Skip to content

fix(adr0034): Post implementation fixes - #1223

Merged
gtema merged 8 commits into
mainfrom
claude/per-domain-assignments-provider-k0tp5e
Sep 8, 2026
Merged

fix(adr0034): Post implementation fixes#1223
gtema merged 8 commits into
mainfrom
claude/per-domain-assignments-provider-k0tp5e

Conversation

@gtema

@gtema gtema commented Sep 8, 2026

Copy link
Copy Markdown
Collaborator
  • fix(policy): Restrict assignment domain-config group to cloud admins
  • fix(assignment): Rebuild domain-config resolver on config reload
  • fix(assignment-openfga): Apply a default request timeout
  • fix(assignment-openfga): Read stored tuples for actor-only listings
  • fix(auth): Gate the system-role check with a system_id filter
  • fix(domain-config): Warn when a bound assignment driver is inert
  • fix(config): Redact api_key from OpenFGAAssignmentDriver Debug
  • docs(test): Note the assignment-group policy coverage split

gtema added 8 commits September 8, 2026 16:06
@gtema
fix: Restrict assignment domain-config group to admins
48f57be 
ADR 0034 §6: binding a domain to an assignment backend mints roles and
must not be reachable by a domain-scoped token. The domain-scoped `admin`
and `manager` allow rules now exclude the `assignment` group; writing it
requires a configured admin SVID or a system-scoped `admin`.

Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
@gtema
fix: Rebuild domain-config resolver on config reload
884a788 
The resolver was frozen at construction, so turning
`domain_specific_drivers_enabled` on, or switching `[domain_config]`
sources, never took effect until a restart. Capture the fs and sql
domain-config backend handles and recompute the resolver from them on
every reload, gated on the dispatch switch and an active source.

Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
@gtema
fix: Apply a default request timeout
850719d 
An unset `timeout` left the OpenFGA HTTP client with no cap, so a stalled
store wedges an assignment call and its caller's token issuance
indefinitely. Default to 30s when the configuration omits it.

Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
@gtema
fix: Read stored tuples for actor-only listings
cd2d6dd 
A non-effective actor-only listing was rejected
(`ListingActorWithoutScopeRequiresEffective`), which broke SCIM group
deprovisioning. Issue a type-scoped `read` with a `user` filter per
target type instead -- the actor-keyed counterpart of a target-scoped
listing. SCIM group delete reverts to the plain non-effective listing.

Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
@gtema
fix: Gate the system-role check with a system_id filter
c420f11 
`target_holds_system_role` listed a user's assignments unfiltered and
scanned the result in memory. Pass `system_id` so the query is narrowed
at the driver and routed to the global driver, and re-check the
assignment type as a defence-in-depth gate.

Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
@gtema
fix: Warn when a bound assignment driver is inert
691110a 
A domain bound to a non-sql, non-global assignment driver that no
`[assignment.domains]` block maps to silently resolves to the global
driver. Emit a warning at bind time so the misconfiguration is visible.

Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
@gtema
fix: Redact api_key from OpenFGAAssignmentDriver Debug
fc91360 
The derived `Debug` printed the OpenFGA API key in cleartext wherever the
assignment config was logged. Hand-write `Debug` to render it as
`<redacted>`.

Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
@gtema
docs: Note the assignment-group policy coverage split
dfa7e96 
Record in the api_v3 domain_config test module that the project-scoped
`admin` refusal and the domain-scoped `admin` / `manager` carve-out are
covered by the rego tests and the real-opa handler tests.

Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
@gtema
gtema force-pushed the claude/per-domain-assignments-provider-k0tp5e branch from 23ecd16 to dfa7e96 Compare September 8, 2026 14:07
@github-actions

