)]}'
{"id":"openstack%2Fkeystone~990500","triplet_id":"openstack%2Fkeystone~stable%2F2025.1~Iaaa0ec713a0a5e062acc3209d6010982899d8f6f","project":"openstack/keystone","branch":"stable/2025.1","attention_set":{},"removed_from_attention_set":{"17685":{"account":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"last_update":"2026-06-12 15:28:03.000000000","reason":"Change was submitted"},"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-06-12 15:28:03.000000000","reason":"Change was submitted"},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-06-12 15:28:03.000000000","reason":"Change was submitted"}},"hashtags":["CVE-2026-43001"],"change_id":"Iaaa0ec713a0a5e062acc3209d6010982899d8f6f","subject":"Enforce delegation project boundary for delegated tokens","status":"MERGED","created":"2026-05-28 15:06:35.000000000","updated":"2026-06-12 15:30:44.000000000","submitted":"2026-06-12 15:28:03.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":2,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"990500","meta_rev_id":"49cf41492b13e159e9914931942ae808b7601ef4","_number":990500,"virtual_id_number":990500,"owner":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-06-12 15:28:03.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":2,"date":"2026-06-11 10:52:23.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":2,"date":"2026-06-02 15:12:46.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"all":[{"value":1,"date":"2026-06-11 10:52:23.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"}],"reviewers":{"REVIEWER":[{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"CC":[{"_account_id":9545,"name":"Andriy Kurilin","email":"andr.kurilin@gmail.com","username":"akurilin"},{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-28 15:06:35.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2026-05-28 16:48:54.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-06-11 14:00:48.000000000","updated_by":{"_account_id":9545,"name":"Andriy Kurilin","email":"andr.kurilin@gmail.com","username":"akurilin"},"reviewer":{"_account_id":9545,"name":"Andriy Kurilin","email":"andr.kurilin@gmail.com","username":"akurilin"},"state":"CC"},{"updated":"2026-06-12 12:14:13.000000000","updated_by":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"reviewer":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"state":"CC"},{"updated":"2026-06-12 12:18:44.000000000","updated_by":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"reviewer":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"state":"REVIEWER"}],"messages":[{"id":"8a09a49aa6df254048a48a796df6ef7234112b60","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-05-28 15:06:35.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"42f24012760de48bb6c0c8e66f4e854fcfa68a20","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 16:48:54.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/08c1c8fba44f4830b97fab77e6a86e3c\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/7f8c5c7c6a1342c190e827485ef34d34 : SUCCESS in 20m 19s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/ca8be09440234e26a7edf8636916e452 : FAILURE in 7m 27s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/e68712aac51341e0b9039707fcb74062 : SUCCESS in 12m 34s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/0f65a8059b07443c9c97604e986dffcd : SUCCESS in 12m 24s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/2108fe84cc774b8c999b397517d8e1cc : SUCCESS in 10m 41s\n- grenade https://zuul.opendev.org/t/openstack/build/5731b2db044142449ae77a09a62a6dc1 : FAILURE in 41m 33s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/56767eba70fb49ebad67248130ad6bb0 : SUCCESS in 1h 18m 22s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/172236e686dd40f8a9542552cff19936 : SUCCESS in 12m 51s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/651baed0f27a41979c4dd033617c4ca3 : SUCCESS in 30m 10s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/6fbb2b17a06646ef8abb4ebd2fac598a : FAILURE in 39m 21s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/1070867ddcff4087afe7ef4787b3e0ee : FAILURE in 18m 42s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/ac295185f9fc4e668ec105e41218d40a : FAILURE in 29m 35s (non-voting)\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/d91a4e6f80304cd8bdeaa4e275e6de7f : SUCCESS in 18m 21s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/8747b4dd84d64358ac6b7ad82389ea25 : SUCCESS in 27m 27s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/0eafb5442525487a95cc4a4f96d58a5a : SUCCESS in 43m 09s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/a6933f15833043eca840e4e028adc1d4 : FAILURE in 9m 27s (non-voting)\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/f31f23c7fa1f4793b5b4e8c7806842e9 : FAILURE in 35m 01s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"36326908f56d0c2188e7dc80ddbe7b9239add64c","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-28 21:58:26.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"6f5b580677f870bcb1f176907265770d17509470","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-28 23:43:07.