m 12s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/70ac6aa34c454dbf854bd12017d21a7a : SUCCESS in 17m 14s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/64ae2bd9b8a14ef4b2e2d61fbe8afe48 : SUCCESS in 24m 24s (non-voting)","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"29246c5fd8d1dafbe6cc8cec4c57faf5590cd44e","revisions":{"229a87e804fc18f81fc54c083be2545cef78413c":{"kind":"REWORK","_number":1,"created":"2026-04-07 21:57:03.000000000","uploader":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"ref":"refs/changes/56/983656/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/56/983656/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/56/983656/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/56/983656/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/56/983656/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/56/983656/1"}}},"commit":{"parents":[{"commit":"f47aaa57e7250b3985d0a1cf2f745f9f476ab23a","subject":"Block restricted app creds from creating EC2 credentials via /credentials","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/f47aaa57e7250b3985d0a1cf2f745f9f476ab23a"}]}],"author":{"name":"Boris Bobrov","email":"b.bobrov@sap.com","date":"2026-04-07 21:55:23.000000000","tz":120},"committer":{"name":"Boris Bobrov","email":"b.bobrov@sap.com","date":"2026-04-07 21:55:23.000000000","tz":120},"subject":"Block app cred tokens from authorizing OAuth1 requests","message":"Block app cred tokens from authorizing OAuth1 requests\n\nThe OAuth1 authorize endpoint checked is_delegated_auth to block\ntrust-scoped and OAuth-scoped tokens from authorizing request\ntokens, but application credential tokens were not covered by\nthis check. A restricted application credential could authorize\na request token with any role the user actually holds, producing\nan access token that yields an unrestricted Keystone token with\nroles beyond the application credential\u0027s restricted set.\n\nAdd an explicit check for application credential tokens on the\nOAuth1 authorize endpoint, consistent with how trust-scoped and\nOAuth-scoped tokens are already blocked.\n\nRelated-Bug: #2142138\nGenerated-By: claude-opus-4-6 (OpenCode)\nSigned-off-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nChange-Id: I9506557609ff7edaa6a961f356f9b8e19faaefc3\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/229a87e804fc18f81fc54c083be2545cef78413c"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/229a87e804fc18f81fc54c083be2545cef78413c"}]},"branch":"refs/heads/master"},"29246c5fd8d1dafbe6cc8cec4c57faf5590cd44e":{"kind":"TRIVIAL_REBASE","_number":2,"created":"2026-04-22 19:05:06.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/56/983656/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/56/983656/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/56/983656/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/56/983656/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/56/983656/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/56/983656/2"}}},"commit":{"parents":[{"commit":"d6a3dc511057d6ac25bd2d75776a4233c5608684","subject":"Block restricted app creds from creating EC2 credentials via /credentials","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/d6a3dc511057d6ac25bd2d75776a4233c5608684"}]}],"author":{"name":"Boris Bobrov","email":"b.bobrov@sap.com","date":"2026-04-07 21:55:23.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-04-22 19:04:35.000000000","tz":120},"subject":"Block app cred tokens from authorizing OAuth1 requests","message":"Block app cred tokens from authorizing OAuth1 requests\n\nThe OAuth1 authorize endpoint checked is_delegated_auth to block\ntrust-scoped and OAuth-scoped tokens from authorizing request\ntokens, but application credential tokens were not covered by\nthis check. A restricted application credential could authorize\na request token with any role the user actually holds, producing\nan access token that yields an unrestricted Keystone token with\nroles beyond the application credential\u0027s restricted set.\n\nAdd an explicit check for application credential tokens on the\nOAuth1 authorize endpoint, consistent with how trust-scoped and\nOAuth-scoped tokens are already blocked.\n\nRelated-Bug: #2142138\nGenerated-By: claude-opus-4-6 (OpenCode)\nSigned-off-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nChange-Id: I9506557609ff7edaa6a961f356f9b8e19faaefc3\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/29246c5fd8d1dafbe6cc8cec4c57faf5590cd44e"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/29246c5fd8d1dafbe6cc8cec4c57faf5590cd44e"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}