)]}'
{"id":"openstack%2Fkeystone~985969","triplet_id":"openstack%2Fkeystone~master~I3d72b789552522ff34b5291143c49fea6f154343","project":"openstack/keystone","branch":"master","attention_set":{"36012":{"account":{"_account_id":36012,"name":"Benjamin Lasseye","display_name":"Benjamin Lasseye","email":"blasseye@ikmail.com","username":"blasseye"},"last_update":"2026-08-03 10:09:56.000000000","reason":"A robot voted negatively on a label"}},"removed_from_attention_set":{},"hashtags":[],"change_id":"I3d72b789552522ff34b5291143c49fea6f154343","subject":"Fix: TOTP authentication lockout risk in Keystone","status":"NEW","created":"2026-04-23 14:49:48.000000000","updated":"2026-08-03 16:13:44.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"e4424e054da3d66fcb7a279005a7ec7f11627668","_number":985969,"virtual_id_number":985969,"owner":{"_account_id":36012,"name":"Benjamin Lasseye","display_name":"Benjamin Lasseye","email":"blasseye@ikmail.com","username":"blasseye"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:check","value":1,"date":"2026-08-03 15:42:52.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-04-23 15:49:54.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"691c7a3bad059e9252dd3a60f5aad39fd0b96678","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":36012,"name":"Benjamin Lasseye","display_name":"Benjamin Lasseye","email":"blasseye@ikmail.com","username":"blasseye"},"date":"2026-04-23 14:49:48.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"ba30777b100c54294594c137b76295abf8a549f1","tag":"autogenerated:gerrit:setWorkInProgress","author":{"_account_id":36012,"name":"Benjamin Lasseye","display_name":"Benjamin Lasseye","email":"blasseye@ikmail.com","username":"blasseye"},"date":"2026-04-23 14:50:23.000000000","message":"Set Work In Progress","accounts_in_message":[],"_revision_number":1},{"id":"1169c519bac1e207ad5962f44ca8262f9b902242","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-23 15:49:54.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/c731d83fd9814f1e91f023ba0738f01f\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/bce6a58710b141ad8b8a00a8f8b3f966 : FAILURE in 11m 52s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/fb3cdf532bc24170a6e655f1c9c303ac : FAILURE in 3m 17s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/70ee02ce789048278acdb042c86a1165 : FAILURE in 9m 00s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/3465a0e2d47b460780740fbc56810546 : FAILURE in 7m 46s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/fce8b776fc0246208b0b41d5e92e23c9 : FAILURE in 13m 59s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/d4dadb2f1c0d4de6bf4cadbaa78aa553 : SUCCESS in 7m 21s\n- grenade https://zuul.opendev.org/t/openstack/build/8b8c167a0775459481c8d65149bab156 : SUCCESS in 31m 37s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/a0f75a01c5b84a31b2dddf66351f9d48 : SUCCESS in 57m 30s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/85eb2f9416d441cfa9ee829ee77ebd1c : SUCCESS in 9m 51s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/760c9943595c4819961ed67ad7556fb7 : SUCCESS in 14m 59s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/9a934f9b24ae4df78eb421c0d961858f : FAILURE in 9m 06s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/9a3d83fa76ac47cba6af7d2489f87ad2 : FAILURE in 25m 38s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/40979519b49c4563a0c1a847a8767074 : SUCCESS in 29m 42s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/088731ff07114ac39dcca96a2660bfdc : SUCCESS in 18m 56s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/b524594cb79149f1b32b4b177cd81379 : SUCCESS in 36m 27s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/f904aaa014ea44d58f75cb7ee990bc79 : SUCCESS in 30m 54s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/950ad982cea441588ee5819e95062654 : FAILURE in 20m 20s (non-voting)\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/3612ee107e6f4ac1a40f480abe90300c : SUCCESS in 3m 33s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"579bc4b9caef3a033a06a386463d775f1c9309ef","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-23 15:52:08.000000000","message":"Patch Set 1:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/774d1e978f82465e8f932b2787ce5397\n\n- openstack-tox-py310-arm64 https://zuul.opendev.org/t/openstack/build/7e2e50708ba84cdf8c4f52e182392a58 : FAILURE in 17m 50s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/a8f4fae551314d0ea9896f498786c964 : FAILURE in 15m 51s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/349965bee0a44f6eba821b157d2fefc5 : FAILURE in 20m 32s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"a35b9a8d0772ce0823f30d97d865456fd86b793d","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":36012,"name":"Benjamin Lasseye","display_name":"Benjamin Lasseye","email":"blasseye@ikmail.com","username":"blasseye"},"date":"2026-04-24 06:43:36.