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/a3811a7fad8140a8a8a4aca0a31d2c59\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/9283c9506a7746ee991c7a14118c956b : SUCCESS in 17m 36s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/2e55533bcf85481283255be9d5800e64 : SUCCESS in 4m 01s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/cf9d65c13aee4f01bcb86f94d52b66e6 : SUCCESS in 12m 12s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/fc7ccbab571b4ef38dde6fd2d5825018 : SUCCESS in 8m 29s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/72d0427d7d314c35878d74c83f8ceb37 : SUCCESS in 15m 02s\n- grenade https://zuul.opendev.org/t/openstack/build/a992d9d023fa4a36a323481a42638a6f : SUCCESS in 49m 30s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/3b376576169a4639bb7176cf2f5e8290 : SUCCESS in 1h 33m 05s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/6614be8b2aad4b09aed7b587dead91b0 : SUCCESS in 13m 40s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/0483cc94a9ff41d6bd0494300b0cd148 : SUCCESS in 32m 14s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/0a3ffa5d830a4bc3ba120dd234d79d01 : FAILURE in 37m 35s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/3f9edad1b04349d3a4a70fbb092609bb : FAILURE in 18m 03s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/ad9974132e9b49508bce111de3d695fe : FAILURE in 29m 58s (non-voting)\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/cf1f83a7b2dd47c68436b8e7e4b7fa89 : SUCCESS in 10m 34s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/a559e09010d54aec9c773d34d18dc512 : SUCCESS in 35m 26s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/6de4171f0fd14f9cbc75b472a55d4f7e : SUCCESS in 1h 02m 42s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/61c5c0b664504e2ebc3235429af1c828 : FAILURE in 9m 03s (non-voting)\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/669db37d885e4648a2dbb3b5f93abde8 : FAILURE in 28m 13s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"2f04652adcdad4f8bb73a25f4211ca50095bd5ae","tag":"autogenerated:gerrit:setHashtag","author":{"_account_id":16643,"name":"Goutham Pacha Ravi","email":"gouthampravi@gmail.com","username":"gouthamr"},"date":"2026-05-29 06:39:09.000000000","message":"Hashtag added: CVE-2026-43001","accounts_in_message":[],"_revision_number":2},{"id":"13aed91516ba203ff0a486cf5476f35b9ad0af38","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-06-02 15:12:46.000000000","message":"Patch Set 2: Code-Review+2","accounts_in_message":[],"_revision_number":2},{"id":"29672e87a7b0bf4d63feb2437ba840ec76ad7c55","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-06-11 10:52:23.000000000","message":"Patch Set 2: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":2},{"id":"ba8c88d8a6b8407b726abaea42f8394899b1b877","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-11 10:53:29.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"48d64148a09f2137135edbffe307977dec1d475c","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-11 11:53:46.000000000","message":"Patch Set 2: Verified-2\n\nBuild failed (gate pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\nhttps://zuul.opendev.org/t/openstack/buildset/b555128f83f04fec87b0c80e1149d861\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/9f2961f8a3a940aeb09ea75517afcd50 : SUCCESS in 9m 33s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/64c7cb795acc476a8162d10365cd059d : SUCCESS in 14m 24s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/667fca1f3c7144c9ab62004f16ca7b17 : SUCCESS in 14m 11s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/bfc0601f50e04487899a30ea1741bbcc : SUCCESS in 14m 50s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/fc623a4a8a03485a9fec55b1a348c29d : SUCCESS in 12m 02s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/3f7da9a6996a4c60b352e37a2e007536 : SUCCESS in 25m 00s\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/b2103e6203c9458188de0b002ca0d1d1 : FAILURE in 29m 46s (non-voting)\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/9bb9972a033743baa1a66aed159b5231 : FAILURE in 20m 13s\n- grenade https://zuul.opendev.org/t/openstack/build/cab806105748409ea8d837dee100ee03 : FAILURE in 52m 45s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/b4a568353d8248318c22d6bd7117e79c : FAILURE in 31m 55s","accounts_in_message":[],"_revision_number":2},{"id":"4d29fb8f2ed266a26980dc86faf85e87a0e4f4f1","author":{"_account_id":9545,"name":"Andriy Kurilin","email":"andr.kurilin@gmail.com","username":"akurilin"},"date":"2026-06-11 14:00:48.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"8de371e5b8129636814446c5e2b32fa07034dfac","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-11 15:01:40.