github-actions Bot commented Sep 8, 2026 •
edited
Loading

Copy link
Copy Markdown

🐰 Bencher Report

Projectkeystone
Branchclaude/per-domain-assignments-provider-k0tp5e
Testbedubuntu-latest
Click to view all benchmark results
BenchmarkLatencyBenchmark Result
nanoseconds (ns)
(Result Δ%)		Upper Boundary
nanoseconds (ns)
(Limit %)
Command_Serde/apply/remove📈 view plot
🚷 view threshold		136,920.00 ns
(-47.25%)Baseline: 259,559.34 ns
1,311,031.97 ns
(10.44%)
Command_Serde/apply/set📈 view plot
🚷 view threshold		158,350.00 ns
(-62.24%)Baseline: 419,380.38 ns
3,209,879.64 ns
(4.93%)
Command_Serde/pack/delete📈 view plot
🚷 view threshold		122.67 ns
(+4.81%)Baseline: 117.04 ns
154.97 ns
(79.16%)
Command_Serde/pack/delete_index📈 view plot
🚷 view threshold		108.85 ns
(+4.28%)Baseline: 104.38 ns
137.27 ns
(79.30%)
Command_Serde/pack/set📈 view plot
🚷 view threshold		213.51 ns
(+12.66%)Baseline: 189.52 ns
244.82 ns
(87.21%)
Command_Serde/pack/set_index📈 view plot
🚷 view threshold		108.80 ns
(+4.26%)Baseline: 104.36 ns
137.62 ns
(79.06%)
Command_Serde/unpack/delete📈 view plot
🚷 view threshold		194.23 ns
(+4.34%)Baseline: 186.16 ns
270.92 ns
(71.69%)
Command_Serde/unpack/delete_index📈 view plot
🚷 view threshold		160.62 ns
(+3.74%)Baseline: 154.83 ns
219.24 ns
(73.26%)
Command_Serde/unpack/set📈 view plot
🚷 view threshold		289.77 ns
(+10.28%)Baseline: 262.77 ns
365.10 ns
(79.37%)
Command_Serde/unpack/set_index📈 view plot
🚷 view threshold		159.64 ns
(+4.71%)Baseline: 152.46 ns
213.79 ns
(74.67%)
Payload_encryption/pack/remove_cmd📈 view plot
🚷 view threshold		115.28 ns
(+3.47%)Baseline: 111.42 ns
150.97 ns
(76.36%)
Payload_encryption/pack/set_cmd📈 view plot
🚷 view threshold		200.78 ns
(+1.27%)Baseline: 198.26 ns
266.03 ns
(75.47%)
Payload_encryption/unpack/remove_cmd📈 view plot
🚷 view threshold		211.01 ns
(+8.25%)Baseline: 194.94 ns
285.15 ns
(74.00%)
Payload_encryption/unpack/set_cmd📈 view plot
🚷 view threshold		300.71 ns
(+10.63%)Baseline: 271.81 ns
380.92 ns
(78.94%)
Raft_1Node_Latency/prefix/1node📈 view plot
🚷 view threshold		2,574,600.00 ns
(-16.35%)Baseline: 3,077,917.80 ns
7,920,498.52 ns
(32.51%)
Raft_1Node_Latency/read/1node📈 view plot
🚷 view threshold		40,270.00 ns
(+8.12%)Baseline: 37,245.34 ns
52,144.08 ns
(77.23%)
Raft_1Node_Latency/remove/1node📈 view plot
🚷 view threshold		389,900.00 ns
(-66.27%)Baseline: 1,156,037.97 ns
11,478,282.95 ns
(3.40%)
Raft_1Node_Latency/write/1node📈 view plot
🚷 view threshold		426,470.00 ns
(-55.76%)Baseline: 963,920.94 ns
7,540,733.87 ns
(5.66%)
build_snapshot/default📈 view plot
🚷 view threshold		113,440.00 ns
(-6.85%)Baseline: 121,778.70 ns
266,982.99 ns
(42.49%)
fernet token/project📈 view plot
🚷 view threshold		1,449.50 ns
(+2.44%)Baseline: 1,415.02 ns
1,818.00 ns
(79.73%)
get_data_keyspace📈 view plot
🚷 view threshold		0.31 ns
(+0.02%)Baseline: 0.31 ns
0.39 ns
(80.66%)
get_db📈 view plot
🚷 view threshold		0.31 ns
(+0.05%)Baseline: 0.31 ns
0.39 ns
(80.66%)
get_fernet_token_timestamp/project📈 view plot
🚷 view threshold		143.68 ns
(+3.13%)Baseline: 139.32 ns
181.84 ns
(79.02%)
get_keyspace📈 view plot
🚷 view threshold		4.38 ns
(-24.25%)Baseline: 5.79 ns
13.03 ns
(33.62%)
🐰 View full continuous benchmarking report in Bencher

@github-actions

github-actions Bot commented Sep 8, 2026

Copy link
Copy Markdown

🦢 Load Test Results

Goose Attack Report

Plan Overview

Action Started Stopped Elapsed Users
Increasing 26-09-08 14:45:09 26-09-08 14:45:32 00:00:23 0 → 45
Maintaining 26-09-08 14:45:32 26-09-08 14:46:02 00:00:30 45
Decreasing 26-09-08 14:46:02 26-09-08 14:46:02 00:00:00 0 ← 45

