)]}'
{"id":"openstack%2Fkeystone~988712","triplet_id":"openstack%2Fkeystone~master~I69954f0549cc9aa731b952e3b8cf546a7da1ce8e","project":"openstack/keystone","branch":"master","topic":"fix/lp2148825","attention_set":{},"removed_from_attention_set":{"7414":{"account":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"last_update":"2026-08-05 14:43:43.000000000","reason":"Change was submitted"},"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-08-05 14:43:43.000000000","reason":"Change was submitted"},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-06-12 15:27:24.000000000","reason":"removed on reply"}},"hashtags":[],"change_id":"I69954f0549cc9aa731b952e3b8cf546a7da1ce8e","subject":"Fix BOLA in access rule GET/DELETE and ownership check in CREATE","status":"MERGED","created":"2026-05-14 22:59:18.000000000","updated":"2026-08-05 14:45:40.000000000","submitted":"2026-08-05 14:43:43.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"988712-fix/lp2148825","meta_rev_id":"49d44ed23de481039289260ad38513a75f4c8550","_number":988712,"virtual_id_number":988712,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-08-05 14:43:43.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":2,"date":"2026-06-12 15:27:24.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":1,"date":"2026-08-05 10:07:11.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"}],"reviewers":{"REVIEWER":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-15 00:19:49.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-05-15 06:36:59.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"REVIEWER"},{"updated":"2026-05-15 06:36:59.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"state":"REVIEWER"}],"messages":[{"id":"7dd7e5f17534f190edc06ed1a879ba7106b71dfd","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-14 22:59:18.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"5f5aa0c7d34be1643bbe90d76eab0080b0bd2a37","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-15 00:19:49.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/9bf4b8d374414722bba5e8e9fc344f31\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/2ab7947c1ce141098e6d1af961463fae : SUCCESS in 17m 57s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/ad823c3796f9498e9e95d793386abf16 : SUCCESS in 5m 12s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/dfcc7dd9e3264bb1b18576b23d620415 : SUCCESS in 9m 18s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/681e823729c0409599263eadf54f530c : SUCCESS in 9m 14s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/43516397db6d4635bff3d5dd2420e679 : SUCCESS in 12m 04s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/f12cb59ed67b4f35bd4e5b37e6116ea3 : SUCCESS in 11m 47s\n- grenade https://zuul.opendev.org/t/openstack/build/9fad9fecd99a4acabe23c72c11cbb637 : SUCCESS in 1h 05m 23s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/2b25483a541d4cf4bfd6f8ef774d2bd8 : SUCCESS in 1h 18m 01s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/9dc2ba96a48a4d38ad5f218514823ee0 : SUCCESS in 4m 47s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/9a7782c48bfd4f60bb7335ea74c7d037 : FAILURE in 17m 01s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/11cf760ec29148fd9bbaa725c661a1a9 : SUCCESS in 20m 50s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/59860c39fe144a20b01169dc0676c5e4 : FAILURE in 11m 26s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/0c4c38ac3fef47b894a53c49210f1882 : FAILURE in 18m 41s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/fb21d4d999ea49f4a6af6796e68e6dcb : SUCCESS in 20m 19s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/f1ab2a40ecb348bf9e63e115ab4eb562 : SUCCESS in 17m 44s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/e7b0dfaae0974f01bf3ef7e7ea228239 : SUCCESS in 18m 33s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/158c2a3c29324c47966b8eb79887cb5e : SUCCESS in 30m 50s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/a092d2fff2b34fcdaa1993ffae9d82ed : SUCCESS in 43m 13s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/7e84826a31674c2fb9553839a5866f83 : RETRY_LIMIT in 9m 27s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"394460cfe670e989f5b7c2c01f204d4e24749bde","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-15 06:36:59.000000000","message":"Patch Set 1:\n\nThis change is ready for review.","accounts_in_message":[],"_revision_number":1},{"id":"c397d09932a2b722676106105968f46e6b23f8c2","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-15 09:26:29.000000000","message":"Patch Set 1:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/d14fa508f2c4404ab07d80a4fa3fe5ed\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/be881346e0c24982888af8919a26607d : SUCCESS in 20m 33s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/5b33dfc457e94ccea2960e3abc0ee637 : SUCCESS in 22m 41s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/353e8ad7e13d4c9da37b348c98b64e6f : SUCCESS in 27m 17s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"115f97fbbf4015d46f990799953490174370d788","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-06-12 15:27:24.000000000","message":"Patch Set 1: Code-Review+2","accounts_in_message":[],"_revision_number":1},{"id":"2c52e7b5c71079de0eebb7345912a06367ae9aab","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-08-05 10:07:11.000000000","message":"Patch Set 1: Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"786de188b4e9d46c31424ce1e0ec0bfd11f86dec","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-05 10:07:59.