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/cac1575602b14c59a4abc6d4e717951b\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/145f95e93e044b49ac1841c0c5af84d1 : SUCCESS in 16m 39s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/769215ff3b7d4672b359454bf926e0b0 : SUCCESS in 9m 47s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/767cc8a5d18d4a79a6c1d045d8570654 : SUCCESS in 12m 40s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/ba6e8d1cbc5b430f889d4e112247ee50 : SUCCESS in 12m 43s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/c1a8c3004cf74ebb857f9d7b109ee807 : SUCCESS in 14m 03s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/9254d6f866f04955a1c2079b34f49376 : SUCCESS in 14m 41s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/2d518cf360e9480886f5af7684541553 : SUCCESS in 31m 40s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/22a54bb2c43e45fe88c63dfdc46293af : FAILURE in 35m 13s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/72cc0051a6a240bba9f2cbcfb7cf5809 : FAILURE in 26m 59s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/3750cdf069ab43648f2452e18d93ae41 : FAILURE in 27m 46s (non-voting)\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/364801a1259e48209142200821e9f143 : SUCCESS in 18m 54s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/dc29521a504f46c1bd6229fddb9540d7 : SUCCESS in 34m 36s (non-voting)\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/cad87dbf38ca4a329d453d8ef7918214 : FAILURE in 29m 15s\n- grenade https://zuul.opendev.org/t/openstack/build/4a3d2a031d374e50a409712f5b47a6d9 : FAILURE in 53m 02s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/ec2beb9eb7fc4972a889d51b03d63c1a : FAILURE in 12m 31s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/d472b3d4e9c844238936b02caba153d0 : FAILURE in 6m 44s (non-voting)\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/bf8a450cc5324078be67637952bb4ac3 : SUCCESS in 32m 52s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"d85ead87ba1d1ce101eac311f9c4eb9f9830863d","author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"date":"2026-06-12 12:14:13.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"d08a6016de4e75e27fbe5468869ee8d6ce3d988d","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-12 13:23:44.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/5e560aca6c4b4d46b425a1e1e8d734fa\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/45c41bdc3aba4eaab1216a39bed8369d : SUCCESS in 20m 38s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/8b216ae607904d2d87d7b2940fb14eac : SUCCESS in 8m 59s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/aa10e9f799944ff39091688006530368 : SUCCESS in 10m 23s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/e3f9d84775414be2a8c9374965b5a220 : SUCCESS in 12m 05s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/da1ba1f1a6a0462b9ac847345abdc61b : SUCCESS in 14m 31s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/2ff97428fbec45d3b9c470ab26ed1a98 : SUCCESS in 13m 47s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/da8a3452eb174507831088b080938939 : SUCCESS in 17m 49s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/4fd3fb1c2c744c37846f88e347b875b1 : FAILURE in 37m 03s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/7fa6efb906464fc4897f4098d030606a : FAILURE in 24m 45s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/8cfa48a39807449292dacdfc30b7616b : SUCCESS in 30m 03s (non-voting)\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/f04ab43723c54e67995981693a91d8c2 : SUCCESS in 18m 02s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/19052ce6cece4b838cbadc2a5a287b8b : SUCCESS in 24m 19s (non-voting)\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/0bd6f36663744398a9e41eea2fefc39b : SUCCESS in 57m 54s\n- grenade https://zuul.opendev.org/t/openstack/build/8b0f860cefcf41f98b100b9d1f4a416c : FAILURE in 44m 50s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/989ae5b61fbf44768c560a2f0065185c : SUCCESS in 1h 00m 27s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/7203d4bd977c419b949aeb1e435eb9f2 : FAILURE in 6m 39s (non-voting)\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/ef5f4e8ee9894cec89186acf5a7332c4 : SUCCESS in 27m 39s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"cea2ff083495eaf3650fa2caf86329f50fdd1161","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-12 13:24:24.000000000","message":"Patch Set 2: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":2},{"id":"372dd496e5ac5536d0d5e6adb1a2cd480db2584b","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-12 15:28:03.000000000","message":"Patch Set 2: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/06db9c2ccfdb4b27a19186fbc08e32bf\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/18f2ec69c72b47d3b25ddc1e9911aada : SUCCESS in 7m 13s\n- openstack-tox-py39 https://zuul.opendev.org/t/openstack/build/815f3e2c1bf5488d90ede829d175dee0 : SUCCESS in 7m 43s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/f7203c99f61d4877b90f094dfd140a69 : SUCCESS in 13m 07s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/61cd873b6a774891afc8718d8d14033e : SUCCESS in 13m 34s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/4aff997f170145e79fec30f3b1c927e2 : SUCCESS in 6m 30s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/fe2d7fe1f9024c71b6c0904f613604bd : SUCCESS in 13m 51s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/40447eaa850248558f9532066938e0e6 : SUCCESS in 1h 37m 54s\n- grenade https://zuul.opendev.org/t/openstack/build/7e3c9c4aad61411b8fa6e71bf462ce49 : FAILURE in 25m 48s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/1eee9f687bcf40d99e26bfc33e42666b : SUCCESS in 32m 11s","accounts_in_message":[],"_revision_number":2},{"id":"56a80a2157349477a41978c898caf0f8aa965184","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-12 15:28:03.