)]}'
{"id":"openstack%2Fkeystone~997418","triplet_id":"openstack%2Fkeystone~master~I8a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b","project":"openstack/keystone","branch":"master","hashtags":[],"change_id":"I8a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b","subject":"Deprecate allow_rescope_scoped_token and default to False","status":"NEW","created":"2026-07-15 15:34:18.000000000","updated":"2026-07-17 12:26:57.000000000","submit_type":"MERGE_IF_NECESSARY","mergeable":true,"submittable":false,"total_comment_count":0,"unresolved_comment_count":0,"has_review_started":true,"meta_rev_id":"6cad159d5b42d10d955ad181fbda11f210b27cee","_number":997418,"virtual_id_number":997418,"owner":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"actions":{},"labels":{"Verified":{"recommended":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"all":[{"tag":"autogenerated:zuul:check","value":1,"date":"2026-07-17 12:20:18.000000000","permitted_voting_range":{"min":-2,"max":2},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Fails","-1":"Doesn\u0027t seem to work"," 0":"No score","+1":"Works for me","+2":"Verified"},"description":"","value":1,"default_value":0,"optional":true},"Code-Review":{"all":[{"value":0,"permitted_voting_range":{"min":-1,"max":1},"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-2":"Do not merge","-1":"This patch needs further work before it can be merged"," 0":"No score","+1":"Looks good to me, but someone else must approve","+2":"Looks good to me (core reviewer)"},"description":"","default_value":0,"optional":true},"Workflow":{"all":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}],"values":{"-1":"Work in progress"," 0":"Ready for reviews","+1":"Approved"},"description":"","default_value":0,"optional":true}},"removable_reviewers":[],"reviewers":{"REVIEWER":[{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}]},"pending_reviewers":{},"reviewer_updates":[{"updated":"2026-07-15 17:31:21.000000000","updated_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"reviewer":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"state":"REVIEWER"}],"messages":[{"id":"2ccc81fcfb7555f768b4cd13e794f70cd988ca00","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-07-15 15:34:18.000000000","message":"Uploaded patch set 1.","accounts_in_message":[],"_revision_number":1},{"id":"d81c17e239fa7cd247c43856e0a501b6eefa5018","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-07-15 15:41:50.000000000","message":"Uploaded patch set 2.","accounts_in_message":[],"_revision_number":2},{"id":"89e0484fd2fa22a4a12fe1efa5b65a2872000305","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-07-15 17:31:21.000000000","message":"Patch Set 2: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/b50317860c57409e8df974af8ac3df5d\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/bb5b433b592643ce9d84547594cc16a1 : FAILURE in 20m 15s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/47deab83e7a04dc9a76c50dbbcea14c3 : SUCCESS in 7m 52s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/5847032173824b5aa1cc9e4a3869a184 : FAILURE in 11m 19s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/41bdfcd7d40941a38653071d4e53db13 : FAILURE in 13m 09s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/9da2b29cffd5456cbee5a6e9784b9373 : FAILURE in 16m 44s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/3fada2baa15f464eb4809b6262aa17b4 : SUCCESS in 15m 45s\n- grenade https://zuul.opendev.org/t/openstack/build/4e9193afb96443d698f44bb117e78c4a : SUCCESS in 1h 08m 46s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/a9f7f5c8b7f348178bdac9431f9842ce : SUCCESS in 1h 40m 30s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/ad172ad2860c45b1940020af870c0699 : SUCCESS in 12m 58s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/8455298fa3b94ea2b098103b15613724 : SUCCESS in 15m 40s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/3dc81a42b55a46efa590d9736757eec2 : SUCCESS in 53m 22s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/59bd8818ce61431fbdb4c1afc73ff270 : FAILURE in 25m 39s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/a7e2881c29a643da932e4a04265d307d : FAILURE in 26m 58s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/59128906146d40b89fb146a184ee51f2 : SUCCESS in 51m 51s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/2671bfb7a1bb440ea4482f851b29a46f : SUCCESS in 45m 09s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/d20ccc12f2314d4e9be39d939de4b804 : SUCCESS in 38m 24s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/ce917015ce0d421c95c1df5d1c7b6267 : SUCCESS in 1h 00m 28s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/191514c115ad4c0d858c0d8c3d7e2d41 : SUCCESS in 47m 43s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/c83a72693fb449a6b01353c5371c15fe : SUCCESS in 10m 23s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":2},{"id":"3a13fddf5556fce741045230badfd1aeecd823d2","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-07-15 18:21:40.000000000","message":"Patch Set 2:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/0ac43671e17d408a8cdeee64a4925b56\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/7b0b80dfe54b4f58a6c63c21b89cf8bf : FAILURE in 24m 08s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/5e42c57c9aaa413e8a44ebb3a1f7687b : FAILURE in 18m 05s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/8929bba1844e4cb2b0b666dd07e04843 : FAILURE in 30m 23s (non-voting)","accounts_in_message":[],"_revision_number":2},{"id":"04e9aac7a4483ec26cbcb730f5ebc210c4b1117f","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-07-17 08:06:27.000000000","message":"Uploaded patch set 3: Patch Set 2 was rebased.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":3},{"id":"aa3ec45ccc5d5deb776394bdbd7dbdaf341ec701","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-07-17 08:47:02.000000000","message":"Patch Set 3:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/574ecf060b644df5a0d620bf0b0c2861\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/4fc0dda5d1d8447293121d4eda0933f7 : FAILURE in 26m 21s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/b6ce5873c4074a6c8be6bf9c18a5a3f8 : FAILURE in 23m 42s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/df7ac81a232c49ccb0298ea05345d7a0 : FAILURE in 38m 29s (non-voting)","accounts_in_message":[],"_revision_number":3},{"id":"8c91538070cea332a9094f76ecd136f68159298f","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-07-17 09:48:32.000000000","message":"Patch Set 3: Verified-1\n\nBuild failed (check pipeline).  For information on how to proceed, see\nhttps://docs.opendev.org/opendev/infra-manual/latest/developers.html#automated-testing\nand https://docs.openstack.org/project-team-guide/testing.html#how-to-handle-test-failures\n\nhttps://zuul.opendev.org/t/openstack/buildset/6f370004ec714808aa6db618e78db58f\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/dcf07e610a264102a004c4b3a0bdc93b : FAILURE in 17m 31s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/285d446ced0b4180a608cc7c90e0ba22 : SUCCESS in 5m 44s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/95f96c5a0458492eb916521504a5c3d9 : FAILURE in 11m 24s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/b2f33672f9fb4f23bb8e917f8dc8e92f : FAILURE in 11m 42s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/289ac17bd36940fab1e55995f4cd6ad8 : FAILURE in 15m 23s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/d544b61beec143bc854f95ac99ac4936 : SUCCESS in 10m 07s\n- grenade https://zuul.opendev.org/t/openstack/build/bc2e9c73cd8849a5b55189d6abca414a : SUCCESS in 1h 04m 26s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/5dc8259cbc744741b9a1fb40811ab9cb : SUCCESS in 1h 36m 17s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/83e6e28185bf435f8ea1642f48d69756 : SUCCESS in 13m 