Request Metrics

Method Name # Requests # Fails Average (ms) Min (ms) Max (ms) RPS Failures/s
DELETE DELETE /v3/auth/tokens 45 0 506.93 38 724 1.50 0.00
DELETE DELETE /v3/projects/:id (teardown) 1 0 213.00 213 213 0.03 0.00
DELETE DELETE /v3/roles/:id (teardown) 1 0 95.00 95 95 0.03 0.00
DELETE DELETE /v3/users/:id (teardown) 2 0 222.00 210 234 0.07 0.00
DELETE DELETE /v4/mappings/rulesets/:mapping_id (teardown) 1 0 151.00 151 151 0.03 0.00
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown) 1 0 203.00 203 203 0.03 0.00
GET 625 0 565.63 355 838 20.83 0.00
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 1276 1276 23.18 1 971 42.53 42.53
GET GET /v3/auth/tokens (validate new) 45 0 529.11 193 678 1.50 0.00
GET GET /v3/auth/tokens (validate revoked) 47 0 482.36 30 627 1.57 0.00
GET GET /v3/projects/:id 57 0 533.86 390 717 1.90 0.00
GET GET /v3/projects/:id (catalog) 85 0 539.16 387 720 2.83 0.00
GET GET /v3/role_assignments 43 0 545.63 373 669 1.43 0.00
GET GET /v3/role_assignments?role.id 43 0 541.88 410 690 1.43 0.00
GET GET /v3/role_assignments?scope.domain.id 43 0 516.81 352 644 1.43 0.00
GET GET /v3/role_assignments?user.id 43 0 513.72 349 653 1.43 0.00
GET GET /v3/roles 116 0 526.99 394 687 3.87 0.00
GET GET /v3/roles/:id 59 0 518.25 353 745 1.97 0.00
GET GET /v3/users/:id 109 0 557.38 400 740 3.63 0.00
GET GET /v3/users/:id (catalog) 108 0 547.27 367 769 3.60 0.00
GET GET /v4/api-keys 27 0 510.07 392 680 0.90 0.00
GET GET /v4/api-keys/:client_id 28 0 585.96 432 797 0.93 0.00
GET GET /v4/mappings/rulesets 28 0 530.46 381 651 0.93 0.00
GET GET /v4/mappings/rulesets/:mapping_id 29 0 538.03 372 751 0.97 0.00
GET GET /v4/oauth2/:domain_id/.well-known/openid-configuration 864 0 52.04 8 189 28.80 0.00
GET GET /v4/oauth2/:domain_id/clients 29 0 521.59 433 733 0.97 0.00
GET GET /v4/oauth2/:domain_id/clients/:provider_id 29 0 530.62 402 643 0.97 0.00
GET GET /v4/oauth2/:domain_id/jwks 866 0 51.52 9 218 28.87 0.00
GET GET /v4/scim_realms 18 0 536.50 429 684 0.60 0.00
GET GET /v4/scim_realms/:domain_id/:provider_id 19 0 498.58 333 604 0.63 0.00
POST POST /v3/auth/tokens 45 0 495.44 379 668 1.50 0.00
POST POST /v3/auth/tokens (password, invalid) 39 0 788.38 484 1227 1.30 0.00
POST POST /v3/auth/tokens (password, project-scoped) 63 0 1091.32 692 1644 2.10 0.00
POST POST /v3/auth/tokens (password, unscoped) 62 0 897.73 473 1416 2.07 0.00
POST POST /v3/auth/tokens (rescope to system) 102 0 600.72 393 802 3.40 0.00
POST POST /v3/auth/tokens (rescope, invalid project) 62 0 491.87 322 673 2.07 0.00
POST POST /v3/auth/tokens (system-scoped, bootstrap admin) 56 0 1124.57 738 1695 1.87 0.00
POST POST /v4/api-keys/:client_id/revoke (teardown) 1 0 249.00 249 249 0.03 0.00
PUT PUT /v4/scim_realms/:domain_id/:provider_id 19 0 581.26 410 832 0.63 0.00
Aggregated 5136 1276 267.86 1 1695 171.20 42.53

