keystone (2:25.0.0-0ubuntu1.4) noble-security; urgency=medium

  * SECURITY UPDATE: privilege escalation via restricted application 
    credentials
    - debian/patches/CVE-2026-33551.patch: Restrict EC2 credential creation
      when called through a restricted application credential.
    - debian/patches/CVE-2026-33551-2.patch: Add tests for restricted app
      cred guard
    - debian/patches/CVE-2026-33551-3.patch: Block restricted app creds 
      from creating EC2 credentials via /credentials
    - debian/patches/CVE-2026-33551-4.patch: Block app cred tokens from 
      authorizing OAuth1 requests
    - CVE-2026-33551
  * SECURITY UPDATE: authentication bypass via LDAP disabled users
    - debian/patches/CVE-2026-40683.patch: Convert LDAP user enabled attribute
      to boolean regardless of user_enabled_invert setting
    - CVE-2026-40683
  * SECURITY UPDATE: sensitive information exposure
    - d/p/cve-2026-42998-fix-user-impersonation-app-creds.patch: Fix user
      impersonation for application credentials to prevent credential
      leaks.
    - CVE-2026-42998
  * SECURITY UPDATE: RBAC policy injection in JSON requests
    - d/p/cve-2026-42999-prevent-rbac-bypass-json-query.patch: Prevent
      RBAC bypass by sanitizing JSON queries.
    - CVE-2026-42999
  * SECURITY UPDATE: Privilege escalation via impersonation and trusts
    - d/p/cve-2026-43000-forbid-trust-ops-app-creds.patch: Forbid trust
      operations with application credentials.
    - CVE-2026-43000
  * SECURITY UPDATE: EC2 credentials created with incorrect project scoping
    - d/p/cve-2026-43001-enforce-app-cred-ec2-project-boundary.patch: 
      Enforce application credential EC2 project boundary.
    - CVE-2026-43001
  * SECURITY UPDATE: Federated users maintain access indefinitely 
    - d/p/cve-2026-44394-preserve-expires-at-federated-rescope.patch:
      Preserve the expires_at attribute during federated token rescoping.
    - CVE-2026-44394

 -- Federico Quattrin <federico.quattrin@canonical.com>  Thu, 11 Jun 2026 18:49:06 -0300

keystone (2:25.0.0-0ubuntu1.2) noble; urgency=medium

  * Fix query for all users in a group while using AD nested group searches
    LP: #2112477
    - d/p/lp2112477-Fix-AD-nested-groups-issues.patch

 -- Jorge Merlino <jorge.merlino@canonical.com>  Mon, 01 Dec 2025 19:37:02 -0300

keystone (2:25.0.0-0ubuntu1.1) noble-security; urgency=medium

  * SECURITY UPDATE: Unauthenticated access to EC2/S3 token endpoints can
    grant Keystone authorization (LP: 2119646)
    - d/p/lp2119646.patch: Add a policy to enforce authentication with a
      user in the service group.
    - CVE number pending

 -- Felipe Reyes <felipe.reyes@canonical.com>  Mon, 03 Nov 2025 15:17:13 +0100

keystone (2:25.0.0-0ubuntu1) noble; urgency=medium

  * New upstream release for OpenStack Caracal.

 -- James Page <james.page@ubuntu.com>  Fri, 05 Apr 2024 14:28:04 +0100

keystone (2:25.0.0~rc1-0ubuntu1) noble; urgency=medium

  * New upstream release candidate for OpenStack Caracal.
  * d/p/*: Refresh.

 -- James Page <james.page@ubuntu.com>  Wed, 20 Mar 2024 14:19:05 +0000

keystone (2:24.0.0+git2024011916.adfa92b4-0ubuntu1) noble; urgency=medium

  [ Corey Bryant ]
  * d/gbp.conf, .launchpad.yaml: Sync from cloud-archive-tools for
    caracal.

