)]}'
{"id":"openstack%2Fkeystone~991059","triplet_id":"openstack%2Fkeystone~master~I43bf8f575eeb7a026c28140007dc0f0fccdf5144","project":"openstack/keystone","branch":"master","topic":"osprh-27983/pbkdf2-sha512-iterations","attention_set":{"35125":{"account":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"last_update":"2026-07-29 12:08:17.000000000","reason":"A robot voted negatively on a label"},"13478":{"account":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"last_update":"2026-06-03 10:18:28.000000000","reason":"\u003cGERRIT_ACCOUNT_35125\u003e replied on the change","reason_account":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"}},"9816":{"account":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"last_update":"2026-06-03 10:14:11.000000000","reason":"\u003cGERRIT_ACCOUNT_35125\u003e replied on the change","reason_account":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"}},"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-06-03 10:14:11.000000000","reason":"\u003cGERRIT_ACCOUNT_35125\u003e replied on the change","reason_account":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"}},"27900":{"account":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"last_update":"2026-06-03 10:14:11.000000000","reason":"\u003cGERRIT_ACCOUNT_35125\u003e replied on the change","reason_account":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"}}},"removed_from_attention_set":{"34120":{"account":{"_account_id":34120,"name":"Andre Aranha","display_name":"afariasa","email":"afariasa@redhat.com","username":"afariasa"},"last_update":"2026-07-31 08:05:32.000000000","reason":"\u003cGERRIT_ACCOUNT_34120\u003e replied on the change","reason_account":{"_account_id":34120,"name":"Andre Aranha","display_name":"afariasa","email":"afariasa@redhat.com","username":"afariasa"}}},"hashtags":[],"change_id":"I43bf8f575eeb7a026c28140007dc0f0fccdf5144","subject":"Increase PBKDF2-SHA512 default iterations to 600,000","status":"NEW","created":"2026-06-02 10:49:17.000000000","updated":"2026-07-31 08:05:32.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":5,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"eed4c1ad4315a76188900780fac1718d67ef9e16","_number":991059,"virtual_id_number":991059,"owner":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":34120,"name":"Andre Aranha","display_name":"afariasa","email":"afariasa@redhat.com","username":"afariasa"},{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"tag":"autogenerated:zuul:check","value":1,"date":"2026-07-30 12:17:19.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"recommended":{"_account_id":34120,"name":"Andre Aranha","display_name":"afariasa","email":"afariasa@redhat.com","username":"afariasa"},"all":[{"value":1,"date":"2026-07-31 08:05:32.000000000","permitted_voting_range":{"min":-1,"max":1},"_account_id":34120,"name":"Andre Aranha","display_name":"afariasa","email":"afariasa@redhat.com","username":"afariasa"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"permitted_voting_range":{"min":-2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","value":1,"default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":34120,"name":"Andre Aranha","display_name":"afariasa","email":"afariasa@redhat.com","username":"afariasa"},{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"_account_id":34120,"name":"Andre Aranha","display_name":"afariasa","email":"afariasa@redhat.com","username":"afariasa"}],"CC":[{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-06-02 11:28:13.000000000","updated_by":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"reviewer":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"state":"CC"},{"updated":"2026-06-02 12:28:55.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-06-03 10:14:11.000000000","updated_by":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"reviewer":{"_account_id":9816,"name":"Takashi Kajinami","email":"kajinamit@oss.nttdata.com","username":"kajinamit"},"state":"REVIEWER"},{"updated":"2026-06-03 10:14:11.000000000","updated_by":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"reviewer":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"state":"REVIEWER"},{"updated":"2026-06-03 10:14:11.000000000","updated_by":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"REVIEWER"},{"updated":"2026-07-22 12:42:13.000000000","updated_by":{"_account_id":34120,"name":"Andre Aranha","display_name":"afariasa","email":"afariasa@redhat.com","username":"afariasa"},"reviewer":{"_account_id":34120,"name":"Andre Aranha","display_name":"afariasa","email":"afariasa@redhat.com","username":"afariasa"},"state":"CC"},{"updated":"2026-07-31 08:05:32.000000000","updated_by":{"_account_id":34120,"name":"Andre Aranha","display_name":"afariasa","email":"afariasa@redhat.com","username":"afariasa"},"reviewer":{"_account_id":34120,"name":"Andre Aranha","display_name":"afariasa","email":"afariasa@redhat.com","username":"afariasa"},"state":"REVIEWER"}],"messages":[{"id":"cc0f8fe56a17f33130f6ea800daa81140e124154","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"date":"2026-06-02 10:49:17.