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"16b5825969adfe409f42f70e30141bb416b86094","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-24 07:30:30.000000000","message":"Patch Set 2:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/59de797cb07f4846b847c15e47c09510\n\n- openstack-tox-py310-arm64 https://zuul.opendev.org/t/openstack/build/45db6467555f4987ae732339afd5754d : FAILURE in 22m 22s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/84294f1849da4441b9eed89b6bcd66cc : FAILURE in 20m 26s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/d60800318f07450cb17e99d0382a3c22 : FAILURE in 25m 53s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"509618bbfb82f9065d993cf8f6594652a5a1344d","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-24 08:27:09.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/033ea17c3361472b82d54eccd75d603c\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/988cf14b533a4d9e940fae7c504dcb04 : FAILURE in 18m 05s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/89a26932a98b4a808a443de2c2311353 : SUCCESS in 6m 37s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/7ee2fc4e14274bd1a65a5f8dbe0612f1 : FAILURE in 11m 01s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/dd145fe2c9884120944b48acee944ea6 : FAILURE in 6m 30s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/d951f4e843af45b9aee76dba6a8a31b9 : FAILURE in 15m 17s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/ae93a04867c046eabb160151ee1daccc : SUCCESS in 13m 52s\n- grenade https://zuul.opendev.org/t/openstack/build/ef395c939b4440af88728f4332154684 : SUCCESS in 52m 58s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/def837bbaeb14a88ad4a0a3a5f08416f : SUCCESS in 1h 41m 22s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/e8fb30593ace43a2a11c6041246be4d7 : SUCCESS in 11m 59s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/195e2412d6dd476d85f707a2fb32b1aa : SUCCESS in 9m 36s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/897e7e28706e411c9d3a2d0d2f6cb7ad : SUCCESS in 15m 10s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/74571b18a85b4f99b311215b5663e544 : FAILURE in 15m 48s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/87f153eeee6c48b685e94216926e7143 : FAILURE in 19m 49s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/b6a71d8eb8e147e38f88fef080e9307e : SUCCESS in 30m 00s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/38f14609165b4c32991b9d8a5cd32efd : SUCCESS in 15m 55s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/50c8167d0bd74aa9a46d0ef97345e318 : SUCCESS in 32m 41s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/22e950eaf9d543cf9a40bff965857b52 : SUCCESS in 34m 31s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/0eca035f62af4027be6f89b9a26ce541 : FAILURE in 21m 00s (non-voting)\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/d989f902d88740128f1dfc2d06d22f61 : SUCCESS in 4m 13s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"6e3752bbb11a0751bc655b5cb7df5ce5ed05a84b","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":36012,"name":"Benjamin Lasseye","display_name":"Benjamin Lasseye","email":"blasseye@ikmail.com","username":"blasseye"},"date":"2026-04-24 12:02:51.000000000","message":"Uploaded patch set 3.