)]}'
{"id":"openstack%2Fkeystone~988719","triplet_id":"openstack%2Fkeystone~stable%2F2025.1~I585a0a15f739620d4f3a7a66e9d4cbc69469da8b","project":"openstack/keystone","branch":"stable/2025.1","attention_set":{},"removed_from_attention_set":{"28356":{"account":{"_account_id":28356,"name":"Rafael Weingartner","email":"rafael@apache.org","username":"rafaelweingartner"},"last_update":"2026-05-15 11:51:35.000000000","reason":"\u003cGERRIT_ACCOUNT_28356\u003e replied on the change","reason_account":{"_account_id":28356,"name":"Rafael Weingartner","email":"rafael@apache.org","username":"rafaelweingartner"}},"3031":{"account":{"_account_id":3031,"name":"Sam Morrison","email":"sorrison@gmail.com","username":"sorrison"},"last_update":"2026-05-17 22:29:36.000000000","reason":"Change was abandoned"}},"hashtags":[],"change_id":"I585a0a15f739620d4f3a7a66e9d4cbc69469da8b","subject":"Keystone identity mapping to support project definition as a JSON","status":"ABANDONED","created":"2026-05-15 03:43:12.000000000","updated":"2026-05-17 22:29:36.000000000","total_comment_count":3,"unresolved_comment_count":1,"has_review_started":true,"meta_rev_id":"7c083ff0e667c0f807f6d01642fa8a26cc65f3b0","_number":988719,"virtual_id_number":988719,"owner":{"_account_id":3031,"name":"Sam Morrison","email":"sorrison@gmail.com","username":"sorrison"},"actions":{},"labels":{"Verified":{"disliked":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":28356,"name":"Rafael Weingartner","email":"rafael@apache.org","username":"rafaelweingartner"},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"tag":"autogenerated:zuul:check","value":-1,"date":"2026-05-15 05:03:42.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":-1,"default_value":0,"optional":true},"Code-Review":{"rejected":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":28356,"name":"Rafael Weingartner","email":"rafael@apache.org","username":"rafaelweingartner"},{"value":-2,"date":"2026-05-15 09:06:05.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":28356,"name":"Rafael Weingartner","email":"rafael@apache.org","username":"rafaelweingartner"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"CC":[{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}],"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"_account_id":28356,"name":"Rafael Weingartner","email":"rafael@apache.org","username":"rafaelweingartner"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-15 03:43:12.000000000","updated_by":{"_account_id":3031,"name":"Sam Morrison","email":"sorrison@gmail.com","username":"sorrison"},"reviewer":{"_account_id":28356,"name":"Rafael Weingartner","email":"rafael@apache.org","username":"rafaelweingartner"},"state":"REVIEWER"},{"updated":"2026-05-15 05:03:42.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-05-15 06:41:20.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"CC"},{"updated":"2026-05-15 09:06:05.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"REVIEWER"}],"messages":[{"id":"cbf5b8a3d4c1a33042d86af9e0d6e2199af61aef","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":3031,"name":"Sam Morrison","email":"sorrison@gmail.com","username":"sorrison"},"date":"2026-05-15 03:43:12.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"dd95314b3d64b0e3596fdf0299a3a2641a23d419","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-15 05:03:42.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/824f44dab90c41c2be00aa48dd60596b\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/77916198a9814f8abba6de67223397d6 : SUCCESS in 13m 33s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/973acec5e0004128853ff8ddbdbea5f8 : SUCCESS in 3m 22s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/e0852036bf16458ea86e2eb79343b115 : SUCCESS in 13m 10s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/0859953e36284798a05f2bb3b65a6268 : SUCCESS in 7m 12s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/9cc73c796bce4ca9bfe4e68b6b843cc6 : SUCCESS in 8m 08s\n- grenade https://zuul.opendev.org/t/openstack/build/0844fd27c0504fc2a37e348f0235a1b6 : FAILURE in 28m 24s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/96b263094f91436aa40a59d31d356017 : SUCCESS in 1h 17m 16s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/f5cc6c70610046ccb7f26deca491311d : SUCCESS in 9m 31s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/43714f81da884322b88892dd7d000ae4 : SUCCESS in 18m 20s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/d2e4e671cbe643d0b6604880817a5fef : FAILURE in 15m 04s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/3f0f18e6f7374a0485b9badb2a00a0b9 : FAILURE in 22m 22s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/de6ecae24032432b800341136d6553cc : FAILURE in 15m 18s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/e1d56d2cd306474cb36b460d5a988eeb : SUCCESS in 10m 03s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/ef64a7a0661143edbbe59683bdbea7f8 : SUCCESS in 37m 37s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/49137c0d16fa4662863a9db932bdb41a : SUCCESS in 37m 42s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/275ef2098d8a4c249fbe2bebed1e0922 : FAILURE in 9m 47s (non-voting)\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/859c692b705e48559efad91c09fc560b : SUCCESS in 32m 31s","accounts_in_message":[],"_revision_number":1},{"id":"02fce02a61f109aa18a65796dfc7a816a74f69a1","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-15 06:41:20.000000000","message":"Patch Set 1:\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"cb0c76d41382b322dc0e9230267d19b723990d7d","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-15 08:25:59.000000000","message":"Patch Set 1:\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/8d745c57e98d41fb915f7e547e24d569\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/9c696dd82a9947d1a4420618062b7071 : SUCCESS in 16m 22s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/be10858413984e22a9dbcef81498dafa : SUCCESS in 6m 