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"e7d25c5749a4c40be58f4f313d25c708eea701d0","author":{"_account_id":13478,"name":"Boris Bobrov","email":"b.bobrov@sap.com","username":"bbobrov"},"date":"2026-06-02 11:28:13.000000000","message":"Patch Set 1:\n\n(1 comment)","accounts_in_message":[],"_revision_number":1},{"id":"6fd6371ba9dbf4d982bd60e8f6a0e5d16a5be7af","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-02 12:28:55.000000000","message":"Patch Set 1: Verified-1\n\n(2 comments)\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/917fe09033e849378e10036b85717abb\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/65f9e23ce31949a79d430bb1416fb309 : SUCCESS in 15m 11s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/ca64cd2e262e4962b39d64bd392b7de9 : FAILURE in 5m 17s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/7751d373ccc942cb83bbee3c7d82eaf8 : SUCCESS in 8m 14s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/3f94ac1bcd83403e9222518279cb491d : SUCCESS in 12m 13s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/1a2683fc828e49eb9ac949da6ba1abb8 : SUCCESS in 11m 50s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/1c5fb864f0af4ee5a6ba1732c8e9d7d3 : FAILURE in 10m 10s\n- grenade https://zuul.opendev.org/t/openstack/build/caea695366b2445fa508b982015e7925 : SUCCESS in 1h 06m 32s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/c9737b829f024fcd8cde793e87138869 : SUCCESS in 1h 36m 06s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/845b106b8f2c49a2b46f5b50c6bd2997 : SUCCESS in 7m 30s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/9fa228dc581a4acb9ed1228d4091ca13 : SUCCESS in 16m 35s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/f9740a293d954e65b89406e7898c315f : SUCCESS in 22m 50s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/cab9ab078784447e9136aaf234c72dc6 : FAILURE in 19m 17s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/6d1f4f58d0a841e887a1343f47f08208 : FAILURE in 26m 37s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/8faa1f69d8bc46dcba124625c160b5ac : SUCCESS in 13m 51s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/1bf0f291c08a4cfd82de417d7bf4a56a : SUCCESS in 13m 53s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/c94c8088a2e74c899ef9a8b244e05da0 : SUCCESS in 30m 20s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/6e640527e6d649b29e1ac5c7a9f81459 : SUCCESS in 1h 03m 27s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/dba2d46fca114134a24e0ff6f7d92b87 : SUCCESS in 42m 26s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/1209c565bc7e4e14a4ee971d3e84061c : SUCCESS in 5m 11s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"717ffafd7072b431670a5710581846a5246358d2","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-02 12:30:52.000000000","message":"Patch Set 1:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/cc442625793e48e681c084e35b5672e8\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/6292dfc67353462881af258c48e1ac8f : SUCCESS in 17m 44s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/e96e57c4539040ae8ccf5b09512018c3 : SUCCESS in 18m 55s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/915ad49695d344eca4cc536636fc6979 : SUCCESS in 34m 48s (non-voting)","accounts_in_message":[],"_revision_number":1},{"id":"0f28c0b890c9881ead891747b8e1a6f7e626a19e","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"date":"2026-06-02 16:25:57.000000000","message":"Uploaded patch set 2.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":2},{"id":"9157d5a3e104ca621265a854ba62ca31a4bcf0fd","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-02 18:54:33.000000000","message":"Patch Set 2: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/61d9e2290c7641fa9b22ecceec10ae05\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/511e1513cfa14a008198ce8d7d8a6e88 : SUCCESS in 19m 24s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/14a4c1466a46406f9346367298f17eb6 : SUCCESS in 4m 58s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/176845e19bb84206a7e9c9e247bfa9f8 : SUCCESS in 11m 28s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/cceb52dd4ff04666b3aa5126c3af9b54 : SUCCESS in 8m 09s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/3799853b0e0d4e7da2563dc7ea71c237 : SUCCESS in 15m 53s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/00bbd64c1b174083a280f21d2f554449 : SUCCESS in 14m 28s\n- grenade https://zuul.opendev.org/t/openstack/build/348acba2d3c94636bc4aeaa2cd38c0b3 : SUCCESS in 1h 07m 50s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/ba84a07dded3491281163a360054f3b7 : SUCCESS in 2h 20m 33s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/062baa2b990e45a5a5752f00bf87e0b9 : SUCCESS in 5m 53s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/8018e1d0f1dd4fea9ff59ce4269f441b : SUCCESS in 12m 37s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/f05956b1d1e046e091a8ec6d32ba7159 : SUCCESS in 32m 29s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/27f539b485d744e884f582e6c7ed1910 : FAILURE in 9m 