Skip to content

feat(domain-config): Add resolution layer - #1199

Merged
gtema merged 2 commits into
mainfrom
feat/domain-config-resolution
Sep 3, 2026
Merged

feat(domain-config): Add resolution layer#1199
gtema merged 2 commits into
mainfrom
feat/domain-config-resolution

Conversation

@gtema

@gtema gtema commented Sep 3, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

What

Phase 3 of #954 (tracked as #958): the layer in crates/core/ that builds a
domain's effective stored configuration by merging the two sources with
precedence.

  • DomainConfig::overlay / overlaid_with (core-types) — merge one
    configuration onto another option by option: an option the overlay sets wins,
    an option only the base sets is kept, a group on one side only is taken whole.
  • DomainConfigResolver (core/src/domain_config/resolver.rs) — consults
    the fs driver first, then the sql driver (which overrides option by
    option), each gated by a switch. Returns the raw, still-serializable
    DomainConfig the config API serves; %(option)s substitution and the
    global [identity]/[ldap] overlay are left to the caller (Phase 5, Phase 5: Wire domain config into identity driver selection #960),
    since those steps inline secrets.
  • Two new [identity] switches, matching python-keystone:
    • domain_specific_drivers_enabled (default false) — consult the file source
    • domain_configurations_from_database (default true) — consult the DB source
  • Wiring: PluginManager gains a domain_config_backends registry and a
    get_domain_config_backend(name) accessor; Provider builds the resolver in
    Provider::new and exposes it via get_domain_config_resolver.

Not in scope

Nothing consumes the resolver at runtime yet — same posture as the #956/#957
drivers. API handlers are #959; identity-driver dispatch is #960.

Tests

  • core-types — overlay module: DB-wins-per-option, file-only-option-kept,
    single-side-group-whole, sensitive option, empty overlay. Anti-drift
    every_configurable_option_is_an_option_of_the_config_section stays green.
  • core — domain_config::resolver: no source, disabled, file-only, db-only,
    db-overrides-file, Ok(None) contributes nothing, error propagates.
  • keystone — plugin_manager: both fs and sql register; unknown name →
    UnsupportedDriver.
  • cargo fmt --all -- --check, cargo build -p openstack-keystone,
    cargo clippy on core-types/config clean.

@gtema
feat(domain-config): Add resolution layer
12e0bf2 
Add the layer that builds a domain's effective stored configuration by
merging the two sources with precedence: the per-domain files (the "fs"
driver) first, then the database (the "sql" driver), which wins option by
option.

The layer is gated by two new [identity] switches, matching
python-keystone: domain_specific_drivers_enabled (default false) consults
the file source, domain_configurations_from_database (default true)
consults the database source.

DomainConfig::overlay merges one configuration onto another at the option
level. DomainConfigResolver consults each enabled backend and stacks the
results; it returns the raw, still-serializable DomainConfig the config
API serves, leaving %(option)s substitution and the global-section
overlay to the caller.

The resolver is wired into Provider (built in Provider::new, exposed via
get_domain_config_resolver) and PluginManager gains a
domain_config_backends registry, but nothing consumes it at runtime yet.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
@gtema gtema linked an issue Sep 3, 2026 that may be closed by this pull request
Phase 3: Domain config resolution logic #958
Closed
@gtema
fix(domain-config): Register-test without fernet keys
cc50015 
The plugin-manager test built a full PluginManager from the default
config, which fails in CI because that path loads on-disk fernet keys
that a default config does not provide.

Exercise register_backends directly on a domain-config-typed map
instead: it proves both the fs and sql sources register, without
pulling in the token drivers.

Assisted-By: Claude <noreply@anthropic.com>
Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
@gtema
gtema enabled auto-merge September 3, 2026 17:31
@github-actions

