)]}'
{"id":"openstack%2Fkeystone~990617","triplet_id":"openstack%2Fkeystone~stable%2F2026.1~Ic70d4756c121e3f096c372ee9b6f5314838e66de","project":"openstack/keystone","branch":"stable/2026.1","attention_set":{},"removed_from_attention_set":{"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-05-29 12:04:53.000000000","reason":"\u003cGERRIT_ACCOUNT_27900\u003e replied on the change","reason_account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}}},"hashtags":[],"change_id":"Ic70d4756c121e3f096c372ee9b6f5314838e66de","subject":"Add audience mapper to devstack Keycloak client","status":"MERGED","created":"2026-05-29 09:29:30.000000000","updated":"2026-05-29 14:58:32.000000000","submitted":"2026-05-29 14:57:13.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"990617","cherry_pick_of_change":989615,"cherry_pick_of_patch_set":1,"meta_rev_id":"f643c02ab0a1894fd2ee5f2d4d15a1cd53354a17","_number":990617,"virtual_id_number":990617,"owner":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-05-29 14:57:12.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"all":[{"value":2,"date":"2026-05-29 12:02:54.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},{"value":2,"date":"2026-05-29 10:00:54.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"all":[{"value":0,"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},{"value":0,"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":1,"date":"2026-05-29 12:04:53.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"CC":[{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"}],"REVIEWER":[{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-29 09:29:30.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"state":"CC"},{"updated":"2026-05-29 10:00:54.000000000","updated_by":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2026-05-29 11:39:42.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-05-29 12:02:54.000000000","updated_by":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"reviewer":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"state":"REVIEWER"}],"messages":[{"id":"f7c96bd5a44b4fb36aff4269fe055f5d8f145f14","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-05-29 09:29:30.000000000","message":"Patch Set 1: Cherry Picked from branch master.","accounts_in_message":[],"_revision_number":1},{"id":"6e1e244001d4c92af4a7a4534d2763447a2b6b02","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-05-29 10:00:54.000000000","message":"Patch Set 1: Code-Review+2","accounts_in_message":[],"_revision_number":1},{"id":"155edf2117b9b15b59dff0c57c01807b4e6740a3","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-29 11:39:42.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/b1f5cedf692844db939dfdc88e76a6b2\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/d42e0e60acf54453a8af11455254cefc : SUCCESS in 17m 48s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/1a10f5327d3e4c93a8ba094d3ba9f3b6 : SUCCESS in 5m 00s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/a8c19bfaf4284b6793ac607b1bc50795 : SUCCESS in 10m 18s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/a9eb4e1fc2c1400bbb290b9b9ad35fac : SUCCESS in 14m 02s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/b412346d4d6f4a80ae42f80b869cf7b0 : SUCCESS in 14m 52s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/6f86de8c8d57451f8d5e34d1ddb403c0 : SUCCESS in 14m 50s\n- grenade https://zuul.opendev.org/t/openstack/build/cdbbaea05e934492abced1c19de21a6b : SUCCESS in 1h 09m 45s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/2c209eb0273846ddbb13f3554b5a136a : SUCCESS in 2h 03m 23s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/866b952d1fd6470388d0c6abbe978328 : SUCCESS in 12m 28s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/253cb17b0a8a46b5b5a3e342cfab29d4 : SUCCESS in 9m 26s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/e4230eebd2da450db75fab755de73cee : SUCCESS in 33m 40s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/2100dc2306cb4d5bb3ac2cd8eafc7c24 : FAILURE in 11m 40s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/634f27f136904120b907a5cbd75520e9 : FAILURE in 25m 40s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/ba608ab9cb694faf91cb8f99ea20d6e4 : SUCCESS in 31m 11s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/32cd68562ef2419d9503aef0d61e040d : SUCCESS in 33m 34s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/db281b799f644384aa1310049d8bced6 : SUCCESS in 34m 06s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/1bf49a459fbd41febc39c906bbd98328 : SUCCESS in 1h 12m 32s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/357d1aa41efc48a4b970e862e066b605 : SUCCESS in 51m 01s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/caeed321a5be49258ca860fe4d0604f3 : SUCCESS in 8m 21s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"360298325539fa6d0d0d009173b0a2b7dcc824e1","author":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"},"date":"2026-05-29 12:02:54.000000000","message":"Patch Set 1: Code-Review+2\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"2c1f881f2a9e9795de5fcff078b10b1a22463d00","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-05-29 12:04:53.000000000","message":"Patch Set 1: Workflow+1","accounts_in_message":[],"_revision_number":1},{"id":"ec6deaca480db4e57143e093e29719a1cae4252b","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-29 12:06:03.