28s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/4aedee65a47b4e48ae1c4c51070d1250 : FAILURE in 19m 45s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/070dc82cff7d4539964e37db0fff6039 : SUCCESS in 35m 47s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/6b5052f43d8147babf3f77fc8c2ff0aa : SUCCESS in 33m 15s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/29bdfa17f5db418a9888982c6c97b70c : SUCCESS in 27m 49s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/31332c4deb894bd5a90ec4cefd2f19a8 : SUCCESS in 34m 11s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/c9a78abab1524ec0adb3eccdfd49c6ab : SUCCESS in 50m 06s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/e620d2656cf24df9beef9cb3bf134439 : SUCCESS in 7m 00s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"2acfec10190e176ce8f0bac964d0471b80f15a8a","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-02 22:57:31.000000000","message":"Patch Set 2:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/bbe8411aad1348508e42797e7dfe680a\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/bb10306137cf43c0850aeee2554cda42 : SUCCESS in 20m 08s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/84731948741c4556a848ecc7d0dbd540 : SUCCESS in 14m 25s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/ced6718b35d047a1b615b2d71e8de46d : SUCCESS in 19m 58s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"b3a0c0e3288e186752addddfe056e5faef7d5664","author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"date":"2026-06-03 10:18:28.000000000","message":"Patch Set 2:\n\n(1 comment)","accounts_in_message":[],"_revision_number":2},{"id":"7269037c7121fa245334fb6a701bbcd0bc17b16f","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"date":"2026-06-11 13:29:08.000000000","message":"Uploaded patch set 3.\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":3},{"id":"e37672c1a63592f91371e105ba5e338cacb092d9","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-11 13:29:26.000000000","message":"Patch Set 3:\n\nMerge Failed.\n\nThis change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset.\nWarning:\n  Error merging gerrit/openstack/keystone for 991059,3","accounts_in_message":[],"_revision_number":3},{"id":"d626c8288009f1962c4853d0180087278e110363","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-11 13:29:36.000000000","message":"Patch Set 3: Verified-1\n\nMerge Failed.\n\nThis change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset.\nWarning:\n  Error merging gerrit/openstack/keystone for 991059,3","accounts_in_message":[],"_revision_number":3},{"id":"ee80876e91bc7383a20aba662e671c56a6300744","author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"date":"2026-06-11 16:16:01.000000000","message":"Patch Set 3:\n\n(1 comment)","accounts_in_message":[],"_revision_number":3},{"id":"659ea068362b297aa6012246ccb780b9ef547c99","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-11 16:16:12.000000000","message":"Patch Set 3:\n\nMerge Failed.\n\nThis change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset.\nWarning:\n  Error merging gerrit/openstack/keystone for 991059,3","accounts_in_message":[],"_revision_number":3},{"id":"2158b1d27f68b56d30465ffad1b863c86bf70403","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-11 16:16:20.000000000","message":"Patch Set 3:\n\nMerge Failed.\n\nThis change or one of its cross-repo dependencies was unable to be automatically merged with the current state of its repository. Please rebase the change and upload a new patchset.\nWarning:\n  Error merging gerrit/openstack/keystone for 991059,3","accounts_in_message":[],"_revision_number":3},{"id":"b7b9a754003c6a00bdfed46cc02fe1d2c5fbcf5e","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"date":"2026-06-11 16:21:04.000000000","message":"Uploaded patch set 4.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":4},{"id":"380341097ac4291615276f6513792039aa5cafc2","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"date":"2026-06-11 16:24:36.000000000","message":"Uploaded patch set 5: Commit message was updated.","accounts_in_message":[],"_revision_number":5},{"id":"f0a8b910ff9be1632b6f6223a792951e51b886f7","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-11 18:16:24.000000000","message":"Patch Set 5: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/6e474617ceda435da468aea18ae8eb74\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/9e50e276da87494f977f28f9fb465116 : SUCCESS in 10m 45s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/ac95d81efaba42daba549e86136ad701 : SUCCESS in 5m 09s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/49a40d68270c4bbaad3dad390cdb7ffd : SUCCESS in 6m 47s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/46886ef808ca4986a8663eabece1e748 : SUCCESS in 11m 21s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/b51e8ce48c624c9fbf71c004fe592c28 : SUCCESS in 15m 56s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/bd470d194d294959955de4a2f446c69f : SUCCESS in 6m 36s\n- grenade https://zuul.opendev.org/t/openstack/build/864f716b13614873b6e57309a28445b4 : SUCCESS in 1h 11m 