14s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/80020309107f491db540a050792c0a67 : SUCCESS in 13m 55s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/ed95dcb16e9c479db634aadcf34f48fc : SUCCESS in 28m 07s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/8183ce615acd44c596d8edb4561c831e : FAILURE in 11m 12s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/0485a490399a4e3fa7b3855c9a4f01e0 : FAILURE in 20m 22s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/56eab659fb844392b48b237d970000b0 : SUCCESS in 45m 56s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/7092cad991e54b049e3b4aeb5610d65d : SUCCESS in 54m 47s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/70dffed16c1e4ff1812e382017679bca : SUCCESS in 24m 37s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/28b5b28959cc48a59fd2afdf05fa81b3 : SUCCESS in 56m 27s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/c2e6dfe4ecea4a8ebc8be5a48aff7a92 : FAILURE in 39m 25s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/99b9930a4a1648e4b98306afc70a1bc3 : SUCCESS in 9m 27s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":3},{"id":"7398ca32f2e14d52987977f718200061d62e2447","tag":"autogenerated:gerrit:newWipPatchSet","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-07-17 10:44:47.000000000","message":"Uploaded patch set 4.\n\nOutdated Votes:\n* Verified-1 (copy condition: \"NEVER\")\n","accounts_in_message":[],"_revision_number":4},{"id":"958081e6c3b952e2451ed95fd048bd5ae62839e0","author":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"date":"2026-07-17 11:48:49.000000000","message":"Patch Set 4:\n\nThis change is ready for review.","accounts_in_message":[],"_revision_number":4},{"id":"08cf23e8ac850e8e0b3d078750e96a205e3d0213","tag":"autogenerated:zuul:check","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-07-17 12:20:18.000000000","message":"Patch Set 4: Verified+1\n\nBuild succeeded (check pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/64e54f1cdcaf48479fa625a2baa8d7e8\n\n- openstack-tox-cover https://zuul.opendev.org/t/openstack/build/7bc18bdf9448482e905697ffdac12aa8 : SUCCESS in 18m 46s\n- openstack-tox-pep8 https://zuul.opendev.org/t/openstack/build/e10fcf4690fd4b64b9821afeb8b89736 : SUCCESS in 5m 27s\n- openstack-tox-py311 https://zuul.opendev.org/t/openstack/build/25204e3994d3432dabecf521e656ef3e : SUCCESS in 11m 40s\n- openstack-tox-py313 https://zuul.opendev.org/t/openstack/build/03c6270cc51b4557bfd3bc5a8aa060d3 : SUCCESS in 12m 25s\n- openstack-tox-py314 https://zuul.opendev.org/t/openstack/build/093fe0138e0241d2b76b26c09fc5d1a1 : SUCCESS in 14m 17s (non-voting)\n- openstack-tox-docs https://zuul.opendev.org/t/openstack/build/951c944142af403797c95fe53472634c : SUCCESS in 14m 30s\n- grenade https://zuul.opendev.org/t/openstack/build/07cce02d9c034164b699f79c10801e43 : SUCCESS in 52m 54s\n- tempest-full-py3 https://zuul.opendev.org/t/openstack/build/c39feb32d2cb46babb0eb4fce4e52689 : SUCCESS in 1h 28m 38s\n- build-openstack-releasenotes https://zuul.opendev.org/t/openstack/build/213a3be645ac430e8577bda7f84686d5 : SUCCESS in 13m 15s\n- keystoneclient-devstack-functional https://zuul.opendev.org/t/openstack/build/b5f061ec63094f909fdb7ac097f31df0 : SUCCESS in 19m 46s (non-voting)\n- keystone-tempest https://zuul.opendev.org/t/openstack/build/7b41c89684264dd7be362b8617e51002 : SUCCESS in 52m 11s\n- keystone-tempest-fips https://zuul.opendev.org/t/openstack/build/fe80536d82c340ec9fe60fdf658a87ee : FAILURE in 22m 45s (non-voting)\n- keystone-tempest-federation https://zuul.opendev.org/t/openstack/build/ca7fc9bcb57949c6963303cdad182657 : FAILURE in 26m 05s (non-voting)\n- keystone-tempest-federation-k2k https://zuul.opendev.org/t/openstack/build/04b893df9311491ab992954e99937f93 : SUCCESS in 41m 01s\n- keystone-tempest-oidc-federation https://zuul.opendev.org/t/openstack/build/e1e59c5cc7f94dcebb2b44c913897145 : SUCCESS in 53m 03s\n- keystone-tempest-ldap-domain-specific-driver https://zuul.opendev.org/t/openstack/build/75bda83b673c4a39be613860cf64f04e : SUCCESS in 29m 16s (non-voting)\n- tempest-ipv6-only https://zuul.opendev.org/t/openstack/build/b911c18866f249f78cae88f0272f950c : SUCCESS in 55m 54s\n- keystone-protection-functional https://zuul.opendev.org/t/openstack/build/c63d03bba7f74134aa5d999a1d54f4c7 : SUCCESS in 45m 29s\n- codegenerator-openapi-identity-tips-with-api-ref https://zuul.opendev.org/t/openstack/build/abe924b7728d44f6ba28d07672dfad32 : SUCCESS in 6m 42s (non-voting)\n\nWarning:\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/cleanup.