github-actions Bot commented Sep 3, 2026 •
edited
Loading

Copy link
Copy Markdown

🐰 Bencher Report

Projectkeystone
Branchfeat/domain-config-resolution
Testbedubuntu-latest
Click to view all benchmark results
BenchmarkLatencyBenchmark Result
nanoseconds (ns)
(Result Δ%)		Upper Boundary
nanoseconds (ns)
(Limit %)
Command_Serde/apply/remove📈 view plot
🚷 view threshold		135,370.00 ns
(-53.06%)Baseline: 288,385.55 ns
1,535,950.07 ns
(8.81%)
Command_Serde/apply/set📈 view plot
🚷 view threshold		148,660.00 ns
(-58.04%)Baseline: 354,253.34 ns
2,361,901.08 ns
(6.29%)
Command_Serde/pack/delete📈 view plot
🚷 view threshold		128.93 ns
(+8.86%)Baseline: 118.43 ns
155.30 ns
(83.02%)
Command_Serde/pack/delete_index📈 view plot
🚷 view threshold		108.61 ns
(+2.80%)Baseline: 105.65 ns
139.02 ns
(78.13%)
Command_Serde/pack/set📈 view plot
🚷 view threshold		204.10 ns
(+7.63%)Baseline: 189.62 ns
244.75 ns
(83.39%)
Command_Serde/pack/set_index📈 view plot
🚷 view threshold		108.92 ns
(+3.08%)Baseline: 105.67 ns
139.28 ns
(78.20%)
Command_Serde/unpack/delete📈 view plot
🚷 view threshold		196.53 ns
(+4.40%)Baseline: 188.25 ns
268.72 ns
(73.14%)
Command_Serde/unpack/delete_index📈 view plot
🚷 view threshold		158.62 ns
(+1.31%)Baseline: 156.56 ns
217.54 ns
(72.92%)
Command_Serde/unpack/set📈 view plot
🚷 view threshold		294.76 ns
(+13.09%)Baseline: 260.65 ns
354.56 ns
(83.13%)
Command_Serde/unpack/set_index📈 view plot
🚷 view threshold		159.53 ns
(+3.51%)Baseline: 154.12 ns
211.72 ns
(75.35%)
Payload_encryption/pack/remove_cmd📈 view plot
🚷 view threshold		116.36 ns
(+2.80%)Baseline: 113.19 ns
149.23 ns
(77.98%)
Payload_encryption/pack/set_cmd📈 view plot
🚷 view threshold		195.17 ns
(-1.08%)Baseline: 197.30 ns
262.81 ns
(74.26%)
Payload_encryption/unpack/remove_cmd📈 view plot
🚷 view threshold		200.60 ns
(+1.92%)Baseline: 196.83 ns
282.07 ns
(71.12%)
Payload_encryption/unpack/set_cmd📈 view plot
🚷 view threshold		302.43 ns
(+11.70%)Baseline: 270.76 ns
373.05 ns
(81.07%)
Raft_1Node_Latency/prefix/1node📈 view plot
🚷 view threshold		2,570,700.00 ns
(-15.66%)Baseline: 3,048,191.41 ns
7,901,872.76 ns
(32.53%)
Raft_1Node_Latency/read/1node📈 view plot
🚷 view threshold		41,827.00 ns
(+12.22%)Baseline: 37,271.61 ns
51,541.38 ns
(81.15%)
Raft_1Node_Latency/remove/1node📈 view plot
🚷 view threshold		390,980.00 ns
(-67.47%)Baseline: 1,201,849.53 ns
11,516,328.35 ns
(3.40%)
Raft_1Node_Latency/write/1node📈 view plot
🚷 view threshold		412,460.00 ns
(-52.43%)Baseline: 867,033.44 ns
6,200,668.52 ns
(6.65%)
build_snapshot/default📈 view plot
🚷 view threshold		114,400.00 ns
(-10.20%)Baseline: 127,399.11 ns
289,922.30 ns
(39.46%)
fernet token/project📈 view plot
🚷 view threshold		1,509.20 ns
(+5.50%)Baseline: 1,430.58 ns
1,801.97 ns
(83.75%)
get_data_keyspace📈 view plot
🚷 view threshold		0.31 ns
(-1.57%)Baseline: 0.32 ns
0.39 ns
(80.18%)
get_db📈 view plot
🚷 view threshold		0.31 ns
(-1.68%)Baseline: 0.32 ns
0.39 ns
(80.11%)
get_fernet_token_timestamp/project📈 view plot
🚷 view threshold		153.15 ns
(+9.60%)Baseline: 139.73 ns
179.63 ns
(85.26%)
get_keyspace📈 view plot
🚷 view threshold		4.37 ns
(-24.47%)Baseline: 5.78 ns
13.45 ns
(32.49%)
🐰 View full continuous benchmarking report in Bencher

@github-actions

github-actions Bot commented Sep 3, 2026

Copy link
Copy Markdown

🦢 Load Test Results

Goose Attack Report

Plan Overview

Action Started Stopped Elapsed Users
Increasing 26-09-03 17:51:14 26-09-03 17:51:36 00:00:22 0 → 45
Maintaining 26-09-03 17:51:36 26-09-03 17:52:06 00:00:30 45
Decreasing 26-09-03 17:52:06 26-09-03 17:52:07 00:00:01 0 ← 45