  [ James Page ]
  * New upstream snapshot for OpenStack Caracal.
  * d/control: Align (Build-)Depends with upstream.
  * d/p/skip-py38-failure.patch: Drop, no longer needed.
  * d/p/ignore-deprecation-warnings.patch,rules: Don't fail tests for
    DeprecationWarnings and skip test that validates this.
  * d/p/notifications-test-config.patch: ensure
    oslo_messaging_notifications configuration group is setup during
    notification tests.
  * d/rules: Add --with sphinxdoc to tidy generated documentation.
  * d/control: Add missing .

 -- James Page <james.page@ubuntu.com>  Mon, 05 Feb 2024 15:48:02 +0000

keystone (2:24.0.0-0ubuntu1) mantic; urgency=medium

  * New upstream release for OpenStack Bobcat.
  * d/control: (Build-)Depend on python3-oslo.i18n version with
    removed deprecated getdefaultlocal() call.

 -- Corey Bryant <corey.bryant@canonical.com>  Wed, 04 Oct 2023 08:59:53 -0400

keystone (2:23.0.0+git2023090509.bc88c28c-0ubuntu1) mantic; urgency=medium

  * New upstream snapshot for OpenStack Bobcat.
  * d/p/drop-blockdiag.patch: Temporarily drop blockdiags until bug fixed
    upstream.
  * d/control: Align (Build-)Depends with upstream.

 -- Corey Bryant <corey.bryant@canonical.com>  Tue, 05 Sep 2023 09:21:42 -0400

keystone (2:23.0.0+git2023071214.093b42a1-0ubuntu1) mantic; urgency=medium

  * d/gbp.conf, .launchpad.yaml: Sync from cloud-archive-tools for
    bobcat.
  * New upstream snapshot for OpenStack Bobcat.
  * d/control: Align (Build-)Depends with upstream.
  * d/p/remove-dependency-on-cryptography-36.0.0.patch: Dropped. Fixed
    in snapshot.

 -- Corey Bryant <corey.bryant@canonical.com>  Wed, 12 Jul 2023 14:28:34 -0400

keystone (2:23.0.0-0ubuntu1) lunar; urgency=medium

  * New upstream release for OpenStack Antelope.
  * d/p/remove-dependency-on-cryptography-36.0.0.patch: Cherry-picked
    from upstream to remove dependency on python3-cryptography 36.0.0.

 -- Corey Bryant <corey.bryant@canonical.com>  Thu, 23 Mar 2023 14:43:05 -0400

keystone (2:22.0.0+git2023030314.c08d9767-0ubuntu1) lunar; urgency=medium

  * d/watch: Drop major version.
  * New upstream snapshot for OpenStack Antelope.
  * d/control: Align (Build-)Depends with upstream.

 -- Corey Bryant <corey.bryant@canonical.com>  Fri, 03 Mar 2023 14:22:29 -0500

keystone (2:22.0.0+git2023011009.7d4047cb-0ubuntu1) lunar; urgency=medium

  * New upstream snapshot for OpenStack Antelope.

 -- Corey Bryant <corey.bryant@canonical.com>  Tue, 10 Jan 2023 09:57:43 -0500

keystone (2:22.0.0-0ubuntu1) kinetic; urgency=medium

  * d/watch: Scope to 22.x.
  * New upstream release for OpenStack Zed.

 -- Corey Bryant <corey.bryant@canonical.com>  Wed, 05 Oct 2022 15:05:43 -0400

keystone (2:21.0.0+git2022091213.1ea9f7557-0ubuntu3) kinetic; urgency=medium

  * d/p/add-missing-manifest.patch: Recursivlely include everything in
    MANIFEST.in rather than risk missing any files. The last update to
    the MANIFEST.in patch didn't include alembic.ini (LP: #1990283).

 -- Corey Bryant <corey.bryant@canonical.com>  Wed, 28 Sep 2022 13:22:45 -0400

keystone (2:21.0.0+git2022091213.1ea9f7557-0ubuntu2) kinetic; urgency=medium

  * d/p/add-missing-manifest.patch: Update MANIFEST.in to include missing
    keystone/common/sql/migrations/ files (LP: #1990283).

 -- Corey Bryant <corey.bryant@canonical.com>  Tue, 20 Sep 2022 09:33:45 -0400

keystone (2:21.0.0+git2022091213.1ea9f7557-0ubuntu1) kinetic; urgency=medium

  * New upstream snapshot for OpenStack Zed.