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.\n  File .ssh/known_hosts.old found in build home directory during playbook opendev.org/opendev/base-jobs/playbooks/base/post-logs.yaml for job keystone-tempest-fips.  Add to preserve-home-paths if safe, or otherwise remove.","accounts_in_message":[],"_revision_number":4},{"id":"6cad159d5b42d10d955ad181fbda11f210b27cee","tag":"autogenerated:zuul:check-arm64","author":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]},"date":"2026-07-17 12:26:57.000000000","message":"Patch Set 4:\n\nBuild succeeded (ARM64 pipeline).\nhttps://zuul.opendev.org/t/openstack/buildset/d4f888fb14844ae194d7af4c9b12b112\n\n- openstack-tox-py311-arm64 https://zuul.opendev.org/t/openstack/build/97e0c7be71324586bc5fb4866a8a9b10 : SUCCESS in 25m 52s (non-voting)\n- openstack-tox-py313-arm64 https://zuul.opendev.org/t/openstack/build/96a41fb3dab043629ac66e51b6dafaef : SUCCESS in 21m 45s (non-voting)\n- openstack-tox-py314-arm64 https://zuul.opendev.org/t/openstack/build/20ef27d7929643049a7f382a41d211f5 : SUCCESS in 30m 39s (non-voting)","accounts_in_message":[],"_revision_number":4}],"current_revision_number":4,"current_revision":"cffa21ed2fccd5fd3c37611059f61dfd2debf1e0","revisions":{"b4f2e14717e5ea7cb8e730967176977e68de2942":{"kind":"REWORK","_number":1,"created":"2026-07-15 15:34:18.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/18/997418/1","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/18/997418/1","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/18/997418/1 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/18/997418/1 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/18/997418/1 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/18/997418/1"}}},"commit":{"parents":[{"commit":"a1ae62006023a8ef7c49827b38668f299a0c3093","subject":"Fix token chain revocation and add user-scoped revocation API","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/a1ae62006023a8ef7c49827b38668f299a0c3093"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-07-15 15:32:49.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-07-15 15:32:49.000000000","tz":120},"subject":"Deprecate allow_rescope_scoped_token and default to False","message":"Deprecate allow_rescope_scoped_token and default to False\n\nRescoping scoped tokens creates token chains deeper than two levels.\nThe Fernet token format only stores two audit IDs (own + root ancestor),\nso revoking a middle token in the chain cannot invalidate its descendants.\nThis is a fundamental limitation of the token format that cannot be fixed\nwithout changing the payload structure.\n\nBy defaulting allow_rescope_scoped_token to False, the token chain is\nalways at most two levels (unscoped -\u003e scoped), and revoking the root\ntoken always covers the entire chain.\n\nThe option is marked deprecated_for_removal. Deployments that rely on\nrescoping should migrate to authenticating for a new token with the\ndesired scope.\n\nRelated-Bug: #2152573\nChange-Id: I8a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/b4f2e14717e5ea7cb8e730967176977e68de2942"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/b4f2e14717e5ea7cb8e730967176977e68de2942"}]},"branch":"refs/heads/master"},"89e1da9bb825d208cf681cbed4259b41d7f66961":{"kind":"REWORK","_number":2,"created":"2026-07-15 15:41:50.