)]}'
{"id":"openstack%2Fkeystone~990631","triplet_id":"openstack%2Fkeystone~unmaintained%2F2024.1~Ic70d4756c121e3f096c372ee9b6f5314838e66de","project":"openstack/keystone","branch":"unmaintained/2024.1","attention_set":{},"removed_from_attention_set":{"13478":{"account":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"last_update":"2026-06-10 10:36:51.000000000","reason":"Change was submitted"}},"hashtags":[],"change_id":"Ic70d4756c121e3f096c372ee9b6f5314838e66de","subject":"Add audience mapper to devstack Keycloak client","status":"MERGED","created":"2026-05-29 12:33:59.000000000","updated":"2026-06-10 10:37:57.000000000","submitted":"2026-06-10 10:36:51.000000000","submitter":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"total_comment_count":3,"unresolved_comment_count":0,"has_review_started":true,"submission_id":"990631","meta_rev_id":"c1147e8ff4d1a6fddac1e205b10ef28bb380cb03","_number":990631,"virtual_id_number":990631,"owner":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"actions":{},"labels":{"Verified":{"approved":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"value":0,"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},{"value":0,"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":0,"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},{"tag":"autogenerated:zuul:gate","value":2,"date":"2026-06-10 10:36:51.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"all":[{"value":2,"date":"2026-06-10 08:54:56.000000000","permitted_voting_range":{"min":2,"max":2},"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},{"value":1,"date":"2026-05-29 15:15:11.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":1,"date":"2026-06-02 06:46:04.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"all":[{"value":1,"date":"2026-06-10 08:54:56.000000000","permitted_voting_range":{"min":1,"max":1},"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},{"value":0,"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":0,"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},{"value":0,"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-05-29 13:34:19.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-05-29 15:15:11.000000000","updated_by":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"reviewer":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"state":"REVIEWER"},{"updated":"2026-06-02 06:46:04.000000000","updated_by":{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},"reviewer":{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},"state":"REVIEWER"},{"updated":"2026-06-10 08:54:56.000000000","updated_by":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"reviewer":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"state":"REVIEWER"}],"messages":[{"id":"6f89329af4fff812ac89cea5c0c20f63625ae0de","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"date":"2026-05-29 12:33:59.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"73ec4646e4f12097b35e72e3ff6633a995c0ca3b","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-05-29 13:34:19.000000000","message":"Patch Set 1: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/b4fa1fe6a69547b4b35a7f1d446b2407\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/4b2ede1ce0bf4199b5e75f4fb46616c1 : SUCCESS in 11m 53s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/3e197180102849d78c28e53fd0edf6fe : SUCCESS in 5m 37s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/370a2a6b15554eb2a9c55eb855fc966c : SUCCESS in 10m 38s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/8cc6adb81a784eca8c80363712e11307 : SUCCESS in 11m 46s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/8059f34a4cde4ad28198875ea32c9e2d : SUCCESS in 8m 33s\n- grenade https://zuul.opendev.org/t/openstack/build/a734a42650d84a0ebd5cc9491b8f1a48 : SUCCESS in 36m 44s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/6f46fe153a9b47408ee79cd63d6bb8c1 : SUCCESS in 58m 42s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/143ea82fb3ab43228ca4a2a95e04435b : SUCCESS in 7m 10s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/ee16c2f4808a4086869b7d9c0fc20661 : SUCCESS in 18m 14s\n- keystone-dsvm-py3-functional-fips https://zuul.opendev.org/t/openstack/build/ddb89802077742f690f70f135f8c5496 : FAILURE in 39m 00s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy https://zuul.opendev.org/t/openstack/build/480a7d789df74e73b93bf4ff27c2d022 : FAILURE in 12m 12s (non-voting)\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/c629b406c4f34f22b49358667d3085ec : SUCCESS in 12m 25s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/8025049227804b2288b6abb38aff5825 : FAILURE in 9m 45s (non-voting)\n- keystone-dsvm-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/d459153c6bf94c6f892b4b6ccb74e9a0 : FAILURE in 11m 19s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/8bc026e7d36e4195ba8ae9829f954568 : SUCCESS in 50m 58s\n- keystone-dsvm-functional-oidc-federation https://zuul.opendev.org/t/openstack/build/634bffe0e7ea4ec9bd45d890b0dafa7a : SUCCESS in 19m 32s","accounts_in_message":[],"_revision_number":1},{"id":"2ee56725728446231c57ebdd97712ba9093ab846","author":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"date":"2026-05-29 15:15:11.000000000","message":"Patch Set 1: Code-Review+1","accounts_in_message":[],"_revision_number":1},{"id":"ca5cf8a5777ca3196659063251e9d5c1035fa55d","author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"date":"2026-05-29 15:47:46.000000000","message":"Patch Set 1:\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"ce359e9ef8ff4b77fb7f6148d7a80177302b7691","author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"date":"2026-05-29 15:48:39.000000000","message":"Patch Set 1:\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"e22d459979da82b1957d4255f04cc90ac2d97c10","author":{"_account_id":16137,"name":"Tobias