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":3},{"id":"2dcba020ac72216f97ce40a0b6c701ef2c1c803c","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-24 14:03:25.000000000","message":"Patch Set 3: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/9212c4874b0f48259550091d41f1db17\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/32bc1663902b481484cb8a0b376ffbd9 : FAILURE in 16m 58s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/4626ffc3fec842ed966997e170198ec7 : SUCCESS in 5m 12s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/218fb9b0d5b64e148f2affac65b26897 : FAILURE in 10m 57s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/1077e498f50649a281788c3f4da903d7 : FAILURE in 11m 22s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/8c983eb78f3147768ea66d48b22ebef4 : FAILURE in 15m 29s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/2dddca84fdf7458cbf140b63c5bf1e72 : SUCCESS in 14m 03s\n- grenade https://zuul.opendev.org/t/openstack/build/46cc922027d04bfab8f841a908156677 : SUCCESS in 1h 14m 31s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/7de8d9abac4d4558bfbe0019b06b13e1 : SUCCESS in 1h 56m 01s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/a5e63897134e4f7dbded8c89cb476293 : SUCCESS in 12m 03s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/1ad201dc496e4531adb6ad60f61c78b2 : SUCCESS in 20m 18s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/3fda4212f33c4c82a36cb985f23153cd : SUCCESS in 33m 00s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/83223c9f794e4ce59122394134533910 : FAILURE in 21m 45s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/1b647ca3c1fa42e0928db8b424b80027 : FAILURE in 26m 21s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/17fcec44b15c415991703c8a4c5cf270 : SUCCESS in 33m 28s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/72d9e7d53b9940828ac084b5b8d45cd4 : SUCCESS in 33m 31s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/1cd20476ac914a43803a9312217208e0 : SUCCESS in 36m 36s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/1a45546c92dd4fac8348a8cef9142d5c : SUCCESS in 51m 11s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/66e93792e89e46a196f756c3ec2fb9da : FAILURE in 39m 17s (non-voting)\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/62c7b05efaf64e4aba7c52ba35e8c412 : SUCCESS in 6m 41s (non-voting)","accounts_in_message":[],"_revision_number":3},{"id":"887cbf2011dd3150ea096048351cfd4730d52b5d","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-04-24 16:23:39.000000000","message":"Patch Set 3:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/9b1b6f1c5b3b40c1bed3387ba6edc958\n\n- openstack-tox-py310-arm64 https://zuul.opendev.org/t/openstack/build/cc47734666454bbea4ec5e7d302a5365 : FAILURE in 15m 29s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/141a02493e9343768b49a19cbe5af51e : FAILURE in 16m 11s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/2cccda0800ae477db2f5b18af1aa68a8 : FAILURE in 22m 32s (non-voting)","accounts_in_message":[],"_revision_number":3},{"id":"0118fb55fa3453e4c55c23dc09057c97df91d4dc","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":36012,"name":"Benjamin Lasseye","display_name":"Benjamin Lasseye","email":"blasseye@ikmail.com","username":"blasseye"},"date":"2026-08-03 08:32:25.000000000","message":"Uploaded patch set 4: New patch set was added with same tree, parent tree, and commit message as Patch Set 3.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":4},{"id":"c0467ba03c4b7cea13de5e9d9ddfe1a0da02951e","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":36012,"name":"Benjamin Lasseye","display_name":"Benjamin Lasseye","email":"blasseye@ikmail.com","username":"blasseye"},"date":"2026-08-03 08:33:57.000000000","message":"Uploaded patch set 5: Patch Set 4 was rebased.","accounts_in_message":[],"_revision_number":5},{"id":"b65222412979eaabd4ca2b68ae4dda42256d3c9e","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":36012,"name":"Benjamin Lasseye","display_name":"Benjamin Lasseye","email":"blasseye@ikmail.com","username":"blasseye"},"date":"2026-08-03 08:36:24.000000000","message":"Uploaded patch set 6: New patch set was added with same tree, parent tree, and commit message as Patch Set 5.","accounts_in_message":[],"_revision_number":6},{"id":"d3dac0272a414fada404ce9565a126ec431dd375","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-03 09:08:44.000000000","message":"Patch Set 6:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/fd7e511a8d42464bb036a581e0ee3233\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/a0b84b71047b489c84fc9769c03240c0 : FAILURE in 22m 41s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/767eec51cb41412687578f2076d7ac67 : FAILURE in 20m 39s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/4edd6fcfae9f481581a21e8b5f9330cc : FAILURE in 30m 06s (non-voting)","accounts_in_message":[],"_revision_number":6},{"id":"96ecc4071315882674660b227d25315f3fa6c51c","author":{"_account_id":36012,"name":"Benjamin Lasseye","display_name":"Benjamin Lasseye","email":"blasseye@ikmail.com","username":"blasseye"},"date":"2026-08-03 09:46:53.000000000","message":"Patch Set 6:\n\n(1 comment)\n\nThis change is ready for review.","accounts_in_message":[],"_revision_number":6},{"id":"51a0259be4aa33d3de7f473a8c7891bc99f36b24","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-03 10:09:56.000000000","message":"Patch Set 6: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/f40d79fd4c4b4cffbb48bfa6ce870edf\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/f53eb8e2aaa24ae097aea96ba8fb4d3a : FAILURE in 15m 56s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/5204e613eb8441af9ef4a246bde149c6 : SUCCESS in 5m 17s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/74aec6d4d00e4affbeb59587e4d4cfb5 : FAILURE in 11m 12s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/2efbb0836bed43c7b52bd8ce9941a290 : FAILURE in 11m 06s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/b2b7b0a164fd47c6ab35e69f456cb6fe : FAILURE in 16m 54s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/762fe11bb22147a6b8d88cd1b181f1f6 : SUCCESS in 14m 25s\n- grenade https://zuul.opendev.org/t/openstack/build/6a4844215d514bae971441f7055782d1 : SUCCESS in 1h 03m 47s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/48801d112a2242fdae47e43771abd14a : SUCCESS in 1h 32m 15s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/52039fb0314b40ac8626a8377fe9fa65 : SUCCESS in 13m 14s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/e747fc72f5da4433abd3050d8400f9d5 : SUCCESS in 18m 05s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/ca2b3425d0aa4f99b703089c5fd56650 : SUCCESS in 48m 01s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/9523337c446d4a1f8ad78f4ecdd2fcc6 : FAILURE in 19m 02s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/424e910a9a0947b18b0d3a6e8f7a702f : FAILURE in 26m 34s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/d202f6b6057a42719b6ccccff556005c : SUCCESS in 50m 15s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/1f774194613044958b32aeddb42a1732 : SUCCESS in 48m 49s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/51b0c9cf644443d99fc45e16751717c8 : SUCCESS in 39m 13s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/ffd0237c25e8435da9eda60756adfc29 : SUCCESS in 55m 21s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/f91ecedd413d493f94e7c11f4c8e4535 : SUCCESS in 30m 22s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/5af89340bc0647b7bc56f49446e59327 : SUCCESS in 6m 50s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":6},{"id":"cda5552c2d9a44a1a59c78d516ab33b782693cfd","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-03 10:28:01.000000000","message":"Patch Set 6:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/e0bb938e37394d7d843a1045fcba9f0d\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/001795ac627041668f94d32947271141 : FAILURE in 26m 14s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/296a1eb6dc4045d6a6d0299b2cf5572a : FAILURE in 25m 12s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/3970851597f34397b849e10c57ee5696 : FAILURE in 39m 14s (non-voting)","accounts_in_message":[],"_revision_number":6},{"id":"122b0625d31b15f99abdb704a020d16669939b1a","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":36012,"name":"Benjamin Lasseye","display_name":"Benjamin Lasseye","email":"blasseye@ikmail.com","username":"blasseye"},"date":"2026-08-03 14:06:56.000000000","message":"Uploaded patch set 7.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":7},{"id":"29f2723fdb3842ea6f5c1a696c68fed391cd0a7e","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-03 15:42:52.000000000","message":"Patch Set 7: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/8ac23ee7c0d749d092360b87e0a2890f\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/7708e165c7e24a299bc4678ef2a52e0e : SUCCESS in 14m 59s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/cd0c9a6c4e7d47419c62e8c1c251a1e6 : SUCCESS in 5m 06s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/25c153b5da9c46389779005327fc2bb1 : SUCCESS in 13m 04s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/31b79cad132c4f5484978050dce07392 : SUCCESS in 9m 20s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/930d0c506c3f48da974194cd44f08dc2 : SUCCESS in 14m 48s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/bc7460f247724003a1782c0e8dc92864 : SUCCESS in 12m 58s\n- grenade https://zuul.opendev.org/t/openstack/build/b15eee35d6fe4c07a55401b6ed1be7ae : SUCCESS in 37m 50s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/aa933e6140ac490e8669f4ee59b16486 : SUCCESS in 1h 30m 00s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/3eb1bbe45651439f86bb05a0aa10d24e : SUCCESS in 12m 50s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/99386f1135c046c69ce63e6351cbbe43 : SUCCESS in 10m 58s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/5f501889b566443593a32896ed3855d0 : SUCCESS in 28m 11s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/34f9b8f173624d81a0701a48a866b47d : FAILURE in 12m 51s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/74e6e747c1f84b3798eadb1d8c9507b4 : FAILURE in 16m 45s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/f33a29f2f7dd4df5a527a817d2e12a55 : SUCCESS in 46m 01s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/9547f216b3f648638a620d4b51aa1864 : SUCCESS in 32m 20s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/3a81dce5124040c29a9288045172379e : SUCCESS in 33m 04s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/246252449e27412d8586969cc4da25ce : SUCCESS in 32m 48s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/21380ee542c341d0a949cb46d40f15ca : SUCCESS in 24m 08s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/6aaeaafd9dc4479396514f771d7c3bf6 : SUCCESS in 7m 06s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":7},{"id":"e4424e054da3d66fcb7a279005a7ec7f11627668","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-03 16:13:44.000000000","message":"Patch Set 7:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/b1999e015ef74cd295d49b4609a7f0ee\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/079517eee9c849d097deea96feafc35d : SUCCESS in 40m 16s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/7a74f1fa6c9447a6a50f30ea0d3aa4f1 : SUCCESS in 36m 50s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/8cfc97b02f644b70880dbc3d786af8da : FAILURE in 50m 56s (non-voting)","accounts_in_message":[],"_revision_number":7}],"current_revision_number":7,"current_revision":"c3622da3e0927946e7c176ce5ded80f323e2dfc8","revisions":{"34ecdde13147e35cbc5d9fa5f130db534b5ade24":{"kind":"REWORK","_number":1,"created":"2026-04-23 14:49:48.000000000","uploader":{"_account_id":36012,"name":"Benjamin Lasseye","display_name":"Benjamin Lasseye","email":"blasseye@ikmail.com","username":"blasseye"},"ref":"refs/changes/69/985969/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/69/985969/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/69/985969/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/69/985969/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/69/985969/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/69/985969/1"}}},"commit":{"parents":[{"commit":"b6fd80996b882890a51f3e2aab41d952d7ff68ae","subject":"Enforce app cred project boundary on EC2 credential paths","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/b6fd80996b882890a51f3e2aab41d952d7ff68ae"}]}],"author":{"name":"blasseye","email":"blasseye@ikmail.com","date":"2026-04-23 14:35:03.000000000","tz":120},"committer":{"name":"blasseye","email":"blasseye@ikmail.com","date":"2026-04-23 14:49:13.000000000","tz":120},"subject":"Fix: TOTP authentication lockout risk in Keystone","message":"Fix: TOTP authentication lockout risk in Keystone\n\nEnabling TOTP authentication in Keystone without users already having TOTP\ncredentials can result in authentication being completely blocked.\nFurthermore, if a user (or an administrator) deletes an existing TOTP\ncredential while TOTP is enforced as a mandatory authentication method,\nthe user is immediately locked out, as they can no longer meet the\nauthentication requirements or re-register a new credential.\n\nWith this fix, I prevent the user from deleting a credential if TOTP is\nenabled. And I prevent TOTP from being enabled if a TOTP credential is not\nactive.