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/18/997418/2","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/18/997418/2","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/18/997418/2 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/18/997418/2 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/18/997418/2 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/18/997418/2"}}},"commit":{"parents":[{"commit":"0034d603deec870269507329229f466c29cda8dc","subject":"Fix token chain revocation and add user-scoped revocation API","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/0034d603deec870269507329229f466c29cda8dc"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-07-15 15:32:49.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-07-15 15:40:45.000000000","tz":120},"subject":"Deprecate allow_rescope_scoped_token and default to False","message":"Deprecate allow_rescope_scoped_token and default to False\n\nRescoping scoped tokens creates token chains deeper than two levels.\nThe Fernet token format only stores two audit IDs (own + root ancestor),\nso revoking a middle token in the chain cannot invalidate its descendants.\nThis is a fundamental limitation of the token format that cannot be fixed\nwithout changing the payload structure.\n\nBy defaulting allow_rescope_scoped_token to False, the token chain is\nalways at most two levels (unscoped -\u003e scoped), and revoking the root\ntoken always covers the entire chain.\n\nThe option is marked deprecated_for_removal. Deployments that rely on\nrescoping should migrate to authenticating for a new token with the\ndesired scope.\n\nRelated-Bug: #2152573\nChange-Id: I8a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/89e1da9bb825d208cf681cbed4259b41d7f66961"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/89e1da9bb825d208cf681cbed4259b41d7f66961"}]},"branch":"refs/heads/master"},"1ac83bb82f4e9f6a2b5508d9f188008766e67389":{"kind":"TRIVIAL_REBASE","_number":3,"created":"2026-07-17 08:06:27.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/18/997418/3","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/18/997418/3","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/18/997418/3 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/18/997418/3 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/18/997418/3 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/18/997418/3"}}},"commit":{"parents":[{"commit":"0a902c4ca90f58605156f58bfee0bd70a90ee8b7","subject":"Fix token chain revocation and add user-scoped revocation API","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/0a902c4ca90f58605156f58bfee0bd70a90ee8b7"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-07-15 15:32:49.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-07-17 08:04:26.000000000","tz":120},"subject":"Deprecate allow_rescope_scoped_token and default to False","message":"Deprecate allow_rescope_scoped_token and default to False\n\nRescoping scoped tokens creates token chains deeper than two levels.\nThe Fernet token format only stores two audit IDs (own + root ancestor),\nso revoking a middle token in the chain cannot invalidate its descendants.\nThis is a fundamental limitation of the token format that cannot be fixed\nwithout changing the payload structure.\n\nBy defaulting allow_rescope_scoped_token to False, the token chain is\nalways at most two levels (unscoped -\u003e scoped), and revoking the root\ntoken always covers the entire chain.\n\nThe option is marked deprecated_for_removal. Deployments that rely on\nrescoping should migrate to authenticating for a new token with the\ndesired scope.