)]}'
{"id":"openstack%2Fkeystone~993764","triplet_id":"openstack%2Fkeystone~master~I3bf233aa609900443fc1094c6985a608cfab97e1","project":"openstack/keystone","branch":"master","topic":"fix/domain-specific-role-grant-validation","attention_set":{"14250":{"account":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"last_update":"2026-07-08 10:39:58.000000000","reason":"Someone else replied on the change"}},"removed_from_attention_set":{},"hashtags":[],"change_id":"I3bf233aa609900443fc1094c6985a608cfab97e1","subject":"Enforce domain scope for domain-targeted role grants","status":"NEW","created":"2026-06-17 14:36:30.000000000","updated":"2026-07-27 18:36:20.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":1,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"aa6b021d980b0b5b78aac32aef739c37a66b08fd","_number":993764,"virtual_id_number":993764,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"tag":"autogenerated:zuul:check","value":1,"date":"2026-06-18 15:04:47.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"approved":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"all":[{"value":2,"date":"2026-07-27 18:36:20.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":2,"date":"2026-07-08 10:39:58.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"approved":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"all":[{"value":1,"date":"2026-07-27 18:36:20.000000000","permitted_voting_range":{"min":-1,"max":1},"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-06-17 16:11:04.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"},{"updated":"2026-07-08 10:39:58.000000000","updated_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"reviewer":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"state":"REVIEWER"},{"updated":"2026-07-27 18:36:20.000000000","updated_by":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"reviewer":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"state":"REVIEWER"}],"messages":[{"id":"13e90fbb72f6ed7b74881bb49dbb6278fe1dc0d4","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-06-17 14:36:30.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"6a0d83fa81577b09aff2c7123167f5469026193e","tag":"autogenerated:gerrit:newPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-06-17 14:42:17.000000000","message":"Uploaded patch set 2.","accounts_in_message":[],"_revision_number":2},{"id":"71ee99fbd13701e4a7a2f5d6ea59b24df5dcc8b8","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-17 16:11:04.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/37dd3810849043ea9f24ab0016be2670\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/f5ebe2a9bb704e8c90fb1ec94e6a9c3e : SUCCESS in 15m 42s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/a77f939d86414ac18ca05ec7f0997ae9 : SUCCESS in 5m 22s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/18ff1fe2f0fa4a7e81898d29f70771e6 : SUCCESS in 7m 03s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/0afe60fa63b84fa59c97b1217367fab2 : SUCCESS in 10m 03s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/97fa473b4b854d12ac028c810d2aae77 : SUCCESS in 12m 35s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/7fc7a7e90b0d4144bea89b57273b5afd : SUCCESS in 13m 41s\n- grenade https://zuul.opendev.org/t/openstack/build/78aca027a3584244afe3ec41e57ad378 : SUCCESS in 1h 01m 45s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/634ac4ca824d47559098118d0cfb054f : SUCCESS in 1h 26m 58s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/66503c778ea24bbda49654ac078ef995 : SUCCESS in 4m 43s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/7bd2fe8b2a494b0590f325b6dfed5e45 : FAILURE in 17m 49s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/43c2c63664b94bf086810ffb1db93951 : SUCCESS in 13m 34s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/3d2ae91298a249a9a2c09d7c5e41f095 : FAILURE in 19m 42s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/afc9024f9a7e42f6ae90d958b227d8f0 : FAILURE in 22m 01s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/c55361c0114142c6aac68ccc7c7d8ca4 : SUCCESS in 22m 31s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/fe179425eeb64d3f91a5d74c24e3cb0d : SUCCESS in 14m 36s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/921fe0d49cf8476d9c06f84c19c53d78 : SUCCESS in 30m 59s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/fae6fe8308864bfeb35f21962524439c : SUCCESS in 1h 05m 26s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/88be0ce852204bb98692aaad905b98f9 : FAILURE in 34m 49s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/9951c25cfd50499cb2555734ae6d4f31 : SUCCESS in 6m 15s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"ce47c86896bcd5394ba0916898295b9684568e41","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-18 01:37:49.000000000","message":"Patch Set 2:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/fb20222b3b58468690bb5cd2026924f3\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/92759526bfd54e1184e7d8f5f066d711 : SUCCESS in 21m 46s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/7c748247ba73495082e59f0a2524b142 : SUCCESS in 15m 41s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/58a4248c0ced4452bb6df1a8f2f319db : SUCCESS in 56m 34s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"e327bf1dc330f1c1277e31937ba249032a60cbfd","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-06-18 13:18:48.000000000","message":"Uploaded patch set 3: Commit message was updated.