)]}'
{"id":"openstack%2Fkeystone~990614","triplet_id":"openstack%2Fkeystone~stable%2F2025.2~I31a1f11a181c11be7de631faf414bfdaf29dac42","project":"openstack/keystone","branch":"stable/2025.2","topic":"fix/project-policy-null-domain-match-stable/2025.2","attention_set":{},"removed_from_attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-06-18 08:51:40.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"I31a1f11a181c11be7de631faf414bfdaf29dac42","subject":"Fix project policy allowing unauthorized access to root domains","status":"MERGED","created":"2026-05-29 08:55:21.000000000","updated":"2026-06-18 08:52:57.000000000","submitted":"2026-06-18 08:51:40.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":2,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"990614-fix/project-policy-null-domain-match-stable/2025.2","cherry_pick_of_change":973223,"cherry_pick_of_patch_set":2,"meta_rev_id":"e07257352daf00185e7040abd2e7f69cdf5b863e","_number":990614,"virtual_id_number":990614,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"value":0,"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-06-18 08:51:39.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"all":[{"value":2,"date":"2026-06-17 19:01:13.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"value":2,"date":"2026-06-17 17:06:46.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"all":[{"value":1,"date":"2026-06-17 19:01:13.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"value":0,"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"CC":[{"_account_id":9725,"name":"Dong Ma","email":"winterma.dong@gmail.com","username":"larainema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-29 08:55:21.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":9725,"name":"Dong Ma","email":"winterma.dong@gmail.com","username":"larainema"},"state":"CC"},{"updated":"2026-05-29 10:39:21.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-06-17 17:06:46.000000000","updated_by":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"reviewer":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"state":"REVIEWER"},{"updated":"2026-06-17 19:01:13.000000000","updated_by":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"reviewer":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"state":"REVIEWER"}],"messages":[{"id":"a93c9c72c44e6992af07566d4319707df9a2325e","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-29 08:55:21.000000000","message":"Patch Set 1: Cherry Picked from branch master.","accounts_in_message":[],"_revision_number":1},{"id":"f2b9699ded5de3e7c7ec3e82dbe9768a4447d190","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-29 10:39:21.000000000","message":"Patch Set 1: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/71162748cb2f4cf69408a511ed2bac0a\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/3cb23bf022f34a0abb262b1337ff0179 : SUCCESS in 11m 02s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/0d8012f330ac4a4488747fff50fd72c0 : SUCCESS in 3m 22s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/699f768aeda04918b789d160397f2456 : SUCCESS in 11m 39s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/a73bdafeabfe40af80ca7c30822e05d7 : SUCCESS in 13m 33s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/898e6c0cf211407cb69db1298599c56e : SUCCESS in 15m 58s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/547cec78efe244f5a13cd6f0a7d8ab90 : SUCCESS in 13m 13s\n- grenade https://zuul.opendev.org/t/openstack/build/21ca5245c65b42d78d7c5adcf8178b9b : SUCCESS in 1h 03m 44s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/8f6ce333bc424e689ffaab077f1a2703 : SUCCESS in 1h 41m 47s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/cf29435816594685b317b701dee22642 : SUCCESS in 12m 43s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/3f57b149a5c14aa0ba9d92072f595ae5 : SUCCESS in 17m 21s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/c59ec37e71894ea9967f0ff219396360 : SUCCESS in 29m 00s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/e736f3f9db13417b93b96d9f6934ef91 : FAILURE in 15m 42s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/38de6e718eda41fa8e7a26c08e7d76f5 : FAILURE in 24m 34s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/c909160430dd4f6ca1e2f10b9e4befbe : FAILURE in 24m 07s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/8f961a37afa3469b82354fe62d6f127a : FAILURE in 30m 42s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/83b362c8b6c34632a9a96f9fc9c5d68a : SUCCESS in 33m 07s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/2977154e59e441d5902970d8d2614aa9 : SUCCESS in 54m 55s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/0588d07a93654dc081ad0589755d9a58 : FAILURE in 38m 21s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/d6a871f73de946cbad27641f8f78dbd1 : FAILURE in 9m 33s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"26bf3e34551f4647bac2afa23cee942b47c008fd","author":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"date":"2026-06-17 17:06:46.000000000","message":"Patch Set 1: Code-Review+2","accounts_in_message":[],"_revision_number":1},{"id":"b118442c894abee4885e435002acd7d42c1b1c27","author":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"date":"2026-06-17 17:07:08.000000000","message":"Patch Set 1:\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"e780b88d527fed77b6f3241c4e458e39d452a5b2","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-17 18:51:58.