Response Time Metrics

Method Name 50%ile (ms) 60%ile (ms) 70%ile (ms) 80%ile (ms) 90%ile (ms) 95%ile (ms) 99%ile (ms) 100%ile (ms)
DELETE DELETE /v3/auth/tokens 500 500 500 600 600 600 700 700
DELETE DELETE /v3/projects/:id (teardown) 213 213 213 213 213 213 213 213
DELETE DELETE /v3/roles/:id (teardown) 95 95 95 95 95 95 95 95
DELETE DELETE /v3/users/:id (teardown) 210 210 210 230 230 230 230 230
DELETE DELETE /v4/mappings/rulesets/:mapping_id (teardown) 151 151 151 151 151 151 151 151
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown) 203 203 203 203 203 203 203 203
GET 600 600 600 600 700 700 800 800
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 6 7 9 12 19 28 600 971
GET GET /v3/auth/tokens (validate new) 600 600 600 600 600 678 678 678
GET GET /v3/auth/tokens (validate revoked) 500 500 500 600 600 600 600 600
GET GET /v3/projects/:id 500 600 600 600 600 700 700 700
GET GET /v3/projects/:id (catalog) 500 600 600 600 600 600 700 700
GET GET /v3/role_assignments 500 600 600 600 600 669 669 669
GET GET /v3/role_assignments?role.id 500 600 600 600 600 600 690 690
GET GET /v3/role_assignments?scope.domain.id 500 600 600 600 600 600 600 600
GET GET /v3/role_assignments?user.id 500 500 500 600 600 600 653 653
GET GET /v3/roles 500 500 600 600 600 600 687 687
GET GET /v3/roles/:id 500 500 600 600 600 600 700 700
GET GET /v3/users/:id 600 600 600 600 700 700 700 700
GET GET /v3/users/:id (catalog) 600 600 600 600 600 700 700 769
GET GET /v4/api-keys 500 500 500 600 600 600 680 680
GET GET /v4/api-keys/:client_id 600 600 600 600 700 700 797 797
GET GET /v4/mappings/rulesets 500 600 600 600 600 600 651 651
GET GET /v4/mappings/rulesets/:mapping_id 500 500 600 600 700 700 751 751
GET GET /v4/oauth2/:domain_id/.well-known/openid-configuration 42 52 64 75 92 110 160 189
GET GET /v4/oauth2/:domain_id/clients 500 500 500 600 600 600 700 700
GET GET /v4/oauth2/:domain_id/clients/:provider_id 500 600 600 600 600 600 600 600
GET GET /v4/oauth2/:domain_id/jwks 43 52 62 74 94 110 150 218
GET GET /v4/scim_realms 500 600 600 600 600 600 684 684
GET GET /v4/scim_realms/:domain_id/:provider_id 500 500 500 600 600 600 600 600
POST POST /v3/auth/tokens 490 500 500 500 600 600 668 668
POST POST /v3/auth/tokens (password, invalid) 800 800 900 1,000 1,000 1,000 1,000 1,000
POST POST /v3/auth/tokens (password, project-scoped) 1,000 1,000 1,000 1,000 1,000 1,000 1,644 1,644
POST POST /v3/auth/tokens (password, unscoped) 900 900 1,000 1,000 1,000 1,000 1,000 1,000
POST POST /v3/auth/tokens (rescope to system) 600 600 600 700 700 700 800 800
POST POST /v3/auth/tokens (rescope, invalid project) 480 500 500 600 600 600 673 673
POST POST /v3/auth/tokens (system-scoped, bootstrap admin) 1,000 1,000 1,000 1,000 1,000 1,000 1,695 1,695
POST POST /v4/api-keys/:client_id/revoke (teardown) 249 249 249 249 249 249 249 249
PUT PUT /v4/scim_realms/:domain_id/:provider_id 600 600 600 600 700 800 800 800
Aggregated 70 420 500 600 600 700 1,000 1,695