Urdin","email":"tobias.urdin@binero.com","username":"tobasco"},"date":"2026-06-02 06:46:04.000000000","message":"Patch Set 1: Code-Review+1","accounts_in_message":[],"_revision_number":1},{"id":"5001cc21ab967fbdc1b8f635bc84b95a4dad7362","author":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"},"date":"2026-06-10 08:54:56.000000000","message":"Patch Set 1: Code-Review+2 Workflow+1\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"3b5a769b6a5b8079ba3fc50d4d91bf91cee3aba2","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-10 08:55:23.000000000","message":"Patch Set 1: -Verified\n\nStarting gate jobs.","accounts_in_message":[],"_revision_number":1},{"id":"327c658b204d4a82f0209736fd59d76072183fb4","tag":"autogenerated:zuul:gate","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-10 10:36:51.000000000","message":"Patch Set 1: Verified+2\n\nBuild succeeded (gate pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/9397f308872e441b91ded5917c95512d\n\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/7eaf34f0268c4304a7787d74a05ab77f : SUCCESS in 8m 57s\n- openstack-tox-py38 https://zuul.opendev.org/t/openstack/build/c9d3da321f4e412d97dfde2612f51d46 : SUCCESS in 11m 33s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/5edab828ac4c4093b8da62255d07fbcb : SUCCESS in 11m 57s\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/8d1580da07774a4ea98d5441dbe82742 : SUCCESS in 11m 40s\n- grenade https://zuul.opendev.org/t/openstack/build/6115daef6da8461abb01bb014f61b7ca : SUCCESS in 58m 46s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/55fcf581ad654f1f8be96adaf392ef2f : SUCCESS in 1h 36m 27s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/80be77b3060a492c92987c09a011e112 : SUCCESS in 13m 59s\n- keystone-dsvm-py3-functional https://zuul.opendev.org/t/openstack/build/b037fcdbd06c46c7b2f96f24260ff55e : SUCCESS in 28m 49s\n- keystone-dsvm-py3-functional-federation-ubuntu-jammy-k2k https://zuul.opendev.org/t/openstack/build/ddedef5f6d84453db5fa4ab2897503eb : SUCCESS in 30m 08s\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/964557c817034a5f8c542be8eda111fc : SUCCESS in 56m 23s","accounts_in_message":[],"_revision_number":1},{"id":"fd01dbe5e38d3e5cedd51fc466297e95774dae1c","tag":"autogenerated:gerrit:merged","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-10 10:36:51.000000000","message":"Change has been successfully merged","accounts_in_message":[],"_revision_number":1},{"id":"c1147e8ff4d1a6fddac1e205b10ef28bb380cb03","tag":"autogenerated:zuul:promote","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-10 10:37:57.000000000","message":"Patch Set 1:\n\nBuild succeeded (promote pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/4d719ecb05744b56ba41490f2597c930\n\n- promote-openstack-tox-docs https://zuul.opendev.org/t/openstack/build/9c3248246dad4ad690fd752474a8c78a : SUCCESS in 52s","accounts_in_message":[],"_revision_number":1}],"current_revision_number":1,"current_revision":"26714bca9cf0ddcc56bd81e445669b72cf041ce0","revisions":{"26714bca9cf0ddcc56bd81e445669b72cf041ce0":{"kind":"REWORK","_number":1,"created":"2026-05-29 12:33:59.000000000","uploader":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"ref":"refs/changes/31/990631/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/31/990631/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/31/990631/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/31/990631/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/31/990631/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/31/990631/1"}}},"commit":{"parents":[{"commit":"dc8c24af85b36242f77791c8ac07ff69944ffd2c","subject":"fix ldap \u0027enabled\u0027 setting not interpreted as boolean","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/dc8c24af85b36242f77791c8ac07ff69944ffd2c"}]}],"author":{"name":"Boris Bobrov","email":"b.bobrov@sap.com","date":"2026-05-21 20:19:22.000000000","tz":120},"committer":{"name":"Boris Bobrov","email":"b.bobrov@sap.com","date":"2026-05-29 12:33:42.000000000","tz":120},"subject":"Add audience mapper to devstack Keycloak client","message":"Add audience mapper to devstack Keycloak client\n\nKeycloak 26.6.2 fixed CVE-2026-37979 by requiring the authenticated\nclient at the OAuth2 token introspection endpoint to be listed in the\nintrospected token\u0027s \"aud\" claim. The devstack OIDC plugin uses the\n\"devstack\" client both to issue user access tokens (via Keycloak\u0027s\nROPC flow) and to introspect those same tokens (via Apache\nmod_auth_openidc\u0027s OIDCOAuthIntrospectionEndpoint).\n\nWithout an audience mapper, the access tokens issued by Keycloak do\nnot list \"devstack\" in \"aud\", so introspection returns\n{\"active\": false} and Apache responds with HTTP 401, breaking the\nkeystone-tempest-oidc-federation job.\n\nAdd an audience protocol mapper to the \"devstack\" client so that\n\"devstack\" is included in the access token\u0027s audience. This is\nupstream\u0027s recommended fix and lets us continue tracking\nquay.io/keycloak/keycloak:latest.\n\nAlso handle the 409 Conflict that Keycloak returns when the client or\nmapper already exists from a previous setup run, so the script is\nidempotent.\n\nGenerated-By: claude-opus-4-7 (OpenCode)\nSigned-off-by: Boris Bobrov \u003cb.bobrov@sap.com\u003e\nChange-Id: Ic70d4756c121e3f096c372ee9b6f5314838e66de\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/26714bca9cf0ddcc56bd81e445669b72cf041ce0"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/26714bca9cf0ddcc56bd81e445669b72cf041ce0"}]},"branch":"refs/heads/unmaintained/2024.1"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"CLOSED","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":17685,"name":"Elod Illes","email":"elod.illes@est.tech","username":"elod.illes"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Verified\u003dMAX"],"failing_atoms":["label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}