)]}'
{"id":"openstack%2Fkeystone~987477","triplet_id":"openstack%2Fkeystone~stable%2F2025.2~I1a9dc4e37f0d2e63c9edb5de7eb5fd3b37ca77ce","project":"openstack/keystone","branch":"stable/2025.2","attention_set":{},"removed_from_attention_set":{"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-05-07 09:10:36.000000000","reason":"\u003cGERRIT_ACCOUNT_27900\u003e replied on the change","reason_account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}},"37598":{"account":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"last_update":"2026-05-07 11:32:05.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"I1a9dc4e37f0d2e63c9edb5de7eb5fd3b37ca77ce","subject":"Block app credential token rescoping","status":"MERGED","created":"2026-05-06 10:53:54.000000000","updated":"2026-05-07 11:33:05.000000000","submitted":"2026-05-07 11:32:05.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"987477","cherry_pick_of_change":986498,"cherry_pick_of_patch_set":1,"meta_rev_id":"bd7a9dd0e6d80edbe0034f16279dbfc6a4b25864","_number":987477,"virtual_id_number":987477,"owner":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-05-07 11:32:05.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":2,"date":"2026-05-07 09:10:36.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":1,"date":"2026-05-07 09:10:36.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"CC":[{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"}],"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-06 10:53:54.000000000","updated_by":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"reviewer":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"state":"CC"},{"updated":"2026-05-06 12:46:33.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-05-06 14:46:37.000000000","updated_by":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"REVIEWER"}],"messages":[{"id":"f4292fd1cc0c773adf24a51dc3f355fbad36480a","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"date":"2026-05-06 10:53:54.000000000","message":"Patch Set 1: Cherry Picked from branch stable/2026.1.","accounts_in_message":[],"_revision_number":1},{"id":"a552fcc8d8500a851ea550e3b2f4e9f73f5e92f1","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-06 12:46:33.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/69d3883a78bd40eebddb3be1725a27c1\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/4fb3dc8270bc4b639939072c9c9d4313 : SUCCESS in 16m 54s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/a04e974e382d4334bc6a2ace0d08defa : SUCCESS in 9m 09s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/fdab3a61d30f4c9e8835b71d1fe4b6e1 : SUCCESS in 12m 15s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/54cea0f1f47b460ba5c8157d975f4de3 : SUCCESS in 11m 36s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/996f95206a104ba685aae2aa66c43d50 : SUCCESS in 19m 10s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/5926f87d8d9e4011a50d45c7e0def199 : SUCCESS in 14m 12s\n- grenade https://zuul.opendev.org/t/openstack/build/405c3330028141f2a02e3d0092582eb2 : SUCCESS in 1h 14m 56s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/6369df787e644e6e8c415d1acd773920 : SUCCESS in 1h 40m 58s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/fa7e7deccf9a494caebb479b7f88dfb2 : SUCCESS in 17m 11s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/89a962db3ac14dd99f4bb61fd0d61782 : SUCCESS in 19m 20s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/5914f6c6d06c48fa83766f541fe872c5 : FAILURE in 14m 49s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/f56967fe9e174fc58f0f558e74a35fa8 : FAILURE in 24m 40s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/33ea0e0447904032831690a36b7ada0a : SUCCESS in 13m 29s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/b56b4b05d9c948e3a6e416c92617347f : SUCCESS in 33m 28s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/c89038a3ed9542758e971a618530000b : SUCCESS in 35m 31s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/890260cba0f1456f8cc3d454e4279bc0 : SUCCESS in 28m 59s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/101821aab5434deca7356c1e6877a802 : FAILURE in 26m 11s (non-voting)\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/0fe43b34250e45b6acbdfce1a99caea3 : FAILURE in 4m 09s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"8ff9e3f745d08f9c15e0eae5bb14230fc138911d","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-05-07 09:10:36.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"3c8c73449b21d6f6c1be1f3316996778ddfc6345","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-07 09:11:03.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"2ce229617fef3ac84d1667a497a6bb97d1a04fa6","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-07 11:32:05.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/5ac2cb0433b6476f8415dcf3223222ca\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/86571910a0f1443ba800d51231934bb8 : SUCCESS in 4m 45s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/a0066a296382408eb12efa6c5080f987 : SUCCESS in 8m 13s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/cc31525f8ddd49a29c5fa1b35e7c6918 : SUCCESS in 14m 30s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/67d298bdf5ba42eca804c2fd7656a302 : SUCCESS in 12m 26s\n- grenade https://zuul.opendev.org/t/openstack/build/e34a24a1375a41d38cef76fce2e7bbd9 : SUCCESS in 1h 06m 10s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/48c06fbbfa7d4a1d9c3ee32958d1b84d : SUCCESS in 1h 53m 50s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/e07e634c5f454a9c93e6b34770b909e2 : SUCCESS in 28m 24s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/8fff8ce9688b4ed18fd2faba662542dd : SUCCESS in 17m 52s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/d1e0ada490c44587ac1e56bd4300b621 : SUCCESS in 1h 05m 27s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/27f2177306de40a59ca3a0f7119f327b : FAILURE in 43m 14s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"a018b1648f2d89e75b0448465430fc06a884c629","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-07 11:32:05.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1},{"id":"bd7a9dd0e6d80edbe0034f16279dbfc6a4b25864","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-07 11:33:05.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/bf7eda6de8bf4369bf72befb44206311\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/3939799658374443ab1699d4694880d4 : SUCCESS in 51s","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"50436db57373f92bfe0d30ae967e4dcc3d4e2613","revisions":{"50436db57373f92bfe0d30ae967e4dcc3d4e2613":{"kind":"REWORK","_number":1,"created":"2026-05-06 10:53:54.000000000","uploader":{"_account_id":37598,"name":"Ivan Anfimov","display_name":"Ivan Anfimov","email":"lazekteam@gmail.com","username":"anfimovir"},"ref":"refs/changes/77/987477/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/77/987477/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/77/987477/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/77/987477/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/77/987477/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/77/987477/1"}}},"commit":{"parents":[{"commit":"3f87f91495d25a14b4ef3a82dc6c9a0cf71f2877","subject":"Block app cred tokens from authorizing OAuth1 requests","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/3f87f91495d25a14b4ef3a82dc6c9a0cf71f2877"}]}],"author":{"name":"Boris Bobrov","email":"b.bobrov@sap.com","date":"2026-03-19 22:27:59.000000000","tz":60},"committer":{"name":"Ivan Anfimov","email":"lazekteam@gmail.com","date":"2026-05-06 10:53:54.000000000","tz":0},"subject":"Block app credential token rescoping","message":"Block app credential token rescoping\n\nApplication credential tokens could be rescoped to system scope\nvia token-from-token auth, bypassing the intended scope binding.\nThe check only blocked project and domain scope but not system,\nallowing escalation to full system-admin privileges.\n\nCheck for any requested scope rather than enumerating individual\nscope types.\n\nCloses-Bug: 2144966\nGenerated-By: claude-opus-4-6 (OpenCode)\nSigned-off-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nChange-Id: I1a9dc4e37f0d2e63c9edb5de7eb5fd3b37ca77ce\n(cherry picked from commit 836f6b98648ee713c368a803eabe01a66f161372)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/50436db57373f92bfe0d30ae967e4dcc3d4e2613"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/50436db57373f92bfe0d30ae967e4dcc3d4e2613"}]},"branch":"refs/heads/stable/2025.2","conflicts":{"ours":"3f87f91495d25a14b4ef3a82dc6c9a0cf71f2877","theirs":"88b5d90203900e3785321723d382ad84000a6aaa","contains_conflicts":false}}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}