Request Metrics

Method Name # Requests # Fails Average (ms) Min (ms) Max (ms) RPS Failures/s
DELETE DELETE /v3/auth/tokens 45 0 550.16 93 820 1.50 0.00
DELETE DELETE /v3/projects/:id (teardown) 1 0 144.00 144 144 0.03 0.00
DELETE DELETE /v3/roles/:id (teardown) 1 0 225.00 225 225 0.03 0.00
DELETE DELETE /v3/users/:id (teardown) 2 0 122.50 97 148 0.07 0.00
DELETE DELETE /v4/mappings/rulesets/:mapping_id (teardown) 1 0 433.00 433 433 0.03 0.00
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown) 1 0 387.00 387 387 0.03 0.00
GET 596 0 591.29 280 923 19.87 0.00
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 2024 2024 14.62 1 744 67.47 67.47
GET GET /v3/auth/tokens (validate new) 43 0 553.30 304 760 1.43 0.00
GET GET /v3/auth/tokens (validate revoked) 45 0 490.93 25 771 1.50 0.00
GET GET /v3/projects/:id 55 0 559.87 358 796 1.83 0.00
GET GET /v3/projects/:id (catalog) 81 0 572.30 377 820 2.70 0.00
GET GET /v3/role_assignments 42 0 581.67 444 746 1.40 0.00
GET GET /v3/role_assignments?role.id 40 0 556.95 395 757 1.33 0.00
GET GET /v3/role_assignments?scope.domain.id 42 0 529.71 304 705 1.40 0.00
GET GET /v3/role_assignments?user.id 42 0 545.86 363 700 1.40 0.00
GET GET /v3/roles 109 0 560.38 355 830 3.63 0.00
GET GET /v3/roles/:id 55 0 560.11 341 761 1.83 0.00
GET GET /v3/users/:id 105 0 581.03 381 842 3.50 0.00
GET GET /v3/users/:id (catalog) 101 0 587.95 436 785 3.37 0.00
GET GET /v4/api-keys 27 0 545.74 414 754 0.90 0.00
GET GET /v4/api-keys/:client_id 27 0 592.67 444 759 0.90 0.00
GET GET /v4/mappings/rulesets 28 0 559.89 380 785 0.93 0.00
GET GET /v4/mappings/rulesets/:mapping_id 28 0 535.39 417 693 0.93 0.00
GET GET /v4/oauth2/:domain_id/.well-known/openid-configuration 855 0 52.68 8 206 28.50 0.00
GET GET /v4/oauth2/:domain_id/clients 27 0 556.37 460 699 0.90 0.00
GET GET /v4/oauth2/:domain_id/clients/:provider_id 27 0 566.37 364 748 0.90 0.00
GET GET /v4/oauth2/:domain_id/jwks 855 0 51.95 13 207 28.50 0.00
GET GET /v4/scim_realms 17 0 544.29 409 758 0.57 0.00
GET GET /v4/scim_realms/:domain_id/:provider_id 18 0 568.28 398 768 0.60 0.00
POST POST /v3/auth/tokens 42 0 521.33 351 693 1.40 0.00
POST POST /v3/auth/tokens (password, invalid) 31 0 990.06 612 1639 1.03 0.00
POST POST /v3/auth/tokens (password, project-scoped) 53 0 1274.77 872 1957 1.77 0.00
POST POST /v3/auth/tokens (password, unscoped) 53 0 1110.58 705 1993 1.77 0.00
POST POST /v3/auth/tokens (rescope to system) 96 0 638.33 388 879 3.20 0.00
POST POST /v3/auth/tokens (rescope, invalid project) 59 0 521.78 362 744 1.97 0.00
POST POST /v3/auth/tokens (system-scoped, bootstrap admin) 49 0 1281.73 755 1766 1.63 0.00
POST POST /v4/api-keys/:client_id/revoke (teardown) 1 0 342.00 342 342 0.03 0.00
PUT PUT /v4/scim_realms/:domain_id/:provider_id 18 0 642.56 470 880 0.60 0.00
Aggregated 5742 2024 240.66 1 1993 191.40 67.47