Status Code Metrics

Method Name Status Codes
DELETE DELETE /v3/auth/tokens 45 [204]
DELETE DELETE /v3/projects/:id (teardown) 1 [204]
DELETE DELETE /v3/roles/:id (teardown) 1 [204]
DELETE DELETE /v3/users/:id (teardown) 2 [204]
DELETE DELETE /v4/mappings/rulesets/:mapping_id (teardown) 1 [204]
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown) 1 [204]
GET 625 [200]
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 1,245 [429], 31 [401]
GET GET /v3/auth/tokens (validate new) 45 [200]
GET GET /v3/auth/tokens (validate revoked) 47 [404]
GET GET /v3/projects/:id 57 [200]
GET GET /v3/projects/:id (catalog) 85 [200]
GET GET /v3/role_assignments 43 [200]
GET GET /v3/role_assignments?role.id 43 [200]
GET GET /v3/role_assignments?scope.domain.id 43 [200]
GET GET /v3/role_assignments?user.id 43 [200]
GET GET /v3/roles 116 [200]
GET GET /v3/roles/:id 59 [200]
GET GET /v3/users/:id 109 [200]
GET GET /v3/users/:id (catalog) 108 [200]
GET GET /v4/api-keys 27 [200]
GET GET /v4/api-keys/:client_id 28 [200]
GET GET /v4/mappings/rulesets 28 [200]
GET GET /v4/mappings/rulesets/:mapping_id 29 [200]
GET GET /v4/oauth2/:domain_id/.well-known/openid-configuration 864 [200]
GET GET /v4/oauth2/:domain_id/clients 29 [200]
GET GET /v4/oauth2/:domain_id/clients/:provider_id 29 [200]
GET GET /v4/oauth2/:domain_id/jwks 866 [200]
GET GET /v4/scim_realms 18 [200]
GET GET /v4/scim_realms/:domain_id/:provider_id 19 [200]
POST POST /v3/auth/tokens 45 [201]
POST POST /v3/auth/tokens (password, invalid) 39 [401]
POST POST /v3/auth/tokens (password, project-scoped) 63 [201]
POST POST /v3/auth/tokens (password, unscoped) 62 [201]
POST POST /v3/auth/tokens (rescope to system) 102 [201]
POST POST /v3/auth/tokens (rescope, invalid project) 62 [401]
POST POST /v3/auth/tokens (system-scoped, bootstrap admin) 56 [201]
POST POST /v4/api-keys/:client_id/revoke (teardown) 1 [200]
PUT PUT /v4/scim_realms/:domain_id/:provider_id 19 [200]
Aggregated 132 [401], 47 [404], 328 [201], 1,245 [429], 51 [204], 3,333 [200]

Transaction Metrics

Transaction # Times Run # Fails Average (ms) Min (ms) Max (ms) RPS Failures/s
ReadHeavy
0.0 1 0 33.00 33 33 0.03 0.00
0.1 112 0 579.13 410 770 3.73 0.00
0.2 113 0 527.14 365 719 3.77 0.00
0.3 111 0 532.79 355 728 3.70 0.00
TokenLifecycle
1.0 0 0 0.00 0 0 0.00 0.00
1.1 47 0 2025.23 859 2448 1.57 0.00
ValidateToken
2.0 0 0 0.00 0 0 0.00 0.00
2.1 96 0 634.07 495 838 3.20 0.00
UserCRUD
3.0 0 0 0.00 0 0 0.00 0.00
3.1 0 0 0.00 0 0 0.00 0.00
3.2 109 0 557.41 400 740 3.63 0.00
3.3 2 0 222.00 210 234 0.07 0.00
ProjectCRUD
4.0 0 0 0.00 0 0 0.00 0.00
4.1 0 0 0.00 0 0 0.00 0.00
4.2 57 0 533.88 390 717 1.90 0.00
4.3 1 0 214.00 214 214 0.03 0.00
RoleCRUD
5.0 0 0 0.00 0 0 0.00 0.00
5.1 0 0 0.00 0 0 0.00 0.00
5.2 59 0 518.29 353 745 1.97 0.00
5.3 1 0 96.00 96 96 0.03 0.00
RoleList
6.0 0 0 0.00 0 0 0.00 0.00
6.1 116 0 527.05 394 687 3.87 0.00
RoleAssignmentList
7.0 0 0 0.00 0 0 0.00 0.00
7.1 43 0 545.67 373 670 1.43 0.00
7.2 43 0 513.74 349 653 1.43 0.00
7.3 43 0 516.88 352 644 1.43 0.00
7.4 43 0 541.98 410 690 1.43 0.00
UserRead
8.0 0 0 0.00 0 0 0.00 0.00
8.1 108 0 585.30 389 753 3.60 0.00
8.2 108 0 547.30 367 769 3.60 0.00
ProjectRead
9.0 0 0 0.00 0 0 0.00 0.00
9.1 85 0 539.85 407 712 2.83 0.00
9.2 85 0 539.19 387 720 2.83 0.00
PasswordAuth
10.0 62 0 897.77 473 1416 2.07 0.00
10.1 63 0 1091.33 692 1644 2.10 0.00
PasswordAuthNegative
11.0 39 0 788.46 484 1227 1.30 0.00
Rescope
12.0 0 0 0.00 0 0 0.00 0.00
12.1 102 0 600.78 393 802 3.40 0.00
RescopeNegative
13.0 0 0 0.00 0 0 0.00 0.00
13.1 62 0 491.94 322 673 2.07 0.00
SystemScopeAuth
14.0 56 0 1124.62 738 1695 1.87 0.00
ApiKeyCRUD
15.0 0 0 0.00 0 0 0.00 0.00
15.1 0 0 0.00 0 0 0.00 0.00
15.2 28 0 585.96 432 797 0.93 0.00
15.3 27 0 510.19 392 680 0.90 0.00
15.4 1 0 249.00 249 249 0.03 0.00
MappingCRUD
16.0 0 0 0.00 0 0 0.00 0.00
16.1 0 0 0.00 0 0 0.00 0.00
16.2 29 0 538.07 372 751 0.97 0.00
16.3 28 0 530.46 381 651 0.93 0.00
16.4 1 0 151.00 151 151 0.03 0.00
OAuth2ClientCRUD
17.0 0 0 0.00 0 0 0.00 0.00
17.1 0 0 0.00 0 0 0.00 0.00
17.2 29 0 530.66 402 643 0.97 0.00
17.3 29 0 521.59 433 733 0.97 0.00
17.4 1 0 203.00 203 203 0.03 0.00
OAuth2Discovery
18.0 866 0 51.54 9 218 28.87 0.00
18.1 864 0 52.07 8 189 28.80 0.00
ScimRealmRead
19.0 0 0 0.00 0 0 0.00 0.00
19.1 19 0 498.63 333 604 0.63 0.00
19.2 18 0 536.50 429 684 0.60 0.00
19.3 19 0 581.26 410 832 0.63 0.00
ScimSync
20.0 0 0 0.00 0 0 0.00 0.00
20.1 0 0 0.00 0 0 0.00 0.00
20.2 0 0 0.00 0 0 0.00 0.00
20.3 1276 0 23.20 1 971 42.53 0.00
20.4 1275 0 0.00 0 0 42.50 0.00
20.5 1275 0 0.00 0 0 42.50 0.00
20.6 1 0 0.00 0 0 0.03 0.00
Aggregated 7553 0 182.14 1 2448 251.77 0.00

