)]}'
{"/PATCHSET_LEVEL":[{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"7ff49d6d28e906aa46d3ee27bd30420191bce7c6","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"3634989a_d81cfa21","updated":"2026-11-06 19:32:55.000000000","message":"According to https://zuul.opendev.org/t/openstack/build/657aa0f4707041ba8c1c4b41f95904e7/console tempauth passes, then Keystone fails.","commit_id":"ffef61764d6ca3cc220be226407f1ff2004f7e14"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"0fa9001b9094f268eb3e07cc42129e302031d728","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":1,"id":"2f0d2a05_e89dea2a","updated":"2026-11-06 18:18:42.000000000","message":"Trying to sort out whether the DSVM failures on https://review.opendev.org/c/openstack/swift/+/1013401 are Keystone-only, or if tempauth is affected, too.","commit_id":"ffef61764d6ca3cc220be226407f1ff2004f7e14"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"ebab263a1cd4411a14ba53c0cbf15712ed43bed1","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"eaefc470_9420786b","updated":"2026-11-06 21:00:40.000000000","message":"Looks like `[filter:authtoken]` needs `service_token_roles \u003d swift_service, service` set -- which is to say, we should backport https://review.opendev.org/c/openstack/swift/+/989336","commit_id":"dfc0dd7c673e08d444e6d69f2b2f55afec835c3a"},{"author":{"_account_id":15343,"name":"Tim Burke","email":"tburke@nvidia.com","username":"tburke"},"change_message_id":"8e273a2e19a339348857ca149fb9494eb79fa0bf","unresolved":false,"context_lines":[],"source_content_type":"","patch_set":2,"id":"b7f50642_e93ce48f","updated":"2026-11-06 20:44:26.000000000","message":"OK, so we\u0027re seeing a bunch of 401s talking to keystone when swift is presented with a service account token. And according to [the build history](https://zuul.opendev.org/t/openstack/builds?job_name\u003dswift-dsvm-functional-ipv6\u0026project\u003dopenstack%2Fswift\u0026branch\u003dstable%2F2026.1), this was working as of 9/29 and started failing on 10/31.\n\nIf it was a keystone change that caused it, that leaves two commits:\n\n- [Fix IdP remote_ids schema maxLength to match SQL](https://github.com/openstack/keystone/commit/f707432105aabe7107a9dd43267b934b3c2535eb)\n- [EC2 credentials: stop client-forged trust_id impersonation](https://github.com/openstack/keystone/commit/8838814d1a0a2369911e1a866e89f384b1be26df)\n\nBut that seems unlikely; neither of those seem to have anything to do with service tokens.\n\nAlternatively, it could be keystonemiddleware; that brings two more commits to consider:\n\n- [Change service_token_roles_required default config](https://github.com/openstack/keystonemiddleware/commit/539da21aec435b1d8c15e6b3e1882b9d02d905c2)\n- [Fix service-token presence bypass of access_rules and token bind](https://github.com/openstack/keystonemiddleware/commit/2be12800c0e8dd9931676b31a8ca43218c67373e)\n\n...but the weird thing is, they\u0027re both pretty clean backports -- so why aren\u0027t master and stable/2026.2 broken?\n\nMaybe the problem is actually down in devstack and how it\u0027s configuring things?","commit_id":"dfc0dd7c673e08d444e6d69f2b2f55afec835c3a"}]}