Response Time Metrics

Method Name 50%ile (ms) 60%ile (ms) 70%ile (ms) 80%ile (ms) 90%ile (ms) 95%ile (ms) 99%ile (ms) 100%ile (ms)
DELETE DELETE /v3/auth/tokens 500 600 600 600 700 700 800 800
DELETE DELETE /v3/projects/:id (teardown) 144 144 144 144 144 144 144 144
DELETE DELETE /v3/roles/:id (teardown) 225 225 225 225 225 225 225 225
DELETE DELETE /v3/users/:id (teardown) 97 97 97 148 148 148 148 148
DELETE DELETE /v4/mappings/rulesets/:mapping_id (teardown) 433 433 433 433 433 433 433 433
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown) 387 387 387 387 387 387 387 387
GET 600 600 600 700 700 800 800 900
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 6 8 9 12 17 22 370 700
GET GET /v3/auth/tokens (validate new) 500 500 600 600 700 700 760 760
GET GET /v3/auth/tokens (validate revoked) 500 500 600 600 600 700 771 771
GET GET /v3/projects/:id 500 600 600 600 700 700 796 796
GET GET /v3/projects/:id (catalog) 600 600 600 600 700 700 700 800
GET GET /v3/role_assignments 600 600 600 700 700 700 700 700
GET GET /v3/role_assignments?role.id 600 600 600 600 600 700 757 757
GET GET /v3/role_assignments?scope.domain.id 500 600 600 600 700 700 700 700
GET GET /v3/role_assignments?user.id 500 600 600 600 700 700 700 700
GET GET /v3/roles 600 600 600 600 700 700 700 800
GET GET /v3/roles/:id 600 600 600 600 700 700 700 761
GET GET /v3/users/:id 600 600 600 700 700 700 800 800
GET GET /v3/users/:id (catalog) 600 600 600 700 700 700 785 785
GET GET /v4/api-keys 500 600 600 600 700 754 754 754
GET GET /v4/api-keys/:client_id 600 600 600 700 700 700 759 759
GET GET /v4/mappings/rulesets 600 600 600 600 600 700 785 785
GET GET /v4/mappings/rulesets/:mapping_id 500 600 600 600 600 600 693 693
GET GET /v4/oauth2/:domain_id/.well-known/openid-configuration 47 53 61 71 89 100 140 206
GET GET /v4/oauth2/:domain_id/clients 600 600 600 600 600 699 699 699
GET GET /v4/oauth2/:domain_id/clients/:provider_id 600 600 600 600 700 700 700 700
GET GET /v4/oauth2/:domain_id/jwks 46 52 61 74 87 110 140 207
GET GET /v4/scim_realms 500 500 600 600 600 700 758 758
GET GET /v4/scim_realms/:domain_id/:provider_id 600 600 600 600 700 700 768 768
POST POST /v3/auth/tokens 500 500 600 600 600 693 693 693
POST POST /v3/auth/tokens (password, invalid) 1,000 1,000 1,000 1,000 1,000 1,000 1,639 1,639
POST POST /v3/auth/tokens (password, project-scoped) 1,000 1,000 1,000 1,000 1,957 1,957 1,957 1,957
POST POST /v3/auth/tokens (password, unscoped) 1,000 1,000 1,000 1,000 1,000 1,000 1,993 1,993
POST POST /v3/auth/tokens (rescope to system) 600 700 700 700 700 800 800 879
POST POST /v3/auth/tokens (rescope, invalid project) 500 500 500 600 600 600 700 700
POST POST /v3/auth/tokens (system-scoped, bootstrap admin) 1,000 1,000 1,000 1,000 1,766 1,766 1,766 1,766
POST POST /v4/api-keys/:client_id/revoke (teardown) 342 342 342 342 342 342 342 342
PUT PUT /v4/scim_realms/:domain_id/:provider_id 700 700 700 700 700 700 880 880
Aggregated 47 79 480 600 600 700 1,000 1,993

Status Code Metrics

Method Name Status Codes
DELETE DELETE /v3/auth/tokens 45 [204]
DELETE DELETE /v3/projects/:id (teardown) 1 [204]
DELETE DELETE /v3/roles/:id (teardown) 1 [204]
DELETE DELETE /v3/users/:id (teardown) 2 [204]
DELETE DELETE /v4/mappings/rulesets/:mapping_id (teardown) 1 [204]
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown) 1 [204]
GET 596 [200]
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 31 [401], 1,993 [429]
GET GET /v3/auth/tokens (validate new) 43 [200]
GET GET /v3/auth/tokens (validate revoked) 45 [404]
GET GET /v3/projects/:id 55 [200]
GET GET /v3/projects/:id (catalog) 81 [200]
GET GET /v3/role_assignments 42 [200]
GET GET /v3/role_assignments?role.id 40 [200]
GET GET /v3/role_assignments?scope.domain.id 42 [200]
GET GET /v3/role_assignments?user.id 42 [200]
GET GET /v3/roles 109 [200]
GET GET /v3/roles/:id 55 [200]
GET GET /v3/users/:id 105 [200]
GET GET /v3/users/:id (catalog) 101 [200]
GET GET /v4/api-keys 27 [200]
GET GET /v4/api-keys/:client_id 27 [200]
GET GET /v4/mappings/rulesets 28 [200]
GET GET /v4/mappings/rulesets/:mapping_id 28 [200]
GET GET /v4/oauth2/:domain_id/.well-known/openid-configuration 855 [200]
GET GET /v4/oauth2/:domain_id/clients 27 [200]
GET GET /v4/oauth2/:domain_id/clients/:provider_id 27 [200]
GET GET /v4/oauth2/:domain_id/jwks 855 [200]
GET GET /v4/scim_realms 17 [200]
GET GET /v4/scim_realms/:domain_id/:provider_id 18 [200]
POST POST /v3/auth/tokens 42 [201]
POST POST /v3/auth/tokens (password, invalid) 31 [401]
POST POST /v3/auth/tokens (password, project-scoped) 53 [201]
POST POST /v3/auth/tokens (password, unscoped) 53 [201]
POST POST /v3/auth/tokens (rescope to system) 96 [201]
POST POST /v3/auth/tokens (rescope, invalid project) 59 [401]
POST POST /v3/auth/tokens (system-scoped, bootstrap admin) 49 [201]
POST POST /v4/api-keys/:client_id/revoke (teardown) 1 [200]
PUT PUT /v4/scim_realms/:domain_id/:provider_id 18 [200]
Aggregated 45 [404], 293 [201], 51 [204], 3,239 [200], 121 [401], 1,993 [429]