\n\nCloses-Bug: #2150088\nChange-Id: I3d72b789552522ff34b5291143c49fea6f154343\nSigned-off-by: blasseye \u003cblasseye@ikmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/34ecdde13147e35cbc5d9fa5f130db534b5ade24"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/34ecdde13147e35cbc5d9fa5f130db534b5ade24"}]},"branch":"refs/heads/master"},"0a1d75340eaacc77012306e446413340a7b7bc05":{"kind":"REWORK","_number":2,"created":"2026-04-24 06:43:36.000000000","uploader":{"_account_id":36012,"name":"Benjamin Lasseye","display_name":"Benjamin Lasseye","email":"blasseye@ikmail.com","username":"blasseye"},"ref":"refs/changes/69/985969/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/69/985969/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/69/985969/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/69/985969/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/69/985969/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/69/985969/2"}}},"commit":{"parents":[{"commit":"b6fd80996b882890a51f3e2aab41d952d7ff68ae","subject":"Enforce app cred project boundary on EC2 credential paths","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/b6fd80996b882890a51f3e2aab41d952d7ff68ae"}]}],"author":{"name":"blasseye","email":"blasseye@ikmail.com","date":"2026-04-23 14:35:03.000000000","tz":120},"committer":{"name":"blasseye","email":"blasseye@ikmail.com","date":"2026-04-24 06:43:17.000000000","tz":120},"subject":"Fix: TOTP authentication lockout risk in Keystone","message":"Fix: TOTP authentication lockout risk in Keystone\n\nEnabling TOTP authentication in Keystone without users already having TOTP\ncredentials can result in authentication being completely blocked.\nFurthermore, if a user (or an administrator) deletes an existing TOTP\ncredential while TOTP is enforced as a mandatory authentication method,\nthe user is immediately locked out, as they can no longer meet the\nauthentication requirements or re-register a new credential.\n\nWith this fix, I prevent the user from deleting a credential if TOTP is\nenabled. And I prevent TOTP from being enabled if a TOTP credential is not\nactive.\n\nCloses-Bug: #2150088\nChange-Id: I3d72b789552522ff34b5291143c49fea6f154343\nSigned-off-by: blasseye \u003cblasseye@ikmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/0a1d75340eaacc77012306e446413340a7b7bc05"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/0a1d75340eaacc77012306e446413340a7b7bc05"}]},"branch":"refs/heads/master"},"a51a7ab43cbd577d3c3737ab680a0134b0e7ce98":{"kind":"REWORK","_number":3,"created":"2026-04-24 12:02:51.000000000","uploader":{"_account_id":36012,"name":"Benjamin Lasseye","display_name":"Benjamin Lasseye","email":"blasseye@ikmail.com","username":"blasseye"},"ref":"refs/changes/69/985969/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/69/985969/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/69/985969/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/69/985969/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/69/985969/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/69/985969/3"}}},"commit":{"parents":[{"commit":"2230026f77a8ed50493d2d58be9120910ceb2089","subject":"Merge \"Fix keystone scope flag in tempest.conf\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/2230026f77a8ed50493d2d58be9120910ceb2089"}]}],"author":{"name":"blasseye","email":"blasseye@ikmail.com","date":"2026-04-23 14:35:03.000000000","tz":120},"committer":{"name":"blasseye","email":"blasseye@ikmail.com","date":"2026-04-24 12:02:41.000000000","tz":120},"subject":"Fix: TOTP authentication lockout risk in Keystone","message":"Fix: TOTP authentication lockout risk in Keystone\n\nEnabling TOTP authentication in Keystone without users already having TOTP\ncredentials can result in authentication being completely blocked.\nFurthermore, if a user (or an administrator) deletes an existing TOTP\ncredential while TOTP is enforced as a mandatory authentication method,\nthe user is immediately locked out, as they can no longer meet the\nauthentication requirements or re-register a new credential.\n\nWith this fix, I prevent the user from deleting a credential if TOTP is\nenabled. And I prevent TOTP from being enabled if a TOTP credential is not\nactive.