Scenario Metrics

Transaction # Users # Times Run Average (ms) Min (ms) Max (ms) Scenarios/s Iterations
ReadHeavy 6 109 1647.82 1347 1921 3.63 18.17
TokenLifecycle 3 44 2063.45 1770 2448 1.47 14.67
ValidateToken 2 94 632.63 495 838 3.13 47.00
UserCRUD 2 107 555.57 400 740 3.57 53.50
ProjectCRUD 1 56 532.55 390 717 1.87 56.00
RoleCRUD 1 58 519.24 353 745 1.93 58.00
RoleList 2 114 526.47 394 687 3.80 57.00
RoleAssignmentList 3 42 2122.86 1740 2367 1.40 14.00
UserRead 4 107 1134.56 857 1421 3.57 26.75
ProjectRead 3 83 1079.65 853 1312 2.77 27.67
PasswordAuth 4 61 2005.57 1430 2594 2.03 15.25
PasswordAuthNegative 1 38 788.11 484 1227 1.27 38.00
Rescope 2 100 602.23 393 802 3.33 50.00
RescopeNegative 1 61 490.75 322 673 2.03 61.00
SystemScopeAuth 2 54 1134.46 738 1695 1.80 27.00
ApiKeyCRUD 1 27 1096.56 882 1298 0.90 27.00
MappingCRUD 1 28 1069.07 822 1266 0.93 28.00
OAuth2ClientCRUD 1 29 1056.59 866 1414 0.97 29.00
OAuth2Discovery 3 863 103.75 17 308 28.77 287.67
ScimRealmRead 1 19 1617.05 1351 2041 0.63 19.00
ScimSync 1 1275 22.80 1 971 42.50 1275.00
Aggregated 45 3369 401.50 1 2594 112.30 2229.67

Error Metrics

Method Name # Error
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 48 401 Unauthorized: GET /SCIM/v2/:domain_id/Users (sync reconcile list)
POST POST /SCIM/v2/:domain_id/Users (sync provision) 1 401 Unauthorized: POST /SCIM/v2/:domain_id/Users (sync provision)
POST POST /v3/auth/tokens (password, invalid) 90 401 Unauthorized: POST /v3/auth/tokens (password, invalid)
POST POST /v3/auth/tokens (rescope, invalid project) 156 401 Unauthorized: POST /v3/auth/tokens (rescope, invalid project)
GET GET /v3/auth/tokens (validate revoked) 160 404 Not Found: GET /v3/auth/tokens (validate revoked)
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 1245 429 Too Many Requests: GET /SCIM/v2/:domain_id/Users (sync reconcile list)