12s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/764787449dcf4dd6b7c0b6f824f79db7 : SUCCESS in 1h 49m 50s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/7c04aa285b714d08ae1f840bc72173fd : SUCCESS in 4m 58s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/64df1a26a6354f9ea9e7c8b133157952 : SUCCESS in 18m 51s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/e34769328935468fa0a1955e027b7328 : SUCCESS in 13m 11s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/10266e067e6c4815a523a81d8cda8a59 : FAILURE in 8m 17s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/c64513087d00447392063115284d0f2c : FAILURE in 27m 13s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/4661ff0375e749d5963362219e7583c5 : SUCCESS in 29m 27s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/eaf0b0f7db0e4976a1c4db6ecb8f6fbb : SUCCESS in 31m 18s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/d7f8c376360647b1b4e7e5be8ad88767 : SUCCESS in 41m 16s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/74b35fc872a04603bb3e3051a6db0c3e : SUCCESS in 1h 24m 33s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/bfce4f49d9984f459dd1dd1e3f19b6f4 : SUCCESS in 43m 20s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/b1828bce2a214fe7903e4c8dc1fbbfbb : SUCCESS in 3m 42s (non-voting)","accounts_in_message":[],"_revision_number":5},{"id":"bef6c0f8fe72c17fd3eb3853230d16d37fa95533","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-16 11:08:06.000000000","message":"Patch Set 5:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/8bd3514978934e75a7bd03603000851c\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/349d65eb89594b59b80bc9c7238a20d8 : POST_FAILURE in 22m 17s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/d481cf07a4f649adb914d3c845057340 : SUCCESS in 26m 04s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/e983a2c2476b4491b90e5169c0223099 : SUCCESS in 32m 57s (non-voting)","accounts_in_message":[],"_revision_number":5},{"id":"c54439c54111eaed1dfea106b3df53699bfc67b0","author":{"_account_id":34120,"name":"Andre Aranha","display_name":"afariasa","email":"afariasa@redhat.com","username":"afariasa"},"date":"2026-07-22 12:42:13.000000000","message":"Patch Set 5:\n\n(1 comment)","accounts_in_message":[],"_revision_number":5},{"id":"19d2b1171ce5402a8fe5309ad1538ba2732ab36d","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"date":"2026-07-29 10:24:08.000000000","message":"Uploaded patch set 6.\n\nOutdated Votes:\n* Verified+1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":6},{"id":"10943b5c3f730eec0f9e0db64de00db09e54975f","author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"date":"2026-07-29 10:24:55.000000000","message":"Patch Set 5:\n\n(1 comment)","accounts_in_message":[],"_revision_number":5},{"id":"85129148877e8b766bc564fa7398a53fe4dec923","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-07-29 12:08:17.000000000","message":"Patch Set 6: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/df3d1411fa70413e9680379efbf537ed\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/982e6e2c92104321a798b4f174f94eae : SUCCESS in 17m 28s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/e5c1577750874c6ca8ff0bb8cec85a61 : FAILURE in 5m 32s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/c46aad9626024fabbd242798e8bdb4e0 : SUCCESS in 12m 41s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/6fdc2d30d6a447c897343dc286e46312 : SUCCESS in 12m 48s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/6fd996ddf0be48ed95766b008a3f747a : SUCCESS in 12m 33s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/0b19a839dcb4478ea616d3fa3da0c816 : SUCCESS in 14m 01s\n- grenade https://zuul.opendev.org/t/openstack/build/553aa763808e42c898cf0e6c2ffdb5e8 : SUCCESS in 1h 01m 34s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/deda3dc6f8b8419ca6d7366094fc6dda : SUCCESS in 1h 37m 16s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/98e0a54e4f3e4ca2a01cc08b6098ae35 : SUCCESS in 11m 39s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/fdfe39aa1fbb4c3d9c9a9663b235e388 : SUCCESS in 17m 47s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/b40709bf034d4ca38f9774a36f3212bc : SUCCESS in 52m 49s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/3e634c147f1543569db5fe094dd3d484 : FAILURE in 15m 29s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/56e749e1650b4a23a3b6fc04cbf743e4 : FAILURE in 30m 40s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/a9c77ddd26894d4d992cc1f85d70d71d : SUCCESS in 47m 09s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/51a8b29e9b8e476baacdfdd044b86416 : SUCCESS in 42m 35s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/d8d7e203323b4f589ef87db2fd19c02f : SUCCESS in 35m 53s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/5daaecbcb04747578de730c2ad3405da : SUCCESS in 56m 10s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/61f70a4186d442eba1267979dc4ce8e8 : SUCCESS in 41m 06s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/f69877c5005c4b45976b3823a39c31af : SUCCESS in 7m 