 -- Corey Bryant <corey.bryant@canonical.com>  Mon, 12 Sep 2022 13:13:22 -0400

keystone (2:21.0.0+git2022071414.d7b1d57ca-0ubuntu1) kinetic; urgency=medium

  * d/rules: Drop --serial as it no longer appears to be necessary.
  * New upstream snapshot for OpenStack Zed.
  * d/control: Ensure openstack-pkg-tools has CIS hardening for log files
    and pkgos_adduser.
  * d/keystone-common.postinst: CIS hardening update to switch adduser to use
    /usr/sbin/nologin when creating system account that does not run a shell.

 -- Corey Bryant <corey.bryant@canonical.com>  Thu, 14 Jul 2022 14:08:22 -0400

keystone (2:21.0.0+git2022060211.7e6d20be5-0ubuntu1) kinetic; urgency=medium

  * New upstream snapshot for OpenStack Zed.
  * d/control: Update standards version to 4.6.1.
  * d/rules: Run tests serially to avoid oslo.config NoSuchOptError.

 -- Corey Bryant <corey.bryant@canonical.com>  Thu, 02 Jun 2022 11:50:36 -0400

keystone (2:21.0.0+git2022050409.884f88148-0ubuntu1) kinetic; urgency=medium

  * New upstream snapshot for OpenStack Zed.

 -- Corey Bryant <corey.bryant@canonical.com>  Wed, 04 May 2022 09:21:41 -0400

keystone (2:21.0.0-0ubuntu1) jammy; urgency=medium

  * d/watch: Scope to 21.x.
  * New upstream release for OpenStack Yoga.

 -- Corey Bryant <corey.bryant@canonical.com>  Wed, 30 Mar 2022 20:48:58 -0400

keystone (2:20.0.0+git2022030313.a3fc9e7c3-0ubuntu1) jammy; urgency=medium

  * New upstream snapshot for OpenStack Yoga.
  * d/control: Align (Build-)Depends with upstream.

 -- Corey Bryant <corey.bryant@canonical.com>  Thu, 03 Mar 2022 13:09:32 -0500

keystone (2:20.0.0+git2022011217.771c943ad-0ubuntu1) jammy; urgency=medium

  * New upstream snapshot for OpenStack Yoga.
  * d/control: Bump debhelper compat to 13.

 -- Corey Bryant <corey.bryant@canonical.com>  Wed, 12 Jan 2022 17:30:07 -0500

keystone (2:20.0.0+git2021120815.2ddf8f321-0ubuntu1) jammy; urgency=medium

  * d/keystone-common.dirs, d/keystone-common.postinst: Create
    /etc/keystone/fernet-keys directory (LP: #1951076).
  * New upstream snapshot for OpenStack Yoga.

 -- Corey Bryant <corey.bryant@canonical.com>  Wed, 08 Dec 2021 15:36:48 -0500

keystone (2:20.0.0-0ubuntu1) impish; urgency=medium

  * d/watch: Scope to 20.x.
  * New upstream release for OpenStack Xena.

 -- Chris MacNaughton <chris.macnaughton@ubuntu.com>  Thu, 07 Oct 2021 07:34:32 +0000

keystone (2:19.0.0+git2021090814.cf5f1e565-0ubuntu1) impish; urgency=medium

  * New upstream release for OpenStack Xena.
  * d/control: Align (Build-)Depends with upstream.

 -- Chris MacNaughton <chris.macnaughton@ubuntu.com>  Thu, 09 Sep 2021 07:59:56 +0000

keystone (2:19.0.0+git2021072116.d1c7759f4-0ubuntu1) impish; urgency=medium

  * New upstream snapshot for OpenStack Xena.

 -- Corey Bryant <corey.bryant@canonical.com>  Wed, 21 Jul 2021 16:55:16 -0400

keystone (2:19.0.0+git2021061112.252733dce-0ubuntu1) impish; urgency=medium

  * New upstream snapshot for OpenStack Xena.