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":3},{"id":"bd918f8fe563bc986cd7266203b781a9ab56e6c6","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-18 13:18:50.000000000","message":"Patch Set 3: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/6942281dac284e3ab369bfb7e78b7c62\n\n\nWarning:\n  Dependency cycle detected and project openstack/keystone-tempest-plugin doesn\u0027t allow circular dependencies","accounts_in_message":[],"_revision_number":3},{"id":"0333610503e2c72bf00b9b6b2965ba77adc225e9","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-18 13:18:50.000000000","message":"Patch Set 3:\n\nBuild failed (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/f177c15b358e49aabd46ae958ada5664\n\n\nWarning:\n  Dependency cycle detected and project openstack/keystone-tempest-plugin doesn\u0027t allow circular dependencies","accounts_in_message":[],"_revision_number":3},{"id":"8642c03ae5ab65249011dffdfcd672d588a03f48","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-06-18 13:30:50.000000000","message":"Patch Set 3:\n\n(1 comment)\n\nThis change is ready for review.","accounts_in_message":[],"_revision_number":3},{"id":"fb5fcf65d66dfe817ffc2f9347aa8f7956c28931","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-18 15:04:47.000000000","message":"Patch Set 3: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/6e30fd92475441b88dff979d4c185543\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/92d6a8522cfe4ea5ae0fa426f63cab7f : SUCCESS in 19m 21s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/fa08d4a36f3a4f20ad151615337e1b96 : SUCCESS in 5m 38s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/a4f07135c87f4a108b076e4dac566f5b : SUCCESS in 11m 28s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/0deeb7612dda4fd1b79c5dba158de7f4 : SUCCESS in 8m 18s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/82d8e02958044593aed7362cd9757bbc : SUCCESS in 15m 22s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/8652db40c7ea49a0b36be0142ae2c705 : SUCCESS in 9m 07s\n- grenade https://zuul.opendev.org/t/openstack/build/c41aa72b466a4eb0ac7aad345b119726 : SUCCESS in 31m 43s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/d25ba9edf5e2488b93f66ff732d1ce64 : SUCCESS in 1h 29m 56s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/502dde2c2be248d085f4962b4d8ea721 : SUCCESS in 14m 01s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/86186164916e4d5c80bf22bc2c777005 : FAILURE in 11m 46s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/b131ee4b9bdc46dba2c7bc521e228610 : SUCCESS in 13m 52s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/5e164060685e4e55bf87e3b4982d4362 : FAILURE in 15m 22s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/1d7fdc3fabd841e190959b3fcf271fd9 : FAILURE in 28m 28s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/fc06a6f05d1d40a4b273397142078c66 : SUCCESS in 34m 45s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/77c1a409384944558f6a01f68ee1a52b : SUCCESS in 14m 53s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/a78f8a7e784c40b989a189480abb6876 : SUCCESS in 37m 43s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/8cafbb31a9924d6fb57842c26ec124e9 : SUCCESS in 32m 21s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/c5d01a8e56004accb6ce6d94d4648391 : SUCCESS in 18m 52s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/e7dd20352bd24678970b73da14b0aae9 : SUCCESS in 9m 48s (non-voting)","accounts_in_message":[],"_revision_number":3},{"id":"f1fd8224005f6ff0a3c31229984a8709c7a6b3a2","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-06-18 16:30:02.000000000","message":"Patch Set 3:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/812bac0cfb58415989ba99a2943507bf\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/c5567011a68243adb382f9a7a2038b9c : SUCCESS in 32m 07s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/ba0c1920375743d4a00386688b18f98b : SUCCESS in 15m 41s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/87938c902f904cd486d3ec3eb192e109 : SUCCESS in 34m 24s (non-voting)","accounts_in_message":[],"_revision_number":3},{"id":"812fc00a14282b11b957d7297be3ea2ec1cf6b62","author":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"},"date":"2026-07-08 10:39:58.000000000","message":"Patch Set 3: Code-Review+2","accounts_in_message":[],"_revision_number":3},{"id":"aa6b021d980b0b5b78aac32aef739c37a66b08fd","author":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"},"date":"2026-07-27 18:36:20.000000000","message":"Patch Set 3: Code-Review+2 Workflow+1","accounts_in_message":[],"_revision_number":3}],"current_revision_number":3,"current_revision":"fa43c4b3df85999e87cb59285d2eed814c6a9893","revisions":{"a6b886a9a2bc342261564cda5305d5c2c254f114":{"kind":"REWORK","_number":1,"created":"2026-06-17 14:36:30.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/64/993764/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/64/993764/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/64/993764/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/64/993764/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/64/993764/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/64/993764/1"}}},"commit":{"parents":[{"commit":"4172e784581e71b468325c05f4e9023c0fefd9b5","subject":"Materialize limit backend queries in read sessions","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/4172e784581e71b468325c05f4e9023c0fefd9b5"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-06-17 14:32:32.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-06-17 14:35:41.000000000","tz":120},"subject":"Enforce domain scope for domain-targeted role grants","message":"Enforce domain scope for domain-targeted role grants\n\nWhen granting a domain-specific role (one with a non-null domain_id)\non a domain target, Keystone only verified that the target domain\nexists. It did not check that the role\u0027s domain matches the target\ndomain, unlike the equivalent grant on a project which correctly\nraises DomainSpecificRoleMismatch.