\n\nRelated-Bug: #2152573\nChange-Id: I8a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/1ac83bb82f4e9f6a2b5508d9f188008766e67389"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/1ac83bb82f4e9f6a2b5508d9f188008766e67389"}]},"branch":"refs/heads/master"},"cffa21ed2fccd5fd3c37611059f61dfd2debf1e0":{"kind":"REWORK","_number":4,"created":"2026-07-17 10:44:47.000000000","uploader":{"_account_id":14250,"name":"Grzegorz Grasza","email":"xek@redhat.com","username":"xek"},"ref":"refs/changes/18/997418/4","fetch":{"anonymous http":{"url":"https://review.opendev.org/openstack/keystone","ref":"refs/changes/18/997418/4","commands":{"Checkout":"git fetch https://review.opendev.org/openstack/keystone refs/changes/18/997418/4 \u0026\u0026 git checkout FETCH_HEAD","Cherry Pick":"git fetch https://review.opendev.org/openstack/keystone refs/changes/18/997418/4 \u0026\u0026 git cherry-pick FETCH_HEAD","Format Patch":"git fetch https://review.opendev.org/openstack/keystone refs/changes/18/997418/4 \u0026\u0026 git format-patch -1 --stdout FETCH_HEAD","Pull":"git pull https://review.opendev.org/openstack/keystone refs/changes/18/997418/4"}}},"commit":{"parents":[{"commit":"0a902c4ca90f58605156f58bfee0bd70a90ee8b7","subject":"Fix token chain revocation and add user-scoped revocation API","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/0a902c4ca90f58605156f58bfee0bd70a90ee8b7"}]}],"author":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-07-15 15:32:49.000000000","tz":120},"committer":{"name":"Grzegorz Grasza","email":"xek@redhat.com","date":"2026-07-17 10:43:02.000000000","tz":120},"subject":"Deprecate allow_rescope_scoped_token and default to False","message":"Deprecate allow_rescope_scoped_token and default to False\n\nRescoping scoped tokens creates token chains deeper than two levels.\nThe Fernet token format only stores two audit IDs (own + root ancestor),\nso revoking a middle token in the chain cannot invalidate its descendants.\nThis is a fundamental limitation of the token format that cannot be fixed\nwithout changing the payload structure.\n\nBy defaulting allow_rescope_scoped_token to False, the token chain is\nalways at most two levels (unscoped -\u003e scoped), and revoking the root\ntoken always covers the entire chain.\n\nThe option is marked deprecated_for_removal. Deployments that rely on\nrescoping should migrate to authenticating for a new token with the\ndesired scope.\n\nRelated-Bug: #2152573\nChange-Id: I8a2b3c4d5e6f7a8b9c0d1e2f3a4b5c6d7e8f9a0b\nSigned-off-by: Grzegorz Grasza \u003cxek@redhat.com\u003e\n","web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/cffa21ed2fccd5fd3c37611059f61dfd2debf1e0"}],"resolve_conflicts_web_links":[{"name":"gitea","tooltip":"Open in GitWeb","url":"https://opendev.org/openstack/keystone/commit/cffa21ed2fccd5fd3c37611059f61dfd2debf1e0"}]},"branch":"refs/heads/master"}},"requirements":[],"submit_records":[{"rule_name":"gerrit~DefaultSubmitRule","status":"OK","labels":[{"label":"Verified","status":"MAY","applied_by":{"_account_id":22348,"name":"Zuul","username":"zuul","tags":["SERVICE_USER"]}},{"label":"Code-Review","status":"MAY"},{"label":"Workflow","status":"MAY"}]}],"submit_requirements":[{"name":"Verified","description":"Verified in gate by CI","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Verified\u003dMAX AND -label:Verified\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Verified\u003dMAX","label:Verified\u003dMIN"],"atom_explanations":{"label:Verified\u003dMAX":"","label:Verified\u003dMIN":""}}},{"name":"Code-Review","description":"Code reviewed by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Code-Review\u003dMAX AND -label:Code-Review\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Code-Review\u003dMAX","label:Code-Review\u003dMIN"],"atom_explanations":{"label:Code-Review\u003dMAX":"","label:Code-Review\u003dMIN":""}}},{"name":"Workflow","description":"Approved for gate by core reviewer","status":"UNSATISFIED","is_legacy":false,"submittability_expression_result":{"expression":"label:Workflow\u003dMAX AND -label:Workflow\u003dMIN","fulfilled":false,"status":"FAIL","passing_atoms":[],"failing_atoms":["label:Workflow\u003dMAX","label:Workflow\u003dMIN"],"atom_explanations":{"label:Workflow\u003dMAX":"","label:Workflow\u003dMIN":""}}}]}