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"286ea92a5342860b1d8a9df00145a6509184a1de","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-05 14:43:43.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/479d151b7a8f4778bc966c9ba9f72ea4\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/9a58d8cd57a147519c7e39c7892a8ced : SUCCESS in 5m 44s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/e7aa5ba7f827473b8e6a13d4d7d4abc9 : SUCCESS in 11m 57s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/6f3b7503163c4926b6a595438cb4e66e : SUCCESS in 6m 48s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/67c3fbdf31e9431fb1c5e7019c7445fa : SUCCESS in 13m 52s\n- grenade https://zuul.opendev.org/t/openstack/build/56ff00ce85384592a329d4675ff734c5 : SUCCESS in 1h 02m 38s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/e28d358276ef4fa8895ef4ace91d292a : SUCCESS in 1h 53m 21s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/2e56e2efff744256864238d9d9d18b48 : SUCCESS in 12m 28s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/e47f5c1da6174b5bb9acc63a4e819a06 : SUCCESS in 26m 34s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/131dc5cd2be04d6f9de6bbf310880eb8 : SUCCESS in 41m 21s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/e02c636076e54b3dae02968c907a782d : SUCCESS in 53m 56s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/2a63bd0b609141cc8ae46da8cb5c8985 : SUCCESS in 41m 46s","accounts_in_message":[],"_revision_number":1},{"id":"fdfeaa5b478e909be681b255bec85c7631cec115","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-05 14:43:43.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1},{"id":"49d44ed23de481039289260ad38513a75f4c8550","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-08-05 14:45:40.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/8da7d290d36140ec93ff15cffdd3917c\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/dbdad5284f614151b5630f39e4d4270b : SUCCESS in 1m 08s","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"117cb88e6f62676f8124813f4fdde04a58cc9108","revisions":{"117cb88e6f62676f8124813f4fdde04a58cc9108":{"kind":"REWORK","_number":1,"created":"2026-05-14 22:59:18.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/12/988712/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/12/988712/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/12/988712/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/12/988712/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/12/988712/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/12/988712/1"}}},"commit":{"parents":[{"commit":"2230026f77a8ed50493d2d58be9120910ceb2089","subject":"Merge \"Fix keystone scope flag in tempest.conf\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/2230026f77a8ed50493d2d58be9120910ceb2089"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-14 22:39:24.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-14 22:59:12.000000000","tz":120},"subject":"Fix BOLA in access rule GET/DELETE and ownership check in CREATE","message":"Fix BOLA in access rule GET/DELETE and ownership check in CREATE\n\nGET /v3/users/{user_id}/access_rules/{access_rule_id} and the\ncorresponding DELETE pass the RBAC policy check when the requester\u0027s\nuser_id matches the path user_id, but the backend then fetches or\ndeletes the target rule globally by access_rule_id with no owner\nfilter. An authenticated user who knows another user\u0027s access_rule_id\ncan read that rule\u0027s details or delete it by substituting their own\nuser_id in the path.\n\nFix by threading user_id from the URL path through the manager down to\nthe SQL query, so the lookup is scoped to external_id AND user_id. A\nmismatched owner produces AccessRuleNotFound (HTTP 404) rather than\nreturning or deleting the rule.\n\nAlso add an ownership check in create_application_credential: when an\nexisting rule is found by external_id, verify it belongs to the\ncreating user before linking it to the new application credential.\n\nFour regression tests are added covering the BOLA GET, BOLA DELETE,\nand cross-user reuse scenarios across all project-scoped personas.\n\nCloses-Bug: #2148825\n\nChange-Id: I69954f0549cc9aa731b952e3b8cf546a7da1ce8e\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/117cb88e6f62676f8124813f4fdde04a58cc9108"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/117cb88e6f62676f8124813f4fdde04a58cc9108"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}