Transaction Metrics

Transaction # Times Run # Fails Average (ms) Min (ms) Max (ms) RPS Failures/s
ReadHeavy
0.0 0 0 0.00 0 0 0.00 0.00
0.1 106 0 601.23 398 923 3.53 0.00
0.2 106 0 558.78 280 793 3.53 0.00
0.3 108 0 562.09 369 784 3.60 0.00
TokenLifecycle
1.0 0 0 0.00 0 0 0.00 0.00
1.1 45 0 2118.89 1021 2458 1.50 0.00
ValidateToken
2.0 0 0 0.00 0 0 0.00 0.00
2.1 93 0 664.44 383 922 3.10 0.00
UserCRUD
3.0 0 0 0.00 0 0 0.00 0.00
3.1 0 0 0.00 0 0 0.00 0.00
3.2 105 0 581.05 381 842 3.50 0.00
3.3 2 0 122.50 97 148 0.07 0.00
ProjectCRUD
4.0 0 0 0.00 0 0 0.00 0.00
4.1 0 0 0.00 0 0 0.00 0.00
4.2 55 0 559.89 358 796 1.83 0.00
4.3 1 0 144.00 144 144 0.03 0.00
RoleCRUD
5.0 0 0 0.00 0 0 0.00 0.00
5.1 0 0 0.00 0 0 0.00 0.00
5.2 55 0 560.15 342 761 1.83 0.00
5.3 1 0 225.00 225 225 0.03 0.00
RoleList
6.0 0 0 0.00 0 0 0.00 0.00
6.1 109 0 560.40 355 830 3.63 0.00
RoleAssignmentList
7.0 0 0 0.00 0 0 0.00 0.00
7.1 42 0 581.74 444 746 1.40 0.00
7.2 42 0 545.88 363 700 1.40 0.00
7.3 42 0 529.76 304 705 1.40 0.00
7.4 40 0 556.95 395 757 1.33 0.00
UserRead
8.0 0 0 0.00 0 0 0.00 0.00
8.1 103 0 607.72 352 838 3.43 0.00
8.2 101 0 587.99 436 785 3.37 0.00
ProjectRead
9.0 0 0 0.00 0 0 0.00 0.00
9.1 80 0 554.74 409 775 2.67 0.00
9.2 81 0 572.32 377 820 2.70 0.00
PasswordAuth
10.0 53 0 1110.64 705 1993 1.77 0.00
10.1 53 0 1274.83 872 1957 1.77 0.00
PasswordAuthNegative
11.0 31 0 990.19 613 1639 1.03 0.00
Rescope
12.0 0 0 0.00 0 0 0.00 0.00
12.1 96 0 638.40 388 879 3.20 0.00
RescopeNegative
13.0 0 0 0.00 0 0 0.00 0.00
13.1 59 0 521.90 362 744 1.97 0.00
SystemScopeAuth
14.0 49 0 1281.80 755 1766 1.63 0.00
ApiKeyCRUD
15.0 0 0 0.00 0 0 0.00 0.00
15.1 0 0 0.00 0 0 0.00 0.00
15.2 27 0 592.70 444 759 0.90 0.00
15.3 27 0 545.74 414 754 0.90 0.00
15.4 1 0 342.00 342 342 0.03 0.00
MappingCRUD
16.0 0 0 0.00 0 0 0.00 0.00
16.1 0 0 0.00 0 0 0.00 0.00
16.2 28 0 535.46 417 693 0.93 0.00
16.3 28 0 559.89 380 785 0.93 0.00
16.4 1 0 433.00 433 433 0.03 0.00
OAuth2ClientCRUD
17.0 0 0 0.00 0 0 0.00 0.00
17.1 0 0 0.00 0 0 0.00 0.00
17.2 27 0 566.41 364 748 0.90 0.00
17.3 27 0 556.41 460 699 0.90 0.00
17.4 1 0 387.00 387 387 0.03 0.00
OAuth2Discovery
18.0 855 0 51.98 13 207 28.50 0.00
18.1 855 0 52.72 8 206 28.50 0.00
ScimRealmRead
19.0 0 0 0.00 0 0 0.00 0.00
19.1 18 0 568.28 398 768 0.60 0.00
19.2 17 0 544.29 409 758 0.57 0.00
19.3 18 0 642.56 470 880 0.60 0.00
ScimSync
20.0 0 0 0.00 0 0 0.00 0.00
20.1 0 0 0.00 0 0 0.00 0.00
20.2 0 0 0.00 0 0 0.00 0.00
20.3 2024 0 14.65 1 744 67.47 0.00
20.4 2023 0 0.00 0 0 67.43 0.00
20.5 2023 0 0.00 0 0 67.43 0.00
20.6 1 0 0.00 0 0 0.03 0.00
Aggregated 9659 0 143.06 1 2458 321.97 0.00