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":2},{"id":"49cf41492b13e159e9914931942ae808b7601ef4","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-12 15:30:44.000000000","message":"Patch Set 2:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/5ea7cfd3ec78477bad4c99df7560070f\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/b89454ca17a8404182d97cb245ac8466 : SUCCESS in 1m 00s\n- promote-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/23a11c3b97fc4d238e9538b83ce33d07 : SUCCESS in 1m 34s","accounts_in_message":[],"_revision_number":2}],"current_revision_number":2,"current_revision":"1b27d289f213dcbc9cfa1665cc0433e2fbf15dfa","revisions":{"5c6287679b6499d189bac275daaad5346a54e276":{"kind":"REWORK","_number":1,"created":"2026-05-28 15:06:35.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/00/990500/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/00/990500/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/00/990500/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/00/990500/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/00/990500/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/00/990500/1"}}},"commit":{"parents":[{"commit":"53af4f758e84a617d7a8522ebaf79937a67c5e4b","subject":"Merge \"Enforce app cred project boundary on EC2 credential paths\" into stable/2025.1","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/53af4f758e84a617d7a8522ebaf79937a67c5e4b"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-04-23 08:13:20.000000000","tz":120},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-05-22 08:23:07.000000000","tz":120},"subject":"Enforce delegation project boundary for delegated tokens","message":"Enforce delegation project boundary for delegated tokens\n\nDelegated tokens (trusts, application credentials, OAuth1 access tokens)\nare scoped to a single project at delegation time. This must be enforced\nthoroughly while granting the API access to Keystone resources that\nmight be also bound to a single project. Without this it is possible to\ngain different access (using trust to see application credentials for a\ndifferent project, reuse the MFA seed, etc).\n\n* Credentials CRUD (/v3/credentials)\n\n  All five CRUD operations verified ownership via user_id but did not bind\n  credential.project_id to the delegating token\u0027s project scope.\n\n  Fix: _check_credential_project_scope() - no-op for non-delegated tokens,\n  raises ForbiddenAction on project mismatch. For list, out-of-scope\n  credentials are silently filtered.\n\n  Credentials with project_id\u003dNone (TOTP/MFA bindings) are treated as\n  out-of-scope for any delegated token: they are user-level secrets with no\n  project anchor, and a delegated token should never be able to enumerate,\n  read, or mutate them - doing so would allow a stolen delegation token to\n  exfiltrate or destroy a user\u0027s MFA binding.\n\n* OS-EC2 credential CRUD (/v3/users/{id}/credentials/OS-EC2)\n\n  POST accepted any tenant_id from a delegated token. GET and DELETE had\n  no delegation check at all.\n\n  Fix: _check_delegation_for_ec2() enforces the project boundary;\n  list silently filters.\n\n  Additionally, pre-existing OAuth1 access-token-backed EC2 credentials\n  with a mismatched project_id could be used at auth-time (POST /v3/ec2tokens)\n  to obtain a cross-project token. Added a check in EC2_S3_Resource.py that\n  cred_data[\u0027project_id\u0027] matches access_token[\u0027project_id\u0027] before issuing\n  the token. The trust branch does not need this check - the token provider\n  uses the trust\u0027s project regardless of the credential\u0027s project_id.\n\n* OS-OAUTH1 access token management (/v3/users/{id}/OS-OAUTH1/access_tokens)\n\n  GET and DELETE had no delegation check. List blocked trust/OAuth but not\n  app-cred tokens.\n\n  Fix: _block_delegated_token() raises Forbidden for any delegation type\n  on list, get, and delete.\n\n* Application credential management (/v3/users/{id}/application_credentials)\n\n  Trust-scoped and OAuth1 tokens had no guard on the application credential\n  and access rule management APIs. An impersonating trust could LIST, CREATE,\n  or DELETE application credentials, creating a persistent backdoor that\n  outlives the trust\u0027s own expiry. App credential tokens are intentionally\n  excluded - the unrestricted/restricted distinction is handled separately by\n  _check_unrestricted_application_credential.\n\n  Fix: _block_delegated_token_app_creds() raises Forbidden for trust-scoped\n  and OAuth1 tokens on all six app credential and access rule endpoints.