26s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/78a7705a6d2a467eba6adbab97b98c3c : SUCCESS in 12m 16s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/c533392cb4b144b5a382daeaee98b110 : SUCCESS in 12m 50s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/8940787ffd644640a397a5e59088cd2f : SUCCESS in 12m 36s\n- grenade https://zuul.opendev.org/t/openstack/build/d7622d03394648ef9fe232975f8ef38e : FAILURE in 25m 22s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/622d4dc8c07e4bd68a54f6f1bc164ce2 : SUCCESS in 1h 36m 40s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/0244d8dc60004c2e99430900b208b9c9 : SUCCESS in 11m 11s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/0cfacfe4db2348bebf7f725380ab53bf : SUCCESS in 34m 12s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/58d49439ba3a41129d7a83bf42e1a2ac : FAILURE in 36m 20s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/721e963d69b845d2ac65f0dc4168eb9f : FAILURE in 25m 01s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/6746d72fa876469fb0912a95a8d8d13a : FAILURE in 26m 40s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/9d0e7e09df514050823261ebbe0f7a37 : SUCCESS in 18m 32s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/ece884a2fdc942df95dee8f668a0d819 : SUCCESS in 33m 53s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/c31c59676b4e411cb6f3508a3bf063ec : SUCCESS in 46m 07s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/769b5bda8f47417c8a47b593b03ef1a0 : FAILURE in 5m 37s (non-voting)\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/06094ce5dacd4b93a3e45130bec9812d : SUCCESS in 32m 43s","accounts_in_message":[],"_revision_number":1},{"id":"7e32a78e1ff647382455b29d8fc7fa93e26c489c","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-05-15 09:06:05.000000000","message":"Patch Set 1: Code-Review-2\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"02ac58e30767d45abd8f55c26cc656321b04f427","author":{"_account_id":28356,"name":"Rafael Weingartner","email":"rafael@apache.org","username":"rafaelweingartner"},"date":"2026-05-15 11:51:35.000000000","message":"Patch Set 1:\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"7c083ff0e667c0f807f6d01642fa8a26cc65f3b0","tag":"autogenerated:gerrit:abandon","author":{"_account_id":3031,"name":"Sam Morrison","email":"sorrison@gmail.com","username":"sorrison"},"date":"2026-05-17 22:29:36.000000000","message":"Abandoned","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"1b85bb4e6fa9c0966b303658811035d466faae95","revisions":{"1b85bb4e6fa9c0966b303658811035d466faae95":{"kind":"REWORK","_number":1,"created":"2026-05-15 03:43:12.000000000","uploader":{"_account_id":3031,"name":"Sam Morrison","email":"sorrison@gmail.com","username":"sorrison"},"ref":"refs/changes/19/988719/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/19/988719/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/19/988719/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/19/988719/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/19/988719/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/19/988719/1"}}},"commit":{"parents":[{"commit":"33744fef63a618e074af4915f03427a054ac4bc8","subject":"Block app cred tokens from authorizing OAuth1 requests","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/33744fef63a618e074af4915f03427a054ac4bc8"}]}],"author":{"name":"Rafael Weingärtner","email":"rafael@apache.org","date":"2025-08-07 23:37:48.000000000","tz":-180},"committer":{"name":"Sam Morrison","email":"sorrison@gmail.com","date":"2026-05-15 03:42:11.000000000","tz":600},"subject":"Keystone identity mapping to support project definition as a JSON","message":"Keystone identity mapping to support project definition as a JSON\n\nThis pull request (PR) depends on [1], which has been released. The\nproposal in [1] enhances the identity mapping schema management.\n\nCurrently, the project assignment via the federated identity mapping is\nstatic. This happens because of the find/replace mechanism that we have\nin place in Keystone mapping processor. Therefore, if the IdP provider\ngenerates an attribute that contains a JSON with project definitions,\nwe are not able to handle it in Keystone properly.\n\nThis PR introduces a new property in the federated identity mapping\nschema called `projects_json` that can also be used as `projects.\nIn the schema, this property will accept a JSON string, that defines\nall of the projects and their specific roles that the user must\nreceive when login-in to the OpenStack platform. Moreover, when using\nthis extension, roles (assigned to projects) are added and removed\non the fly.\n\nThe extension is quite straight forward. We created a new\n``federation_attribute_mapping_schema_version`` version (3.0).\nThis new version enables the handling of `project_json` and `projects`\nin the attribute mapping that can contain a JSON string with the\nprojects assingment.\n\nFurthermore, we added code to handle the addition of extra roles for\nprojects and removal of roles that are present in OpenStack, but are\nnot in the IdP data. This is a mechanism to make the state of the\nOpenStack federated user consistent with the Identity provider user\nattributes.\n\n[1] https://bugs.launchpad.net/keystone/+bug/1887515\n\nImplements: https://bugs.launchpad.net/keystone/+bug/1888412\nCloses-Bug: #1888412\n\nDepends-On: https://review.opendev.org/#/c/739966/\n\nChange-Id: I585a0a15f739620d4f3a7a66e9d4cbc69469da8b\nSigned-off-by: Rafael Weingärtner \u003crafael@apache.org\u003e\n(cherry picked from commit e6a15ba337bbf7950e707b04bbbe3ea609b9a131)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/1b85bb4e6fa9c0966b303658811035d466faae95"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/1b85bb4e6fa9c0966b303658811035d466faae95"}]},"branch":"refs/heads/stable/2025.1"}},"requirements":[],"submit_records":[],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":["label:Code-Review\u003dMIN"],"failing_atoms":["label:Code-Review\u003dMAX"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}