Scenario Metrics

Transaction # Users # Times Run Average (ms) Min (ms) Max (ms) Scenarios/s Iterations
ReadHeavy 6 104 1729.84 1424 2100 3.47 17.33
TokenLifecycle 3 42 2171.29 1778 2458 1.40 14.00
ValidateToken 2 91 670.37 491 922 3.03 45.50
UserCRUD 2 103 584.59 422 842 3.43 51.50
ProjectCRUD 1 54 563.63 378 796 1.80 54.00
RoleCRUD 1 54 564.19 412 761 1.80 54.00
RoleList 2 107 563.24 388 830 3.57 53.50
RoleAssignmentList 3 40 2226.48 1894 2557 1.33 13.33
UserRead 4 100 1202.49 928 1551 3.33 25.00
ProjectRead 3 78 1132.90 873 1443 2.60 26.00
PasswordAuth 4 51 2389.53 1804 3414 1.70 12.75
PasswordAuthNegative 1 30 991.20 613 1639 1.00 30.00
Rescope 2 94 641.87 464 879 3.13 47.00
RescopeNegative 1 58 524.66 362 744 1.93 58.00
SystemScopeAuth 2 47 1291.57 755 1766 1.57 23.50
ApiKeyCRUD 1 27 1143.04 922 1357 0.90 27.00
MappingCRUD 1 27 1099.41 887 1281 0.90 27.00
OAuth2ClientCRUD 1 27 1134.48 847 1319 0.90 27.00
OAuth2Discovery 3 854 105.21 26 277 28.47 284.67
ScimRealmRead 1 18 1763.39 1519 1954 0.60 18.00
ScimSync 1 2023 14.37 1 744 67.43 2023.00
Aggregated 45 4029 336.57 1 3414 134.30 2932.08

Error Metrics

Method Name # Error
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 49 401 Unauthorized: GET /SCIM/v2/:domain_id/Users (sync reconcile list)
POST POST /SCIM/v2/:domain_id/Users (sync provision) 1 401 Unauthorized: POST /SCIM/v2/:domain_id/Users (sync provision)
POST POST /v3/auth/tokens (password, invalid) 72 401 Unauthorized: POST /v3/auth/tokens (password, invalid)
POST POST /v3/auth/tokens (rescope, invalid project) 150 401 Unauthorized: POST /v3/auth/tokens (rescope, invalid project)
GET GET /v3/auth/tokens (validate revoked) 152 404 Not Found: GET /v3/auth/tokens (validate revoked)
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 2312 429 Too Many Requests: GET /SCIM/v2/:domain_id/Users (sync reconcile list)