 -- Chris MacNaughton <chris.macnaughton@ubuntu.com>  Fri, 11 Jun 2021 12:51:34 +0000

keystone (2:19.0.0-0ubuntu1) hirsute; urgency=medium

  * New upstream release for OpenStack Wallaby.

 -- Chris MacNaughton <chris.macnaughton@ubuntu.com>  Wed, 14 Apr 2021 14:46:01 +0000

keystone (2:19.0.0~rc1-0ubuntu1) hirsute; urgency=medium

  * d/watch: Scope to 19.x series
  * New upstream release candidate for OpenStack Wallaby.
  * d/control: Align (Build-)Depends with upstream.

 -- Chris MacNaughton <chris.macnaughton@ubuntu.com>  Mon, 29 Mar 2021 14:27:46 +0000

keystone (2:18.0.0+git2021012507.c239cc666-0ubuntu1) hirsute; urgency=medium

  * New upstream snapshot for OpenStack Wallaby.

 -- Chris MacNaughton <chris.macnaughton@ubuntu.com>  Mon, 25 Jan 2021 08:05:30 +0000

keystone (2:18.0.0+git2020120911.b0b93c039-0ubuntu1) hirsute; urgency=medium

  * New upstream snapshot for OpenStack Wallaby.
  * d/control: Align (Build-)Depends with upstream.
  * d/rules: Update PBR_VERSION for new snapshot version format.
  * d/control: Set min BD version of python-oslo.db to 8.5.0+really.8.4.0 to
    align with upper-constraints.

 -- Corey Bryant <corey.bryant@canonical.com>  Wed, 09 Dec 2020 11:51:18 -0500

keystone (2:18.0.0-0ubuntu1) groovy; urgency=medium

  * d/control: Update VCS paths for move to lp:~ubuntu-openstack-dev.
  * d/watch: Scope to 18.x series.
  * New upstream release for OpenStack Victoria.
  * d/control: Align (Build-)Depends with upstream.

 -- Chris MacNaughton <chris.macnaughton@ubuntu.com>  Thu, 15 Oct 2020 14:04:15 +0000

keystone (2:18.0.0~b3~git2020091407.0ba9e3a12-0ubuntu1) groovy; urgency=medium

  * d/control: Remove Breaks/Replaces that are older than Focal (LP: #1878419).
  * New upstream snapshot for OpenStack Victoria.
  * d/control: Align (Build-)Depends with upstream.

 -- Chris MacNaughton <chris.macnaughton@canonical.com>  Mon, 14 Sep 2020 07:22:48 +0000

keystone (2:18.0.0~b2~git2020073017.b187dfd05-0ubuntu1) groovy; urgency=medium

  * New upstream snapshot for OpenStack Victoria.
  * d/control: Align (Build-)Depends with upstream.
  * d/control, d/copyright: Update upstream URL.

 -- Corey Bryant <corey.bryant@canonical.com>  Thu, 30 Jul 2020 17:03:45 -0400

keystone (2:18.0.0~b1~git2020070209.3eb8cafb8-0ubuntu1) groovy; urgency=medium

  * New upstream snapshot for OpenStack Victoria.
  * d/control: Align (Build-)Depends with upstream.
  * d/control, d/rules: Switch to debhelper compat 12.
  * d/control: Update Standards-Version to 4.5.0.

 -- Corey Bryant <corey.bryant@canonical.com>  Thu, 02 Jul 2020 09:33:09 -0400

keystone (2:17.0.0-0ubuntu1) groovy; urgency=medium

  * d/watch: Scope to 17.x series and get tarballs from opendev.org.
  * d/control: Align (Build-)Depends with upstream.
  * d/p/update-babel-requirement.txt: Dropped now that Babel has been
    dropped from upstream requirements.txt.
  * New upstream release for OpenStack Ussuri (LP: #1877642).

 -- Corey Bryant <corey.bryant@canonical.com>  Wed, 13 May 2020 17:10:34 -0400

keystone (2:17.0.0~b3~git2020041013.7bb6314e4-0ubuntu1) focal; urgency=medium

  * New upstream snapshot for OpenStack Ussuri.
  * d/keystone-common.postinst: Set ownership and permissions for all /var/lib
    files and directories.