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/ae5fc4696bc04ff2a3a91dd2c5ab909c\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/4525734898f34d079bc0081904392050 : SUCCESS in 18m 50s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/3cc7f457292a4bf784e535ef1f5595bc : SUCCESS in 6m 52s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/4fc8b3893fb94039a03d0a99aba9209b : SUCCESS in 11m 34s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/280a0cbbbbdd4b18b86735aada8d65ab : SUCCESS in 13m 11s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/5c1df295e19f4aa8a9ef076064015ab9 : SUCCESS in 17m 36s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/0773c4921d4b4692b2c7b5dc91738fd1 : SUCCESS in 13m 39s\n- grenade https://zuul.opendev.org/t/openstack/build/04263c5f2a894a808c52afcac2634cab : SUCCESS in 1h 36m 46s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/71545c8e57ac45d2ac38b99e26a4024c : SUCCESS in 1h 21m 10s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/201093729f55447fb172693fa6821095 : SUCCESS in 12m 30s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/1d6d39e6b56749e08fad83132c807105 : SUCCESS in 18m 45s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/a0f661fa8dae48779281222a06ac049d : SUCCESS in 24m 40s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/102ab731ceae4bfabfacb8426348f0e7 : FAILURE in 17m 07s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/28a8bedba62f45bd9a7d3a5334e09e77 : FAILURE in 21m 49s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/00206120401444a9955680e9b03d60f8 : SUCCESS in 12m 43s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/732922395307403da1057beca7839b6e : SUCCESS in 33m 22s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/07fecdad270c4f5bb93da132cf71f163 : SUCCESS in 36m 47s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/455e6c94851d4e27afead9f793f3cc17 : SUCCESS in 45m 52s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/4ae5c546df574ad7825793c4d1890e5c : SUCCESS in 32m 16s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/c29bd712270e4bb8b9b9193437c30a9f : FAILURE in 8m 43s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"2d7c566b885ced1e2e911571c424a45df05ea2e3","author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"date":"2026-06-17 19:01:13.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"a4f74e4ddb5e18c9bb513b6a75b4d46995a68600","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-17 19:01:44.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"ff8c87149fb13c8a62873de8a13ab29ac4689b6f","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-17 21:04:15.000000000","message":"Patch Set 1: Verified-2\n\nBuild failed (gate pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\n\nhttps://zuul.opendev.org/t/openstack/buildset/012718a3b04f465189a5b85bcf5da219\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/4cb8e9b872e542d898cd8fd67727a1c2 : SUCCESS in 6m 11s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/14adf7dbacd0425ba4af912e8d9cc5ab : SUCCESS in 15m 49s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/67094e8007884dc69f89a3c6b36e0484 : SUCCESS in 12m 31s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/3cf09d83061942cfa57493febbea3e3e : SUCCESS in 14m 41s\n- grenade https://zuul.opendev.org/t/openstack/build/a0a0039fddb04f189f3dc7e8a0aa8f56 : SUCCESS in 51m 01s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/14a630bc505e487f81f69b55e624ba6d : SUCCESS in 1h 22m 32s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/e48e11d769cc4373b955418b7d5950c9 : SUCCESS in 16m 44s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/3b3806f370644107bf8e2fa9fff20cbb : SUCCESS in 20m 00s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/eb42374891ab4346af9654b0fe3bf037 : SUCCESS in 14m 20s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/e951bd2557dd4310883f434b42016c49 : SUCCESS in 56m 57s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/4a12975c7b7147499a588d7d8670bd6c : FAILURE in 42m 23s","accounts_in_message":[],"_revision_number":1},{"id":"f0efac37a46b874e400766e770d4a3dcf2e62482","author":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"},"date":"2026-06-18 05:09:35.000000000","message":"Patch Set 1:\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"8a5dd9eba238f737e4fa5c62061a9ae4a812f2a4","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-18 07:00:43.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/1fc5a4ea72314382b6984ff82560b315\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/5edfaffe63004feb90d7f34cbd89c0bd : SUCCESS in 18m 54s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/a0342538d25a469e934ccc0c9172cbc0 : SUCCESS in 6m 57s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/bf5b92d7d23b4495b62216df253f558c : SUCCESS in 11m 48s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/deb11062e9e54ded9285780329dd3211 : SUCCESS in 12m 18s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/30179cdec17e40dab9eebb3280825c25 : SUCCESS in 9m 12s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/9d98b585896047b1b22280579f6e4b17 : SUCCESS in 7m 05s\n- grenade https://zuul.opendev.org/t/openstack/build/746c3904b875430cbcab5f5cb6e50ed7 : SUCCESS in 58m 13s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/c18ea0dca8944c50bc0ce50d31dbfaee : SUCCESS in 1h 45m 42s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/14ba0445e2b649f5af66c6a4fccaf05b : SUCCESS in 13m 19s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/13ccb575fb664c45b23902e5e5608ba3 : SUCCESS in 8m 57s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/ae9ccb3e344a4cdbb5ffccf7bfcbca6c : SUCCESS in 28m 04s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/31cb9b3482e64c389c5bbfb934a21c15 : FAILURE in 18m 42s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/dd9cfb73ab2246aa9ecc176ae1b76c2f : FAILURE in 12m 19s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/3b0c45128235487795ce33279a18b770 : SUCCESS in 19m 04s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/b5adbc44269b49698bdbeda76ba3d7d5 : SUCCESS in 19m 27s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/c21ebf340ee3423887c3a74bee93b1c9 : SUCCESS in 19m 47s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/f3dba41f54e94d739b335bec1356daab : SUCCESS in 55m 00s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/8d552c83f2c340659b67597dd2b1c634 : SUCCESS in 19m 38s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/15437179a78e42d5b6f703964235c2c2 : FAILURE in 4m 08s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"cd6bceb5bc4b9ef55c1cf3feb6c46fb0c4e78455","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-18 07:01:09.