View full report

@github-actions

github-actions Bot commented Sep 8, 2026

Copy link
Copy Markdown

🧪 Tempest Identity Compatibility Results (advisory, non-blocking)

rust

Totals
======
Ran: 133 tests in 28.1210 sec.
 - Passed: 66
 - Skipped: 4
 - Expected Fail: 0
 - Unexpected Success: 0
 - Failed: 63
Sum of execute time for each test: 22.6278 sec.
Failed test IDs 
===== FAILED TESTS (target=rust) =====
tempest.api.identity.admin.v3.test_credentials.CredentialsTestJSON.test_credentials_create_get_update_delete[id-7cd59bf9-bda4-4c72-9467-d21cab278355,smoke]
tempest.api.identity.admin.v3.test_application_credentials.ApplicationCredentialsV3AdminTest.test_create_application_credential_with_roles[id-3b3dd48f-3388-406a-a9e6-4d078a552d0e]
tempest.api.identity.admin.v3.test_domains_negative.DomainsNegativeTestJSON.test_create_domain_with_name_length_over_64[id-37b1bbf2-d664-4785-9a11-333438586eae,negative]
tempest.api.identity.admin.v3.test_domains_negative.DomainsNegativeTestJSON.test_delete_active_domain[gate,id-1f3fbff5-4e44-400d-9ca1-d953f05f609b,negative]
tempest.api.identity.admin.v3.test_default_project_id.TestDefaultProjectId.test_default_project_id[id-d6110661-6a71-49a7-a453-b5e26640ff6d]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_create_domain_config_and_show_config_groups_and_options[id-9e3ff13c-f597-4f01-9377-d6c06c2a1477]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_create_update_and_delete_domain_config_groups_and_opts[id-c7510fa2-6661-4170-9c6b-4783a80651e9]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_check_revoke_roles_on_projects_group[id-26021436-d5a4-4256-943c-ded01e0d4b45]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_check_revoke_roles_on_projects_user[id-18b70e45-7687-4b72-8277-b8f1a47d7591]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_show_default_group_config_and_options[id-11a02bf0-6f94-4380-b3b0-c8dc18fc0d22]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_check_revoke_roles_on_domains_group[id-c7a8dda2-be50-4fb4-9a9c-e830771078b1]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_check_revoke_roles_on_domains_user[id-4e6f0366-97c8-423c-b2be-41eae6ac91c8]
tempest.api.identity.admin.v3.test_list_projects.ListProjectsTestJSON.test_list_projects_with_enabled[id-0fe7a334-675a-4509-b00e-1c4b95d5dae8]
tempest.api.identity.admin.v3.test_list_projects.ListProjectsTestJSON.test_list_projects_with_parent[id-6edc66f5-2941-4a17-9526-4073311c1fac]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_revoke_user_roles_on_domain[id-3acf666e-5354-42ac-8e17-8b68893bcd36]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_revoke_user_roles_on_project_tree[id-9f02ccd9-9b57-46b4-8f77-dd5a736f3a06]
tempest.api.identity.admin.v3.test_domains.DomainsTestJSON.test_create_domain_without_description[id-2abf8764-309a-4fa9-bc58-201b799817ad]
tempest.api.identity.admin.v3.test_domains.DomainsTestJSON.test_create_update_delete_domain[id-f2f5b44a-82e8-4dad-8084-0661ea3b18cf,smoke]
tempest.api.identity.admin.v3.test_domains.DomainsTestJSON.test_domain_delete_cascades_content[id-d8d318b7-d1b3-4c37-94c5-3c5ba0b121ea]
tempest.api.identity.admin.v3.test_domains.DomainsTestJSON.test_list_domains_filter_by_enabled[id-3fd19840-65c1-43f8-b48c-51bdd066dff9]
tempest.api.identity.admin.v3.test_project_tags.IdentityV3ProjectTagsTest.test_list_update_delete_project_tags[id-7c123aac-999d-416a-a0fb-84b915ab10de]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_create_and_show_consumer[id-c8307ea6-a86c-47fd-ae7b-5b3b2caca76d]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_delete_consumer[id-fdfa1b7f-2a31-4354-b2c7-f6ae20554f93]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_list_consumers[id-09ca50de-78f2-4ffb-ac71-f2254036b2b8]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_update_consumer[id-080a9b1a-c009-47c0-9979-5305bf72e3dc]
setUpClass (tempest.api.identity.admin.v3.test_endpoint_groups.EndPointGroupsTest)
tempest.api.identity.admin.v3.test_projects_negative.ProjectsNegativeStaticTestJSON.test_create_projects_name_length_over_64[id-502b6ceb-b0c8-4422-bf53-f08fdb21e2f0,negative]
tempest.api.identity.admin.v3.test_groups.GroupsV3TestJSON.test_group_users_add_list_delete[id-1598521a-2f36-4606-8df9-30772bd51339,smoke]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_create_is_domain_project[id-a7eb9416-6f9b-4dbb-b71b-7f73aaef59d5]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_project_create_with_parent[id-1854f9c0-70bc-4d11-a08a-1c789d339e3d]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_project_get_equals_list[id-d1db68b6-aebe-4fa0-b79d-d724d2e21162]