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"dd744372b90b35a066012eb778db23b070bae438","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-29 14:57:12.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/ec62a8b4cf724b09b6e6e5a506c38b49\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/a78b4ee864a44d7280a2986019a4adb9 : SUCCESS in 5m 08s\n- openstack-tox-py310 https://zuul.opendev.org/t/openstack/build/377a6b3d8ad64b38a0d58ca97ce964b8 : SUCCESS in 15m 41s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/f6df853e53af4d5e8f05e032521c6b1e : SUCCESS in 11m 33s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/a66b5c0e44674343ab2247eb177e3f63 : SUCCESS in 13m 19s\n- grenade https://zuul.opendev.org/t/openstack/build/272f21545ef0458ca3c34b998493a809 : SUCCESS in 1h 28m 09s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/1a615349a9f948af8561096151dc2562 : SUCCESS in 1h 45m 58s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/d9ed68f8f85d435e9ef7b0e453cc3e4c : SUCCESS in 12m 22s\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/91aa32dc4ed34f5f982cf1cbbfb1f30e : SUCCESS in 12m 17s\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/d70976b6d0b2474d8d1b9460e1a63d20 : SUCCESS in 30m 07s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/091f31f621b24c4c8c93d3b49e973365 : SUCCESS in 30m 50s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/cd0d4f09198b4557b6c826ace2f44d68 : SUCCESS in 27m 20s","accounts_in_message":[],"_revision_number":1},{"id":"ea4ff54153c2910198173d83a85c535a2d72ffe7","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-29 14:57:13.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1},{"id":"f643c02ab0a1894fd2ee5f2d4d15a1cd53354a17","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-29 14:58:32.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/ee0d45bf7c9d4e1a8521526a58fd2ddd\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/3368223c614947d1a84fab2c9b374409 : SUCCESS in 1m 04s","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"fff1fa51695be6cd6aeb68d76ba0ab74c5e3d652","revisions":{"fff1fa51695be6cd6aeb68d76ba0ab74c5e3d652":{"kind":"REWORK","_number":1,"created":"2026-05-29 09:29:30.000000000","uploader":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"ref":"refs/changes/17/990617/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/17/990617/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/17/990617/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/17/990617/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/17/990617/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/17/990617/1"}}},"commit":{"parents":[{"commit":"635914a6a8a9fb3b172fc15528608df2d091036b","subject":"Block app cred tokens from authorizing OAuth1 requests","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/635914a6a8a9fb3b172fc15528608df2d091036b"}]}],"author":{"name":"Boris Bobrov","email":"b.bobrov@sap.com","date":"2026-05-21 20:19:22.000000000","tz":120},"committer":{"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","date":"2026-05-29 09:29:30.000000000","tz":0},"subject":"Add audience mapper to devstack Keycloak client","message":"Add audience mapper to devstack Keycloak client\n\nKeycloak 26.6.2 fixed CVE-2026-37979 by requiring the authenticated\nclient at the OAuth2 token introspection endpoint to be listed in the\nintrospected token\u0027s \"aud\" claim. The devstack OIDC plugin uses the\n\"devstack\" client both to issue user access tokens (via Keycloak\u0027s\nROPC flow) and to introspect those same tokens (via Apache\nmod_auth_openidc\u0027s OIDCOAuthIntrospectionEndpoint).\n\nWithout an audience mapper, the access tokens issued by Keycloak do\nnot list \"devstack\" in \"aud\", so introspection returns\n{\"active\": false} and Apache responds with HTTP 401, breaking the\nkeystone-tempest-oidc-federation job.\n\nAdd an audience protocol mapper to the \"devstack\" client so that\n\"devstack\" is included in the access token\u0027s audience. This is\nupstream\u0027s recommended fix and lets us continue tracking\nquay.io/keycloak/keycloak:latest.\n\nAlso handle the 409 Conflict that Keycloak returns when the client or\nmapper already exists from a previous setup run, so the script is\nidempotent.\n\nGenerated-By: claude-opus-4-7 (OpenCode)\nSigned-off-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nChange-Id: Ic70d4756c121e3f096c372ee9b6f5314838e66de\n(cherry picked from commit b698f56afd33aae53d6c0c665956e209eff02591)\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/fff1fa51695be6cd6aeb68d76ba0ab74c5e3d652"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/fff1fa51695be6cd6aeb68d76ba0ab74c5e3d652"}]},"branch":"refs/heads/stable/2026.1","conflicts":{"ours":"635914a6a8a9fb3b172fc15528608df2d091036b","theirs":"b698f56afd33aae53d6c0c665956e209eff02591","contains_conflicts":false}}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":13252,"name":"Dr. Jens Harbott","display_name":"Jens Harbott (frickler)","email":"frickler@offenerstapel.de","username":"jrosenboom"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}