Issues

• Reduce dependency tree to make Debian packaging feasible

  openstack-experimental/keystone#1534 · Filter by author gtema opened on Oct 15, 2026

• oauth2: mint-time scope provenance check and system scope for workloads

  openstack-experimental/keystone#1500 · Filter by author gtema opened on Oct 12, 2026

• identity: reject replay of an already used TOTP code in authenticate_by_totp

  security_improvement
  openstack-experimental/keystone#1479 · Filter by author gtema opened on Oct 9, 2026

• test(oauth2): Live tests for OP browser login, MFA, SSO, consent and federated sign-in

  test
  openstack-experimental/keystone#1469 · Filter by author gtema opened on Oct 9, 2026

• test(federation): Fail instead of skipping without GitHub JWT

  test
  Bug

  openstack-experimental/keystone#1368 · Filter by author gtema opened on Oct 3, 2026

• test(oauth2): GitHub Actions OIDC token exchange test

  test
  Task

  openstack-experimental/keystone#1367 · Filter by author gtema opened on Oct 3, 2026

• test(oauth2): Keycloak JWT token exchange in k3s

  test
  Task

  openstack-experimental/keystone#1366 · Filter by author gtema opened on Oct 3, 2026

• docs(adr): Amend ADR 0026 §12 with token-exchange scope

  documentation
  Task

  openstack-experimental/keystone#1365 · Filter by author gtema opened on Oct 3, 2026

• oauth2: Decide scope of token-exchange subject kinds and revocation

  Task

  openstack-experimental/keystone#1357 · Filter by author gtema opened on Oct 1, 2026

• oauth2: Document and live-test the token-exchange grant (legacy bridge)

  documentationtest
  Task

  openstack-experimental/keystone#1356 · Filter by author gtema opened on Oct 1, 2026

• oauth2: Shared subject-token validation profile for token exchange

  Feature

  openstack-experimental/keystone#1355 · Filter by author gtema opened on Oct 1, 2026

• oauth2: RFC 8693 request/response conformance for token exchange

  api
  Bug

  openstack-experimental/keystone#1354 · Filter by author gtema opened on Oct 1, 2026

• oauth2: Cap token-exchange lifetime to subject and app-cred expiry

  security_improvement
  Bug

  openstack-experimental/keystone#1353 · Filter by author gtema opened on Oct 1, 2026

• raft: supply-chain and deployment-validation claims are not backed by CI (openraft alpha, no cargo-vet, check_no_dev_mode.sh unwired and failing, ADR status)

  infrastructuresecurity_improvement
  Task

  openstack-experimental/keystone#1304 · Filter by author gtema opened on Sep 18, 2026

• Raft storage readiness M4: Operations, tests and documentation

  Task

  openstack-experimental/keystone#1292 · Filter by author gtema opened on Sep 18, 2026

• Raft storage readiness M3: Security and transport hardening

  Task

  openstack-experimental/keystone#1291 · Filter by author gtema opened on Sep 18, 2026

• Raft storage readiness M2: Key management lifecycle

  Task

  openstack-experimental/keystone#1290 · Filter by author gtema opened on Sep 18, 2026

• Raft storage readiness M1: Data durability and correctness

  Task

  openstack-experimental/keystone#1289 · Filter by author gtema opened on Sep 18, 2026
  1

• Raft distributed storage production readiness (audit 2026-09)

  Task

  openstack-experimental/keystone#1288 · Filter by author gtema opened on Sep 18, 2026

• oauth2 docs: fix false statements, add ADR 0026 implementation-status table, options.md table, and a production checklist

  documentation
  Task

  openstack-experimental/keystone#1287 · Filter by author gtema opened on Sep 18, 2026

• oauth2 client: enforce token_endpoint_auth_method and remove or enforce require_pkce

  Task

  openstack-experimental/keystone#1274 · Filter by author gtema opened on Sep 18, 2026

• oauth2: add RFC 9207 iss to authorization responses and RFC 8252 loopback-port matching for public clients

  Task

  openstack-experimental/keystone#1272 · Filter by author gtema opened on Sep 18, 2026

• auth: accept OP-issued OpenStack access tokens (Authorization: Bearer JWT) on Keystone's own v3/v4 API

  security_improvement
  Feature

  openstack-experimental/keystone#1266 · Filter by author gtema opened on Sep 18, 2026

• oauth2: support openstack:api on authorization_code and device_code grants (scope picker, OpenStackAccessTokenClaims for humans)

  Feature

  openstack-experimental/keystone#1265 · Filter by author gtema opened on Sep 18, 2026

• OAuth2 OP readiness M5: Operations, tests, and documentation

  Feature

  openstack-experimental/keystone#1254 · Filter by author gtema opened on Sep 18, 2026