\n\nCloses-Bug: #2150088\nChange-Id: I3d72b789552522ff34b5291143c49fea6f154343\nSigned-off-by: blasseye \u003cblasseye@ikmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a51a7ab43cbd577d3c3737ab680a0134b0e7ce98"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a51a7ab43cbd577d3c3737ab680a0134b0e7ce98"}]},"branch":"refs/heads/master"},"be53b5ceebd71a89b195376565e6109a7961e7af":{"kind":"NO_CHANGE","_number":4,"created":"2026-08-03 08:32:25.000000000","uploader":{"_account_id":36012,"name":"Benjamin Lasseye","display_name":"Benjamin Lasseye","email":"blasseye@ikmail.com","username":"blasseye"},"ref":"refs/changes/69/985969/4","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/69/985969/4","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/69/985969/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/69/985969/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/69/985969/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/69/985969/4"}}},"commit":{"parents":[{"commit":"2230026f77a8ed50493d2d58be9120910ceb2089","subject":"Merge \"Fix keystone scope flag in tempest.conf\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/2230026f77a8ed50493d2d58be9120910ceb2089"}]}],"author":{"name":"blasseye","email":"blasseye@ikmail.com","date":"2026-04-23 14:35:03.000000000","tz":120},"committer":{"name":"blasseye","email":"blasseye@ikmail.com","date":"2026-08-03 08:31:58.000000000","tz":120},"subject":"Fix: TOTP authentication lockout risk in Keystone","message":"Fix: TOTP authentication lockout risk in Keystone\n\nEnabling TOTP authentication in Keystone without users already having TOTP\ncredentials can result in authentication being completely blocked.\nFurthermore, if a user (or an administrator) deletes an existing TOTP\ncredential while TOTP is enforced as a mandatory authentication method,\nthe user is immediately locked out, as they can no longer meet the\nauthentication requirements or re-register a new credential.\n\nWith this fix, I prevent the user from deleting a credential if TOTP is\nenabled. And I prevent TOTP from being enabled if a TOTP credential is not\nactive.\n\nCloses-Bug: #2150088\nChange-Id: I3d72b789552522ff34b5291143c49fea6f154343\nSigned-off-by: blasseye \u003cblasseye@ikmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/be53b5ceebd71a89b195376565e6109a7961e7af"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/be53b5ceebd71a89b195376565e6109a7961e7af"}]},"branch":"refs/heads/master"},"29de552ea3a430fde7d72c45edc522a9e6eb0baa":{"kind":"TRIVIAL_REBASE","_number":5,"created":"2026-08-03 08:33:57.000000000","uploader":{"_account_id":36012,"name":"Benjamin Lasseye","display_name":"Benjamin Lasseye","email":"blasseye@ikmail.com","username":"blasseye"},"ref":"refs/changes/69/985969/5","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/69/985969/5","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/69/985969/5 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/69/985969/5 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/69/985969/5 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/69/985969/5"}}},"commit":{"parents":[{"commit":"30ef2ffa65a3486ef882f00538e20f2253c57d4c","subject":"Merge \"Make JWT token signing algorithm configurable\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/30ef2ffa65a3486ef882f00538e20f2253c57d4c"}]}],"author":{"name":"blasseye","email":"blasseye@ikmail.com","date":"2026-04-23 14:35:03.000000000","tz":120},"committer":{"name":"blasseye","email":"blasseye@ikmail.com","date":"2026-08-03 08:33:30.000000000","tz":120},"subject":"Fix: TOTP authentication lockout risk in Keystone","message":"Fix: TOTP authentication lockout risk in Keystone\n\nEnabling TOTP authentication in Keystone without users already having TOTP\ncredentials can result in authentication being completely blocked.\nFurthermore, if a user (or an administrator) deletes an existing TOTP\ncredential while TOTP is enforced as a mandatory authentication method,\nthe user is immediately locked out, as they can no longer meet the\nauthentication requirements or re-register a new credential.\n\nWith this fix, I prevent the user from deleting a credential if TOTP is\nenabled. And I prevent TOTP from being enabled if a TOTP credential is not\nactive.