 -- Corey Bryant <corey.bryant@canonical.com>  Fri, 10 Apr 2020 13:08:43 -0400

keystone (2:17.0.0~b3~git2020032415.9f9040257-0ubuntu2) focal; urgency=medium

  * d/keystone-common.postinst: Set default ownership for /etc/<pkg>
    files/directories to keystone:keystone (LP: #1869132).

 -- Corey Bryant <corey.bryant@canonical.com>  Thu, 26 Mar 2020 11:48:38 -0400

keystone (2:17.0.0~b3~git2020032415.9f9040257-0ubuntu1) focal; urgency=medium

  * New upstream snapshot for OpenStack Ussuri.
  * d/control: Align (Build-)Depends with upstream.
  * d/p/add-version-info.patch: Rebased.
  * d/keystone*.{pre*|post*}: Consolidate and move to keystone-common.postinst,
    do work when called with configure (aligns with other openstack packages),
    and set default ownership/permissions for /etc/<pkg>, /var/lib/<pkg>, and
    /var/log/<pkg> (LP: #1859422).

 -- Corey Bryant <corey.bryant@canonical.com>  Tue, 24 Mar 2020 15:02:12 -0400

keystone (2:17.0.0~b2~git2020020513.99733f172-0ubuntu1) focal; urgency=medium

  * New upstream snapshot for OpenStack Ussuri.

 -- Sahid Orentino Ferdjaoui <sahid.ferdjaoui@canonical.com>  Wed, 05 Feb 2020 14:47:14 +0100

keystone (2:17.0.0~b1~git2019121613.db81fee63-0ubuntu1) focal; urgency=medium

  * New upstream snapshot for OpenStack Ussuri.
  * d/control: Drop remaining py2 BDs.
  * d/rules: Switch to pybuild.
  * d/rules: Update PBR_VERSION to handle ~git versioning.
  * d/p/skip-py38-failure.patch: Skip py38 failure until fixed upstream.

 -- Corey Bryant <corey.bryant@canonical.com>  Mon, 16 Dec 2019 13:15:00 -0500

keystone (2:16.0.0-0ubuntu1) eoan; urgency=medium

  * New upstream release for OpenStack Train.
  * d/keystone-common.install: Drop install of policy.v3cloudsample.json as it
    has been dropped from upstream.

 -- Corey Bryant <corey.bryant@canonical.com>  Wed, 16 Oct 2019 10:52:00 -0400

keystone (2:16.0.0~rc1-0ubuntu1) eoan; urgency=medium

  * d/watch: Track 16.x series.
  * New upstream release candidate for OpenStack Train.
  * d/p/token-consistently-decode-binary-types.patch: Dropped. Fixed in rc1.

 -- Corey Bryant <corey.bryant@canonical.com>  Fri, 27 Sep 2019 09:15:23 -0400

keystone (2:16.0.0~b3~git2019091810.5e35efd55-0ubuntu1) eoan; urgency=medium

  * New upstream snapshot for OpenStack Train.
  * d/control: Align (Build-)Depends with upstream.

 -- Corey Bryant <corey.bryant@canonical.com>  Wed, 18 Sep 2019 10:40:53 +0200

keystone (2:16.0.0~b2~git2019073116.bca92f99b-0ubuntu1) eoan; urgency=medium

  [ Sahid Orentino Ferdjaoui ]
  * New upstream snapshot for OpenStack Train.
  * d/control: Align (Build-)Depends with upstream.
  * d/p/drop-sphinxcontrib-apidoc.patch: Refreshed.

  [ Corey Bryant ]
  * d/control: Align (Build-)Depends with upstream.
  * d/p/drop-sphinxcontrib-apidoc.patch: Dropped. No longer needed with new BD
    for python3-sphinxcontrib.apidoc.


 -- Sahid Orentino Ferdjaoui <sahid.ferdjaoui@canonical.com>  Wed, 31 Jul 2019 16:50:19 +0200

# Older entries have been removed from this changelog.
# To read the complete changelog use `apt changelog keystone-common`.