\n\nCloses-Bug: #2150089\nRelated-Bug: #2149789\nRelated-Bug: #2149775\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nChange-Id: Iaaa0ec713a0a5e062acc3209d6010982899d8f6f\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit 16582e5192be354e26ebef4badca1213ddc4dc07)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/5c6287679b6499d189bac275daaad5346a54e276"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/5c6287679b6499d189bac275daaad5346a54e276"}]},"branch":"refs/heads/stable/2025.1"},"1b27d289f213dcbc9cfa1665cc0433e2fbf15dfa":{"kind":"REWORK","_number":2,"created":"2026-05-28 21:58:26.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/00/990500/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/00/990500/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/00/990500/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/00/990500/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/00/990500/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/00/990500/2"}}},"commit":{"parents":[{"commit":"53af4f758e84a617d7a8522ebaf79937a67c5e4b","subject":"Merge \"Enforce app cred project boundary on EC2 credential paths\" into stable/2025.1","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/53af4f758e84a617d7a8522ebaf79937a67c5e4b"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-04-23 08:13:20.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-28 21:57:05.000000000","tz":120},"subject":"Enforce delegation project boundary for delegated tokens","message":"Enforce delegation project boundary for delegated tokens\n\nDelegated tokens (trusts, application credentials, OAuth1 access tokens)\nare scoped to a single project at delegation time. This must be enforced\nthoroughly while granting the API access to Keystone resources that\nmight be also bound to a single project. Without this it is possible to\ngain different access (using trust to see application credentials for a\ndifferent project, reuse the MFA seed, etc).\n\n* Credentials CRUD (/v3/credentials)\n\n  All five CRUD operations verified ownership via user_id but did not bind\n  credential.project_id to the delegating token\u0027s project scope.\n\n  Fix: _check_credential_project_scope() - no-op for non-delegated tokens,\n  raises ForbiddenAction on project mismatch. For list, out-of-scope\n  credentials are silently filtered.\n\n  Credentials with project_id\u003dNone (TOTP/MFA bindings) are treated as\n  out-of-scope for any delegated token: they are user-level secrets with no\n  project anchor, and a delegated token should never be able to enumerate,\n  read, or mutate them - doing so would allow a stolen delegation token to\n  exfiltrate or destroy a user\u0027s MFA binding.\n\n* OS-EC2 credential CRUD (/v3/users/{id}/credentials/OS-EC2)\n\n  POST accepted any tenant_id from a delegated token. GET and DELETE had\n  no delegation check at all.\n\n  Fix: _check_delegation_for_ec2() enforces the project boundary;\n  list silently filters.\n\n  Additionally, pre-existing OAuth1 access-token-backed EC2 credentials\n  with a mismatched project_id could be used at auth-time (POST /v3/ec2tokens)\n  to obtain a cross-project token. Added a check in EC2_S3_Resource.py that\n  cred_data[\u0027project_id\u0027] matches access_token[\u0027project_id\u0027] before issuing\n  the token. The trust branch does not need this check - the token provider\n  uses the trust\u0027s project regardless of the credential\u0027s project_id.\n\n* OS-OAUTH1 access token management (/v3/users/{id}/OS-OAUTH1/access_tokens)\n\n  GET and DELETE had no delegation check. List blocked trust/OAuth but not\n  app-cred tokens.\n\n  Fix: _block_delegated_token() raises Forbidden for any delegation type\n  on list, get, and delete.\n\n* Application credential management (/v3/users/{id}/application_credentials)\n\n  Trust-scoped and OAuth1 tokens had no guard on the application credential\n  and access rule management APIs. An impersonating trust could LIST, CREATE,\n  or DELETE application credentials, creating a persistent backdoor that\n  outlives the trust\u0027s own expiry. App credential tokens are intentionally\n  excluded - the unrestricted/restricted distinction is handled separately by\n  _check_unrestricted_application_credential.\n\n  Fix: _block_delegated_token_app_creds() raises Forbidden for trust-scoped\n  and OAuth1 tokens on all six app credential and access rule endpoints.\n\nCloses-Bug: #2150089\nRelated-Bug: #2149789\nRelated-Bug: #2149775\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nChange-Id: Iaaa0ec713a0a5e062acc3209d6010982899d8f6f\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\nSigned-off-by: Artem Goncharov \u003cartem.goncharov@gmail.com\u003e\n(cherry picked from commit 16582e5192be354e26ebef4badca1213ddc4dc07)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/1b27d289f213dcbc9cfa1665cc0433e2fbf15dfa"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/1b27d289f213dcbc9cfa1665cc0433e2fbf15dfa"}]},"branch":"refs/heads/stable/2025.1"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}