25s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":6},{"id":"b28f382fdb66d232a4ffbb07f03601813461287a","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-07-29 14:37:11.000000000","message":"Patch Set 6:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/d2409056ac9948bebeeb048e17310968\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/be72e102cd854c19826e88782f28978c : SUCCESS in 35m 20s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/1bc6c2a9d3904e0f807029b233b61dc6 : SUCCESS in 34m 09s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/a6b8595383b7432e952c7f6598f543b6 : TIMED_OUT in 1h 01m 35s (non-voting)","accounts_in_message":[],"_revision_number":6},{"id":"aa043b2fd851cf8a1aa2992643ff86c385cc81f8","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"date":"2026-07-30 10:41:01.000000000","message":"Uploaded patch set 7.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":7},{"id":"d7baee035897efdfdd350d3ce8b45ba8a14d84cd","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-07-30 12:17:19.000000000","message":"Patch Set 7: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/a92ccde1a2834a70a2ff5058834e7e6a\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/f9f98d4dee254a87ab1d566a5c676126 : SUCCESS in 18m 29s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/41064761f4ef4b3484ddc161d1654d04 : SUCCESS in 5m 54s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/209fecc79336464890f2eb8677acb88b : SUCCESS in 12m 28s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/9376fe5adfd243f885f8187f46d7df71 : SUCCESS in 7m 11s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/858bbeaf3fbb4a7daf6a4c9091c49a6b : SUCCESS in 17m 04s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/f2452deec95a43bf9523ade1c5092d2c : SUCCESS in 8m 06s\n- grenade https://zuul.opendev.org/t/openstack/build/b8adf30f3d9041d6bc2e963be4ed7963 : SUCCESS in 36m 08s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/6e6f4b4f2c7746c0a065c830deb48806 : SUCCESS in 1h 34m 03s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/edc579a0812c4b69a9751cb3e4e27b55 : SUCCESS in 13m 01s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/08fc35e694624410b1c98bee5a583a0d : SUCCESS in 20m 32s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/782fa9f270b841afae2d1e3dd892814d : SUCCESS in 25m 46s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/2b315e4ecedb40149a135b4aed6fedea : FAILURE in 10m 41s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/41da4f6672054e64b1898046237d80c4 : FAILURE in 23m 43s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/3f7e9080b23944a191d23fc7b57a20e8 : SUCCESS in 47m 37s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/e4710df3ed504b1d9bee71576dd8b53c : SUCCESS in 37m 27s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/977776ea8a7449bcaf72e203b8a28686 : SUCCESS in 20m 21s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/63a78299f793455d8922df7fd6e8080d : SUCCESS in 1h 03m 44s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/81588688e11e48f29a711654f06e2092 : SUCCESS in 44m 58s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/03fbc76814904120a223157cb55fa8d6 : SUCCESS in 7m 12s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":7},{"id":"d1a2ace0ae7355356ec3decfbcadfc08d0cd1f0c","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-07-30 15:29:01.000000000","message":"Patch Set 7:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/89ca61b2b8a545148ee37f74a86e4912\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/3585b9ad3bfc42a49b60e0c7ee838115 : SUCCESS in 24m 24s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/43a9a76505fd479f9499ef88af164513 : SUCCESS in 23m 38s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/8b9e2dd1376047aba2abb10b92532d1d : TIMED_OUT in 1h 01m 16s (non-voting)","accounts_in_message":[],"_revision_number":7},{"id":"eed4c1ad4315a76188900780fac1718d67ef9e16","author":{"_account_id":34120,"name":"Andre Aranha","display_name":"afariasa","email":"afariasa@redhat.com","username":"afariasa"},"date":"2026-07-31 08:05:32.000000000","message":"Patch Set 7: Code-Review+1","accounts_in_message":[],"_revision_number":7}],"current_revision_number":7,"current_revision":"e73a5135eccdc5e31c8d1c1f653b1d491d9e2497","revisions":{"940fc312df7d9f23f2cbd2df13e5e15854a7ce2d":{"kind":"REWORK","_number":1,"created":"2026-06-02 10:49:17.000000000","uploader":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"ref":"refs/changes/59/991059/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/59/991059/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/59/991059/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/59/991059/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/59/991059/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/59/991059/1"}}},"commit":{"parents":[{"commit":"4a6ba41cbd1913cabac88679c051c9033fa8464b","subject":"Merge \"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/4a6ba41cbd1913cabac88679c051c9033fa8464b"}]}],"author":{"name":"Mauricio Harley","email":"mharley@redhat.com","date":"2026-06-02 10:45:42.000000000","tz":0},"committer":{"name":"Mauricio Harley","email":"mharley@redhat.com","date":"2026-06-02 10:45:42.000000000","tz":0},"subject":"Increase PBKDF2-SHA512 default iterations to 600,000","message":"Increase PBKDF2-SHA512 default iterations to 600,000\n\nKeystone\u0027s PBKDF2-SHA512 password hasher previously used 25,000\niterations as its default, well below the OWASP 2023 recommendation\nof 600,000 for PBKDF2-HMAC-SHA512.  