\n\nThis allowed a full administrator to store a logically invalid grant\nwhere a role scoped to domain A was assigned within domain B. The\ntoken issuance engine filtered such grants out, so no privileges were\ngranted in practice, but the inconsistency polluted the assignment\nstore and could confuse operators reviewing role assignments.\n\nAdd the missing validation and extend DomainSpecificRoleMismatch to\naccept a generic target_type/target_id pair so the same exception\ncovers both project and domain grant contexts.\n\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nChange-Id: I3bf233aa609900443fc1094c6985a608cfab97e1\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a6b886a9a2bc342261564cda5305d5c2c254f114"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a6b886a9a2bc342261564cda5305d5c2c254f114"}]},"branch":"refs/heads/master"},"2fa09c60a63d50f75607d0929828c99032c04eee":{"kind":"REWORK","_number":2,"created":"2026-06-17 14:42:17.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/64/993764/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/64/993764/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/64/993764/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/64/993764/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/64/993764/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/64/993764/2"}}},"commit":{"parents":[{"commit":"4172e784581e71b468325c05f4e9023c0fefd9b5","subject":"Materialize limit backend queries in read sessions","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/4172e784581e71b468325c05f4e9023c0fefd9b5"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-06-17 14:32:32.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-06-17 14:40:43.000000000","tz":120},"subject":"Enforce domain scope for domain-targeted role grants","message":"Enforce domain scope for domain-targeted role grants\n\nWhen granting a domain-specific role (one with a non-null domain_id)\non a domain target, Keystone only verified that the target domain\nexists. It did not check that the role\u0027s domain matches the target\ndomain, unlike the equivalent grant on a project which correctly\nraises DomainSpecificRoleMismatch.\n\nThis allowed a full administrator to store a logically invalid grant\nwhere a role scoped to domain A was assigned within domain B. The\ntoken issuance engine filtered such grants out, so no privileges were\ngranted in practice, but the inconsistency polluted the assignment\nstore and could confuse operators reviewing role assignments.\n\nAdd the missing validation and extend DomainSpecificRoleMismatch to\naccept a generic target_type/target_id pair so the same exception\ncovers both project and domain grant contexts.\n\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nChange-Id: I3bf233aa609900443fc1094c6985a608cfab97e1\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/2fa09c60a63d50f75607d0929828c99032c04eee"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/2fa09c60a63d50f75607d0929828c99032c04eee"}]},"branch":"refs/heads/master"},"fa43c4b3df85999e87cb59285d2eed814c6a9893":{"kind":"NO_CODE_CHANGE","_number":3,"created":"2026-06-18 13:18:48.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/64/993764/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/64/993764/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/64/993764/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/64/993764/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/64/993764/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/64/993764/3"}}},"commit":{"parents":[{"commit":"4172e784581e71b468325c05f4e9023c0fefd9b5","subject":"Materialize limit backend queries in read sessions","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/4172e784581e71b468325c05f4e9023c0fefd9b5"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-06-17 14:32:32.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-06-18 13:18:01.000000000","tz":120},"subject":"Enforce domain scope for domain-targeted role grants","message":"Enforce domain scope for domain-targeted role grants\n\nWhen granting a domain-specific role (one with a non-null domain_id)\non a domain target, Keystone only verified that the target domain\nexists. It did not check that the role\u0027s domain matches the target\ndomain, unlike the equivalent grant on a project which correctly\nraises DomainSpecificRoleMismatch.\n\nThis allowed a full administrator to store a logically invalid grant\nwhere a role scoped to domain A was assigned within domain B. The\ntoken issuance engine filtered such grants out, so no privileges were\ngranted in practice, but the inconsistency polluted the assignment\nstore and could confuse operators reviewing role assignments.\n\nAdd the missing validation and extend DomainSpecificRoleMismatch to\naccept a generic target_type/target_id pair so the same exception\ncovers both project and domain grant contexts.\n\nDepends-On: https://review.opendev.org/c/openstack/keystone-tempest-plugin/+/993910\n\nAssisted-by: Claude Sonnet 4.6 \u003cnoreply@anthropic.com\u003e\nChange-Id: I3bf233aa609900443fc1094c6985a608cfab97e1\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/fa43c4b3df85999e87cb59285d2eed814c6a9893"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/fa43c4b3df85999e87cb59285d2eed814c6a9893"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY","applied_by":{"_account_id":27900,"name":"Artem Goncharov","email":"artem.goncharov@gmail.com","username":"gtema"}},{"label":"Workflow","status":"MAY","applied_by":{"_account_id":7414,"name":"David Wilde","email":"dwilde@redhat.com","username":"d34dh0r53"}}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Code-Review\u003dMAX"],"failing_atoms":["label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"SATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":true,"status":"PASS","passing_atoms":["label:Workflow\u003dMAX"],"failing_atoms":["label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}