\n\nCloses-Bug: #2150088\nChange-Id: I3d72b789552522ff34b5291143c49fea6f154343\nSigned-off-by: blasseye \u003cblasseye@ikmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/29de552ea3a430fde7d72c45edc522a9e6eb0baa"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/29de552ea3a430fde7d72c45edc522a9e6eb0baa"}]},"branch":"refs/heads/master"},"b6453c7505800fd59942d59c3dc19f79003081cd":{"kind":"NO_CHANGE","_number":6,"created":"2026-08-03 08:36:24.000000000","uploader":{"_account_id":36012,"name":"Benjamin Lasseye","display_name":"Benjamin Lasseye","email":"blasseye@ikmail.com","username":"blasseye"},"ref":"refs/changes/69/985969/6","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/69/985969/6","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/69/985969/6 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/69/985969/6 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/69/985969/6 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/69/985969/6"}}},"commit":{"parents":[{"commit":"30ef2ffa65a3486ef882f00538e20f2253c57d4c","subject":"Merge \"Make JWT token signing algorithm configurable\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/30ef2ffa65a3486ef882f00538e20f2253c57d4c"}]}],"author":{"name":"blasseye","email":"blasseye@ikmail.com","date":"2026-04-23 14:35:03.000000000","tz":120},"committer":{"name":"blasseye","email":"blasseye@ikmail.com","date":"2026-08-03 08:36:03.000000000","tz":120},"subject":"Fix: TOTP authentication lockout risk in Keystone","message":"Fix: TOTP authentication lockout risk in Keystone\n\nEnabling TOTP authentication in Keystone without users already having TOTP\ncredentials can result in authentication being completely blocked.\nFurthermore, if a user (or an administrator) deletes an existing TOTP\ncredential while TOTP is enforced as a mandatory authentication method,\nthe user is immediately locked out, as they can no longer meet the\nauthentication requirements or re-register a new credential.\n\nWith this fix, I prevent the user from deleting a credential if TOTP is\nenabled. And I prevent TOTP from being enabled if a TOTP credential is not\nactive.\n\nCloses-Bug: #2150088\nChange-Id: I3d72b789552522ff34b5291143c49fea6f154343\nSigned-off-by: blasseye \u003cblasseye@ikmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/b6453c7505800fd59942d59c3dc19f79003081cd"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/b6453c7505800fd59942d59c3dc19f79003081cd"}]},"branch":"refs/heads/master"},"c3622da3e0927946e7c176ce5ded80f323e2dfc8":{"kind":"REWORK","_number":7,"created":"2026-08-03 14:06:56.000000000","uploader":{"_account_id":36012,"name":"Benjamin Lasseye","display_name":"Benjamin Lasseye","email":"blasseye@ikmail.com","username":"blasseye"},"ref":"refs/changes/69/985969/7","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/69/985969/7","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/69/985969/7 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/69/985969/7 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/69/985969/7 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/69/985969/7"}}},"commit":{"parents":[{"commit":"30ef2ffa65a3486ef882f00538e20f2253c57d4c","subject":"Merge \"Make JWT token signing algorithm configurable\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/30ef2ffa65a3486ef882f00538e20f2253c57d4c"}]}],"author":{"name":"blasseye","email":"blasseye@ikmail.com","date":"2026-04-23 14:35:03.000000000","tz":120},"committer":{"name":"blasseye","email":"blasseye@ikmail.com","date":"2026-08-03 14:05:40.000000000","tz":120},"subject":"Fix: TOTP authentication lockout risk in Keystone","message":"Fix: TOTP authentication lockout risk in Keystone\n\nEnabling TOTP authentication in Keystone without users already having TOTP\ncredentials can result in authentication being completely blocked.\nFurthermore, if a user (or an administrator) deletes an existing TOTP\ncredential while TOTP is enforced as a mandatory authentication method,\nthe user is immediately locked out, as they can no longer meet the\nauthentication requirements or re-register a new credential.\n\nWith this fix, I prevent the user from deleting a credential if TOTP is\nenabled. And I prevent TOTP from being enabled if a TOTP credential is not\nactive.\n\nCloses-Bug: #2150088\nChange-Id: I3d72b789552522ff34b5291143c49fea6f154343\nSigned-off-by: blasseye \u003cblasseye@ikmail.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/c3622da3e0927946e7c176ce5ded80f323e2dfc8"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/c3622da3e0927946e7c176ce5ded80f323e2dfc8"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY"},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}