tempest.api.identity.admin.v3.test_groups.GroupsV3TestJSON.test_list_user_groups[id-64573281-d26a-4a52-b899-503cb0f4e4ec]
tempest.api.identity.admin.v3.test_list_projects.ListProjectsStaticTestJSON.test_list_projects[id-1d830662-22ad-427c-8c3e-4ec854b0af44]
tempest.api.identity.admin.v3.test_tokens.TokensV3TestJSON.test_get_available_domain_scopes[id-ec5ecb05-af64-4c04-ac86-4d9f6f12f185]
tempest.api.identity.admin.v3.test_tokens.TokensV3TestJSON.test_rescope_token[id-565fa210-1da1-4563-999b-f7b5b67cf112]
tempest.api.identity.admin.v3.test_list_users.UsersV3TestJSON.test_list_users_with_not_enabled[id-bff8bf2f-9408-4ef5-b63a-753c8c2124eb]
tempest.api.identity.admin.v3.test_users_negative.UsersNegativeTest.test_create_user_for_non_existent_domain[id-e75f006c-89cc-477b-874d-588e4eab4b17,negative]
tempest.api.identity.admin.v3.test_users.UsersV3TestJSON.test_list_user_projects[id-a831e70c-e35b-430b-92ed-81ebbc5437b8]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_get_trusts_all[id-4773ebd5-ecbf-4255-b8d8-b63e6f72b65d,smoke]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_api_media_types[id-657c1970-4722-4189-8831-7325f3bc4265,smoke]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_api_version_resources[id-b9232f5e-d9e5-4d97-b96c-28d3db4de1bd,smoke]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_identity_v3_existence[id-79aec9ae-710f-4c54-a4fc-3aa25b4feac3]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_list_api_versions[id-721f480f-35b6-46c7-846e-047e6acea0dc,smoke]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_get_trusts_query[id-6268b345-87ca-47c0-9ce3-37792b43403a]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_expire[id-0ed14b66-cefd-4b5c-a964-65759453e292]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_impersonate[id-5a0a91a4-baef-4a14-baba-59bf4d7fcace]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_assignments_for_domain_roles[id-3859df7e-5b78-4e4d-b10e-214c8953842a]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_assignments_for_implied_roles_create_delete[id-c8828027-df48-4021-95df-b65b92c7429e]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_group_on_domain[id-4bf8a70b-e785-413a-ad53-9f91ce02faa7]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_group_on_project[id-cbf11737-1904-4690-9613-97bcbb3df1c4]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_group_on_system[id-c888fe4f-8018-48db-b959-542225c1b4b6]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_user_on_domain[id-6c9a2940-3625-43a3-ac02-5dcec62ef3bd]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_implied_domain_roles[id-eb1e1c24-1bc4-4d47-9748-e127a1852c82]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_implied_roles_create_check_show_delete[id-c90c316c-d706-4728-bcba-eb1912081b69]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_role_create_update_show_list[id-18afc6c0-46cf-4911-824e-9989cc056c3a,smoke]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_noimpersonate[id-ed2a8779-a7ac-49dc-afd7-30f32f936ed2]
tempest.api.identity.v3.test_tokens.TokensV3Test.test_validate_token[id-a9512ac3-3909-48a4-b395-11f438e16260]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_create_application_credential[id-8080c75c-eddc-4786-941a-c2da7039ae61]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_create_application_credential_expires[id-852daf0c-42b5-4239-8466-d193d0543ed3]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_list_application_credentials[id-ff0cd457-6224-46e7-b79e-0ada4964a8a6]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_query_application_credentials[id-9bb5e5cc-5250-493a-8869-8b665f6aa5f6]
tempest.api.identity.v3.test_catalog.IdentityCatalogTest.test_catalog_standardization[id-56b57ced-22b8-4127-9b8a-565dfb0207e2]
tempest.api.identity.v3.test_projects.IdentityV3ProjectsTest.test_list_projects_returns_only_authorized_projects[id-86128d46-e170-4644-866a-cc487f699e1d]
===== END FAILED TESTS (target=rust) =====

View full run

@gtema
gtema added this pull request to the merge queue Sep 8, 2026
Merged via the queue into main with commit f0a81e0 Sep 8, 2026
37 checks passed
@openstack-experimental-release-plz openstack-experimental-release-plz Bot mentioned this pull request Sep 8, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@gtema