While PBKDF2 with HMAC is\nconsidered quantum-safe, Grover\u0027s algorithm provides a quadratic\nspeedup for brute-force search, making a high iteration count\nimportant for long-term security.\n\nThis change:\n\n* Raises the default round count from 25,000 to 600,000 via the\n  new public constant ``pbkdf2.DEFAULT_ROUNDS``.  The value remains\n  operator-configurable through ``[identity] password_hash_rounds``.\n\n* Adds ``Sha512.needs_rehash()`` to detect hashes computed with\n  fewer iterations than the current target, and a module-level\n  ``password_hashing.needs_rehash()`` that additionally detects\n  algorithm mismatches.\n\n* Transparently rehashes outdated passwords on the next successful\n  authentication by updating the ``password_hash`` column of the\n  current Password record in place, leaving password-history,\n  expiry, and created_at metadata untouched.\n\nThe ~24x increase in hashing work per authentication is expected\nand intentional.  Operators should benchmark their hardware and\ntune ``[identity] password_hash_rounds`` if the new default causes\nunacceptable latency.\n\nOSPRH-27983\n\nChange-Id: I43bf8f575eeb7a026c28140007dc0f0fccdf5144\nSigned-off-by: Mauricio Harley \u003cmharley@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/940fc312df7d9f23f2cbd2df13e5e15854a7ce2d"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/940fc312df7d9f23f2cbd2df13e5e15854a7ce2d"}]},"branch":"refs/heads/master"},"d9b12501769c0369bddc6666499bdf03a222fec1":{"kind":"REWORK","_number":2,"created":"2026-06-02 16:25:57.000000000","uploader":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"ref":"refs/changes/59/991059/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/59/991059/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/59/991059/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/59/991059/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/59/991059/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/59/991059/2"}}},"commit":{"parents":[{"commit":"4a6ba41cbd1913cabac88679c051c9033fa8464b","subject":"Merge \"Prevent RBAC policy bypass via JSON body and query filters (CVE-2026-42999)\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/4a6ba41cbd1913cabac88679c051c9033fa8464b"}]}],"author":{"name":"Mauricio Harley","email":"mharley@redhat.com","date":"2026-06-02 10:45:42.000000000","tz":0},"committer":{"name":"Mauricio Harley","email":"mharley@redhat.com","date":"2026-06-02 16:23:28.000000000","tz":0},"subject":"Increase PBKDF2-SHA512 default iterations to 600,000","message":"Increase PBKDF2-SHA512 default iterations to 600,000\n\nKeystone\u0027s PBKDF2-SHA512 password hasher previously used 25,000\niterations as its default, well below the OWASP 2023 recommendation\nof 600,000 for PBKDF2-HMAC-SHA512.  While PBKDF2 with HMAC is\nconsidered quantum-safe, Grover\u0027s algorithm provides a quadratic\nspeedup for brute-force search, making a high iteration count\nimportant for long-term security.\n\nThis change:\n\n* Raises the default round count from 25,000 to 600,000 via the\n  new public constant ``pbkdf2.DEFAULT_ROUNDS``.  The value remains\n  operator-configurable through ``[identity] password_hash_rounds``.\n\n* Adds ``Sha512.needs_rehash()`` to detect hashes computed with\n  fewer iterations than the current target, and a module-level\n  ``password_hashing.needs_rehash()`` that additionally detects\n  algorithm mismatches.\n\n* Transparently rehashes outdated passwords on the next successful\n  authentication by updating the ``password_hash`` column of the\n  current Password record in place, leaving password-history,\n  expiry, and created_at metadata untouched.\n\nThe ~24x increase in hashing work per authentication is expected\nand intentional.  Operators should benchmark their hardware and\ntune ``[identity] password_hash_rounds`` if the new default causes\nunacceptable latency.\n\nOSPRH-27983\n\nChange-Id: I43bf8f575eeb7a026c28140007dc0f0fccdf5144\nSigned-off-by: Mauricio Harley \u003cmharley@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/d9b12501769c0369bddc6666499bdf03a222fec1"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/d9b12501769c0369bddc6666499bdf03a222fec1"}]},"branch":"refs/heads/master"},"015f553df726415cbc2cb78ae1a831e4aa519b8c":{"kind":"REWORK","_number":3,"created":"2026-06-11 13:29:08.000000000","uploader":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"ref":"refs/changes/59/991059/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/59/991059/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/59/991059/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/59/991059/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/59/991059/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/59/991059/3"}}},"commit":{"parents":[{"commit":"eb3c0cd99a353fde717155aa80da4ddb4251ffe4","subject":"Merge \"Fix LDAP pagination to return all users beyond page_size\"","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/eb3c0cd99a353fde717155aa80da4ddb4251ffe4"}]}],"author":{"name":"Mauricio Harley","email":"mharley@redhat.com","date":"2026-06-11 12:53:46.000000000","tz":0},"committer":{"name":"Mauricio Harley","email":"mharley@redhat.com","date":"2026-06-11 13:22:27.000000000","tz":0},"subject":"Increase PBKDF2-SHA512 default iterations to 600,000","message":"Increase PBKDF2-SHA512 default iterations to 600,000\n\nRaise the default iteration count for PBKDF2-SHA512 password hashing\nfrom 25,000 to 600,000, matching the OWASP 2023 recommendation.  The\nhigher count strengthens resistance to brute-force attacks, including\nquantum-accelerated search via Grover\u0027s algorithm.\n\nExisting passwords are transparently rehashed on next successful\nauthentication thanks to the rehash infrastructure introduced in\nthe companion patch.  Operators may tune the value via\n[identity] password_hash_rounds.\n\nExpected authentication latency impact: 0.3-0.8 s per login on\nmodern hardware.\n\nDepends-On: I8bf6427256a1716a886f6e7ac0e55d030df6c21e\nChange-Id: I43bf8f575eeb7a026c28140007dc0f0fccdf5144\nSigned-off-by: Mauricio Harley \u003cmharley@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/015f553df726415cbc2cb78ae1a831e4aa519b8c"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/015f553df726415cbc2cb78ae1a831e4aa519b8c"}]},"branch":"refs/heads/master"},"f46f3e08c1a6c893bd6868f176b3f6fc34fed7f8":{"kind":"REWORK","_number":4,"created":"2026-06-11 16:21:04.000000000","uploader":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"ref":"refs/changes/59/991059/4","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/59/991059/4","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/59/991059/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/59/991059/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/59/991059/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/59/991059/4"}}},"commit":{"parents":[{"commit":"a6286af89a608455e10e3fb1036e1fc44a1cd8d9","subject":"Add transparent PBKDF2-SHA512 password rehashing on login","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a6286af89a608455e10e3fb1036e1fc44a1cd8d9"}]}],"author":{"name":"Mauricio Harley","email":"mharley@redhat.com","date":"2026-06-11 16:17:55.000000000","tz":0},"committer":{"name":"Mauricio Harley","email":"mharley@redhat.com","date":"2026-06-11 16:18:29.000000000","tz":0},"subject":"Increase PBKDF2-SHA512 default iterations to 600,000","message":"Increase PBKDF2-SHA512 default iterations to 600,000\n\nRaise the default iteration count for PBKDF2-SHA512 password hashing\nfrom 25,000 to 600,000, matching the OWASP 2023 recommendation.  The\nhigher count strengthens resistance to brute-force attacks, including\nquantum-accelerated search via Grover\u0027s algorithm.\n\nExisting passwords are transparently rehashed on next successful\nauthentication thanks to the rehash infrastructure introduced in\nthe companion patch.  Operators may tune the value via\n[identity] password_hash_rounds.\n\nExpected authentication latency impact: 0.3-0.8 s per login on\nmodern hardware.\n\nDepends-On: I8bf6427256a1716a886f6e7ac0e55d030df6c21e\nChange-Id: I43bf8f575eeb7a026c28140007dc0f0fccdf5144\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\nSigned-off-by: Mauricio Harley \u003cmharley@redhat.com\u003e\nCo-authored-by: Cursor \u003ccursoragent@cursor.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/f46f3e08c1a6c893bd6868f176b3f6fc34fed7f8"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/f46f3e08c1a6c893bd6868f176b3f6fc34fed7f8"}]},"branch":"refs/heads/master"},"b75ee7ffd955b8d31f792de89a6832860d9b9d6e":{"kind":"NO_CODE_CHANGE","_number":5,"created":"2026-06-11 16:24:36.000000000","uploader":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"ref":"refs/changes/59/991059/5","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/59/991059/5","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/59/991059/5 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/59/991059/5 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/59/991059/5 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/59/991059/5"}}},"commit":{"parents":[{"commit":"a6286af89a608455e10e3fb1036e1fc44a1cd8d9","subject":"Add transparent PBKDF2-SHA512 password rehashing on login","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a6286af89a608455e10e3fb1036e1fc44a1cd8d9"}]}],"author":{"name":"Mauricio Harley","email":"mharley@redhat.com","date":"2026-06-11 16:17:55.000000000","tz":0},"committer":{"name":"Mauricio Harley","email":"mharley@redhat.com","date":"2026-06-11 16:21:47.000000000","tz":0},"subject":"Increase PBKDF2-SHA512 default iterations to 600,000","message":"Increase PBKDF2-SHA512 default iterations to 600,000\n\nRaise the default iteration count for PBKDF2-SHA512 password hashing\nfrom 25,000 to 600,000, matching the OWASP 2023 recommendation.  