View full report

@github-actions

github-actions Bot commented Sep 3, 2026

Copy link
Copy Markdown

🧪 Tempest Identity Compatibility Results (advisory, non-blocking)

rust

Totals
======
Ran: 133 tests in 31.5921 sec.
 - Passed: 65
 - Skipped: 4
 - Expected Fail: 0
 - Unexpected Success: 0
 - Failed: 64
Sum of execute time for each test: 25.3004 sec.
Failed test IDs 
===== FAILED TESTS (target=rust) =====
tempest.api.identity.admin.v3.test_application_credentials.ApplicationCredentialsV3AdminTest.test_create_application_credential_with_roles[id-3b3dd48f-3388-406a-a9e6-4d078a552d0e]
tempest.api.identity.admin.v3.test_credentials.CredentialsTestJSON.test_credentials_create_get_update_delete[id-7cd59bf9-bda4-4c72-9467-d21cab278355,smoke]
tempest.api.identity.admin.v3.test_domains.DomainsTestJSON.test_create_domain_without_description[id-2abf8764-309a-4fa9-bc58-201b799817ad]
tempest.api.identity.admin.v3.test_domains.DomainsTestJSON.test_create_update_delete_domain[id-f2f5b44a-82e8-4dad-8084-0661ea3b18cf,smoke]
tempest.api.identity.admin.v3.test_domains.DomainsTestJSON.test_domain_delete_cascades_content[id-d8d318b7-d1b3-4c37-94c5-3c5ba0b121ea]
tempest.api.identity.admin.v3.test_domains.DomainsTestJSON.test_list_domains_filter_by_enabled[id-3fd19840-65c1-43f8-b48c-51bdd066dff9]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_create_domain_config_and_show_config_groups_and_options[id-9e3ff13c-f597-4f01-9377-d6c06c2a1477]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_create_update_and_delete_domain_config[id-7161023e-5dd0-4612-9da0-1bac6ac30b63]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_create_update_and_delete_domain_config_groups_and_opts[id-c7510fa2-6661-4170-9c6b-4783a80651e9]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_show_default_group_config_and_options[id-11a02bf0-6f94-4380-b3b0-c8dc18fc0d22]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_create_and_show_consumer[id-c8307ea6-a86c-47fd-ae7b-5b3b2caca76d]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_delete_consumer[id-fdfa1b7f-2a31-4354-b2c7-f6ae20554f93]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_list_consumers[id-09ca50de-78f2-4ffb-ac71-f2254036b2b8]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_update_consumer[id-080a9b1a-c009-47c0-9979-5305bf72e3dc]
tempest.api.identity.admin.v3.test_default_project_id.TestDefaultProjectId.test_default_project_id[id-d6110661-6a71-49a7-a453-b5e26640ff6d]
tempest.api.identity.admin.v3.test_domains_negative.DomainsNegativeTestJSON.test_create_domain_with_name_length_over_64[id-37b1bbf2-d664-4785-9a11-333438586eae,negative]
tempest.api.identity.admin.v3.test_domains_negative.DomainsNegativeTestJSON.test_delete_active_domain[gate,id-1f3fbff5-4e44-400d-9ca1-d953f05f609b,negative]
setUpClass (tempest.api.identity.admin.v3.test_endpoint_groups.EndPointGroupsTest)
tempest.api.identity.admin.v3.test_project_tags.IdentityV3ProjectTagsTest.test_list_update_delete_project_tags[id-7c123aac-999d-416a-a0fb-84b915ab10de]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_check_revoke_roles_on_projects_group[id-26021436-d5a4-4256-943c-ded01e0d4b45]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_check_revoke_roles_on_projects_user[id-18b70e45-7687-4b72-8277-b8f1a47d7591]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_check_revoke_roles_on_domains_group[id-c7a8dda2-be50-4fb4-9a9c-e830771078b1]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_check_revoke_roles_on_domains_user[id-4e6f0366-97c8-423c-b2be-41eae6ac91c8]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_revoke_user_roles_on_domain[id-3acf666e-5354-42ac-8e17-8b68893bcd36]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_revoke_user_roles_on_project_tree[id-9f02ccd9-9b57-46b4-8f77-dd5a736f3a06]
tempest.api.identity.admin.v3.test_groups.GroupsV3TestJSON.test_group_users_add_list_delete[id-1598521a-2f36-4606-8df9-30772bd51339,smoke]
tempest.api.identity.admin.v3.test_groups.GroupsV3TestJSON.test_list_user_groups[id-64573281-d26a-4a52-b899-503cb0f4e4ec]
tempest.api.identity.admin.v3.test_projects_negative.ProjectsNegativeStaticTestJSON.test_create_projects_name_length_over_64[id-502b6ceb-b0c8-4422-bf53-f08fdb21e2f0,negative]
tempest.api.identity.admin.v3.test_list_projects.ListProjectsStaticTestJSON.test_list_projects[id-1d830662-22ad-427c-8c3e-4ec854b0af44]
tempest.api.identity.admin.v3.test_list_projects.ListProjectsTestJSON.test_list_projects_with_enabled[id-0fe7a334-675a-4509-b00e-1c4b95d5dae8]