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"29cae8285dc1e126f47cf3f42a25cdc36b633b2d","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-18 08:51:39.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/ed0727eb87da4cf1a691f45e5ccae0c6\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/b2db08cd598a465ebf02db430989e142 : SUCCESS in 6m 13s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/ccb64ec9db90404a955fa830fa648eaa : SUCCESS in 13m 48s\n- openstack-tox-py312 https://zuul.opendev.org/t/openstack/build/767e22d72e044a75b3758f3d802a44e9 : SUCCESS in 7m 21s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/b39898f9fe4a4c48af8b0ae765abe081 : SUCCESS in 10m 16s\n- grenade https://zuul.opendev.org/t/openstack/build/abe86dace3444d9aae81e8b30188e7b7 : SUCCESS in 1h 05m 12s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/a71712e419d84842a6756b0670085065 : SUCCESS in 1h 45m 46s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/605b9f77cb4247a1a44d807dd9002240 : SUCCESS in 13m 22s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/83105dc18e3e47e391118395c935dc38 : SUCCESS in 30m 36s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/73d15502e21f45a689aaab82a95193b7 : SUCCESS in 29m 41s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/dfc5c11d634d400c8473be1518b33ec4 : SUCCESS in 1h 00m 23s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/8d6d6749d90545ad91781ea1630dd6ea : SUCCESS in 40m 23s","accounts_in_message":[],"_revision_number":1},{"id":"3fd42342540a3c5815dbe812edc8c956ed86dc7f","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-18 08:51:40.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1},{"id":"e07257352daf00185e7040abd2e7f69cdf5b863e","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-18 08:52:57.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/a3ddd00deeff4110991cb9cb6fe97fff\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/dc4d57be40314cfdb79e0b276b3aa3a6 : SUCCESS in 1m 01s","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"96466c2210f8ef01d126a0c3eb45cdf56c2263dc","revisions":{"96466c2210f8ef01d126a0c3eb45cdf56c2263dc":{"kind":"REWORK","_number":1,"created":"2026-05-29 08:55:21.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/14/990614/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/14/990614/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/14/990614/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/14/990614/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/14/990614/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/14/990614/1"}}},"commit":{"parents":[{"commit":"b433d009eaa6287f398cbca27e97c01cac77de58","subject":"Merge \"Enforce app cred project boundary on EC2 credential paths\" into stable/2025.2","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/b433d009eaa6287f398cbca27e97c01cac77de58"}]}],"author":{"name":"Dong Ma","email":"winterma.dong@gmail.com","date":"2026-01-13 12:19:42.000000000","tz":480},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-05-29 08:55:21.000000000","tz":0},"subject":"Fix project policy allowing unauthorized access to root domains","message":"Fix project policy allowing unauthorized access to root domains\n\nThe project policy rules using domain_id matching were vulnerable to\na None \u003d\u003d None match condition. When a user has a project-scoped token\n(domain_id \u003d None in credentials) and the target is a root domain\n(domain_id \u003d null), the policy check would incorrectly pass.\n\nThis allowed any user with a reader/admin/manager role on any project\nto access details of root domains (projects with is_domain\u003dtrue and\ndomain_id\u003dnull), such as the default domain.\n\nThe fix adds an explicit check to ensure the target project domain_id\nis not null, preventing the accidental None \u003d\u003d None match. This follows\nthe same pattern used in grant.py for handling null domain_id values.\n\nAffected policy rules:\n- SYSTEM_READER_OR_DOMAIN_READER_OR_PROJECT_USER\n- SYSTEM_ADMIN_OR_DOMAIN_ADMIN_OR_PROJECT_ADMIN\n- ADMIN_OR_DOMAIN_MANAGER\n\nCloses-Bug: #2138295\nChange-Id: I31a1f11a181c11be7de631faf414bfdaf29dac42\nSigned-off-by: Dong Ma \u003cwinterma.dong@gmail.com\u003e\n(cherry picked from commit 57a0a59cce0aad4fdd9d42390ee61c8c28f16590)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/96466c2210f8ef01d126a0c3eb45cdf56c2263dc"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/96466c2210f8ef01d126a0c3eb45cdf56c2263dc"}]},"branch":"refs/heads/stable/2025.2","conflicts":{"ours":"b433d009eaa6287f398cbca27e97c01cac77de58","theirs":"57a0a59cce0aad4fdd9d42390ee61c8c28f16590","contains_conflicts":false}}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":7973,"name":"Douglas Mendizábal","email":"dmendiza@redhat.com","username":"dougmendizabal"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}