The\nhigher count strengthens resistance to brute-force attacks, including\nquantum-accelerated search via Grover\u0027s algorithm.\n\nExisting passwords are transparently rehashed on next successful\nauthentication thanks to the rehash infrastructure introduced in\nthe companion patch.  Operators may tune the value via\n[identity] password_hash_rounds.\n\nDepends-On: I8bf6427256a1716a886f6e7ac0e55d030df6c21e\nChange-Id: I43bf8f575eeb7a026c28140007dc0f0fccdf5144\nSigned-off-by: Mauricio Harley \u003cmharley@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/b75ee7ffd955b8d31f792de89a6832860d9b9d6e"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/b75ee7ffd955b8d31f792de89a6832860d9b9d6e"}]},"branch":"refs/heads/master"},"0dc44537b45326d81bcb0e2fe76b4a2bcf98ccc6":{"kind":"REWORK","_number":6,"created":"2026-07-29 10:24:08.000000000","uploader":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"ref":"refs/changes/59/991059/6","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/59/991059/6","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/59/991059/6 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/59/991059/6 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/59/991059/6 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/59/991059/6"}}},"commit":{"parents":[{"commit":"6e6ebda8595bb6f5e45ee58c13ee9196ddb2a33f","subject":"Add transparent PBKDF2-SHA512 password rehashing on login","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/6e6ebda8595bb6f5e45ee58c13ee9196ddb2a33f"}]}],"author":{"name":"Mauricio Harley","email":"mharley@redhat.com","date":"2026-06-11 16:17:55.000000000","tz":0},"committer":{"name":"Mauricio Harley","email":"mharley@redhat.com","date":"2026-07-29 10:20:13.000000000","tz":0},"subject":"Increase PBKDF2-SHA512 default iterations to 600,000","message":"Increase PBKDF2-SHA512 default iterations to 600,000\n\nRaise the default iteration count for PBKDF2-SHA512 password hashing\nfrom 25,000 to 600,000, matching the OWASP 2023 recommendation.  The\nhigher count strengthens resistance to brute-force attacks, including\nquantum-accelerated search via Grover\u0027s algorithm.\n\nExisting passwords are transparently rehashed on next successful\nauthentication thanks to the rehash infrastructure introduced in\nthe companion patch.  Operators may tune the value via\n[identity] password_hash_rounds.\n\nDepends-On: I8bf6427256a1716a886f6e7ac0e55d030df6c21e\nChange-Id: I43bf8f575eeb7a026c28140007dc0f0fccdf5144\nSigned-off-by: Mauricio Harley \u003cmharley@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/0dc44537b45326d81bcb0e2fe76b4a2bcf98ccc6"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/0dc44537b45326d81bcb0e2fe76b4a2bcf98ccc6"}]},"branch":"refs/heads/master"},"e73a5135eccdc5e31c8d1c1f653b1d491d9e2497":{"kind":"REWORK","_number":7,"created":"2026-07-30 10:41:01.000000000","uploader":{"_account_id":35125,"name":"Mauricio Harley","email":"mharley@redhat.com","username":"mharley-rh"},"ref":"refs/changes/59/991059/7","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/59/991059/7","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/59/991059/7 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/59/991059/7 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/59/991059/7 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/59/991059/7"}}},"commit":{"parents":[{"commit":"6e6ebda8595bb6f5e45ee58c13ee9196ddb2a33f","subject":"Add transparent PBKDF2-SHA512 password rehashing on login","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/6e6ebda8595bb6f5e45ee58c13ee9196ddb2a33f"}]}],"author":{"name":"Mauricio Harley","email":"mharley@redhat.com","date":"2026-06-11 16:17:55.000000000","tz":0},"committer":{"name":"Mauricio Harley","email":"mharley@redhat.com","date":"2026-07-30 10:37:20.000000000","tz":0},"subject":"Increase PBKDF2-SHA512 default iterations to 600,000","message":"Increase PBKDF2-SHA512 default iterations to 600,000\n\nRaise the default iteration count for PBKDF2-SHA512 password hashing\nfrom 25,000 to 600,000, matching the OWASP 2023 recommendation.  The\nhigher count strengthens resistance to brute-force attacks, including\nquantum-accelerated search via Grover\u0027s algorithm.\n\nExisting passwords are transparently rehashed on next successful\nauthentication thanks to the rehash infrastructure introduced in\nthe companion patch.  Operators may tune the value via\n[identity] password_hash_rounds.\n\nDepends-On: I8bf6427256a1716a886f6e7ac0e55d030df6c21e\nChange-Id: I43bf8f575eeb7a026c28140007dc0f0fccdf5144\nSigned-off-by: Mauricio Harley \u003cmharley@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/e73a5135eccdc5e31c8d1c1f653b1d491d9e2497"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/e73a5135eccdc5e31c8d1c1f653b1d491d9e2497"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":34120,"name":"Andre Aranha","display_name":"afariasa","email":"afariasa@redhat.com","username":"afariasa"}},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}