tempest.api.identity.admin.v3.test_list_projects.ListProjectsTestJSON.test_list_projects_with_parent[id-6edc66f5-2941-4a17-9526-4073311c1fac]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_create_is_domain_project[id-a7eb9416-6f9b-4dbb-b71b-7f73aaef59d5]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_project_create_with_parent[id-1854f9c0-70bc-4d11-a08a-1c789d339e3d]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_project_get_equals_list[id-d1db68b6-aebe-4fa0-b79d-d724d2e21162]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_get_trusts_all[id-4773ebd5-ecbf-4255-b8d8-b63e6f72b65d,smoke]
tempest.api.identity.admin.v3.test_list_users.UsersV3TestJSON.test_list_users_with_not_enabled[id-bff8bf2f-9408-4ef5-b63a-753c8c2124eb]
tempest.api.identity.admin.v3.test_tokens.TokensV3TestJSON.test_get_available_domain_scopes[id-ec5ecb05-af64-4c04-ac86-4d9f6f12f185]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_get_trusts_query[id-6268b345-87ca-47c0-9ce3-37792b43403a]
tempest.api.identity.admin.v3.test_tokens.TokensV3TestJSON.test_rescope_token[id-565fa210-1da1-4563-999b-f7b5b67cf112]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_expire[id-0ed14b66-cefd-4b5c-a964-65759453e292]
tempest.api.identity.v3.test_catalog.IdentityCatalogTest.test_catalog_standardization[id-56b57ced-22b8-4127-9b8a-565dfb0207e2]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_impersonate[id-5a0a91a4-baef-4a14-baba-59bf4d7fcace]
tempest.api.identity.admin.v3.test_users.UsersV3TestJSON.test_list_user_projects[id-a831e70c-e35b-430b-92ed-81ebbc5437b8]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_noimpersonate[id-ed2a8779-a7ac-49dc-afd7-30f32f936ed2]
tempest.api.identity.admin.v3.test_users_negative.UsersNegativeTest.test_create_user_for_non_existent_domain[id-e75f006c-89cc-477b-874d-588e4eab4b17,negative]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_assignments_for_domain_roles[id-3859df7e-5b78-4e4d-b10e-214c8953842a]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_assignments_for_implied_roles_create_delete[id-c8828027-df48-4021-95df-b65b92c7429e]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_group_on_domain[id-4bf8a70b-e785-413a-ad53-9f91ce02faa7]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_group_on_project[id-cbf11737-1904-4690-9613-97bcbb3df1c4]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_group_on_system[id-c888fe4f-8018-48db-b959-542225c1b4b6]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_user_on_domain[id-6c9a2940-3625-43a3-ac02-5dcec62ef3bd]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_implied_domain_roles[id-eb1e1c24-1bc4-4d47-9748-e127a1852c82]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_implied_roles_create_check_show_delete[id-c90c316c-d706-4728-bcba-eb1912081b69]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_api_media_types[id-657c1970-4722-4189-8831-7325f3bc4265,smoke]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_api_version_resources[id-b9232f5e-d9e5-4d97-b96c-28d3db4de1bd,smoke]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_identity_v3_existence[id-79aec9ae-710f-4c54-a4fc-3aa25b4feac3]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_list_api_versions[id-721f480f-35b6-46c7-846e-047e6acea0dc,smoke]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_role_create_update_show_list[id-18afc6c0-46cf-4911-824e-9989cc056c3a,smoke]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_create_application_credential[id-8080c75c-eddc-4786-941a-c2da7039ae61]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_create_application_credential_expires[id-852daf0c-42b5-4239-8466-d193d0543ed3]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_list_application_credentials[id-ff0cd457-6224-46e7-b79e-0ada4964a8a6]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_query_application_credentials[id-9bb5e5cc-5250-493a-8869-8b665f6aa5f6]
tempest.api.identity.v3.test_projects.IdentityV3ProjectsTest.test_list_projects_returns_only_authorized_projects[id-86128d46-e170-4644-866a-cc487f699e1d]
tempest.api.identity.v3.test_tokens.TokensV3Test.test_validate_token[id-a9512ac3-3909-48a4-b395-11f438e16260]
===== END FAILED TESTS (target=rust) =====

View full run

@gtema
gtema added this pull request to the merge queue Sep 3, 2026
Merged via the queue into main with commit 8bc3562 Sep 3, 2026
35 checks passed
@openstack-experimental-release-plz openstack-experimental-release-plz Bot mentioned this pull request Sep 3, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

Phase 3: Domain config resolution logic

1 participant

@gtema