Skip to content

fix(token): Truncate new token expiry to seconds - #1577

Merged
gtema merged 1 commit into
mainfrom
oauth2
Oct 21, 2026
Merged

fix(token): Truncate new token expiry to seconds#1577
gtema merged 1 commit into
mainfrom
oauth2

Conversation

@gtema

@gtema gtema commented Oct 21, 2026

Copy link
Copy Markdown
Collaborator

The issue response was built from the in-memory token, so expires_at
carried real microseconds. The fernet and JWS encoders store whole
seconds, so a later validate or GET reported a different value.

Truncate in get_new_token_expiry, after the min() with the
authentication expiry. This matches python keystone's
default_expire_time and the issued_at handling from #1194.

Assisted-by: Claude noreply@anthropic.com
Signed-off-by: Artem Goncharov artem.goncharov@gmail.com

@gtema
fix(token): Truncate new token expiry to seconds
2c3b391 
The issue response was built from the in-memory token, so expires_at
carried real microseconds. The fernet and JWS encoders store whole
seconds, so a later validate or GET reported a different value.

Truncate in get_new_token_expiry, after the min() with the
authentication expiry. This matches python keystone's
default_expire_time and the issued_at handling from #1194.

Assisted-by: Claude <noreply@anthropic.com>
Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
@gtema
gtema enabled auto-merge October 21, 2026 10:27
@github-actions

github-actions Bot commented Oct 21, 2026

Copy link
Copy Markdown

🐰 Bencher Report

Projectkeystone
Branchoauth2
Testbedubuntu-latest
Click to view all benchmark results
BenchmarkLatencyBenchmark Result
nanoseconds (ns)
(Result Δ%)		Upper Boundary
nanoseconds (ns)
(Limit %)
Command_Serde/apply/remove📈 view plot
🚷 view threshold		128,250.00 ns
(-6.12%)Baseline: 136,607.41 ns
262,080.74 ns
(48.94%)
Command_Serde/apply/set📈 view plot
🚷 view threshold		138,450.00 ns
(-2.94%)Baseline: 142,639.53 ns
248,027.41 ns
(55.82%)
Command_Serde/pack/delete📈 view plot
🚷 view threshold		140.96 ns
(+22.09%)Baseline: 115.46 ns
165.48 ns
(85.18%)
Command_Serde/pack/delete_index📈 view plot
🚷 view threshold		122.64 ns
(+18.07%)Baseline: 103.87 ns
145.65 ns
(84.20%)
Command_Serde/pack/set📈 view plot
🚷 view threshold		229.42 ns
(+22.95%)Baseline: 186.59 ns
272.33 ns
(84.24%)
Command_Serde/pack/set_index📈 view plot
🚷 view threshold		122.96 ns
(+17.91%)Baseline: 104.29 ns
147.48 ns
(83.37%)
Command_Serde/unpack/delete📈 view plot
🚷 view threshold		165.96 ns
(+14.74%)Baseline: 144.65 ns
217.24 ns
(76.39%)
Command_Serde/unpack/delete_index📈 view plot
🚷 view threshold		143.08 ns
(+16.65%)Baseline: 122.66 ns
183.19 ns
(78.10%)
Command_Serde/unpack/set📈 view plot
🚷 view threshold		265.94 ns
(+18.30%)Baseline: 224.80 ns
347.00 ns
(76.64%)
Command_Serde/unpack/set_index📈 view plot
🚷 view threshold		143.49 ns
(+17.60%)Baseline: 122.02 ns
180.95 ns
(79.30%)
Payload_encryption/pack/remove_cmd📈 view plot
🚷 view threshold		123.46 ns
(+15.09%)Baseline: 107.28 ns
160.97 ns
(76.70%)
Payload_encryption/pack/set_cmd📈 view plot
🚷 view threshold		218.67 ns
(+12.93%)Baseline: 193.63 ns
295.78 ns
(73.93%)
Payload_encryption/unpack/remove_cmd📈 view plot
🚷 view threshold		171.31 ns
(+16.80%)Baseline: 146.67 ns
218.45 ns
(78.42%)
Payload_encryption/unpack/set_cmd📈 view plot
🚷 view threshold		275.10 ns
(+20.30%)Baseline: 228.67 ns
352.68 ns
(78.00%)
Raft_1Node_Latency/prefix/1node📈 view plot
🚷 view threshold		5,718,300.00 ns
(+57.81%)Baseline: 3,623,495.47 ns
8,696,690.66 ns
(65.75%)
Raft_1Node_Latency/read/1node📈 view plot
🚷 view threshold		45,194.00 ns
(+30.76%)Baseline: 34,562.84 ns
52,594.68 ns
(85.93%)
Raft_1Node_Latency/remove/1node📈 view plot
🚷 view threshold		356,280.00 ns
(+0.10%)Baseline: 355,916.56 ns
598,887.44 ns
(59.49%)
Raft_1Node_Latency/write/1node📈 view plot
🚷 view threshold		394,070.00 ns
(+2.11%)Baseline: 385,930.47 ns
753,901.24 ns
(52.27%)
build_snapshot/default📈 view plot
🚷 view threshold		2,109.90 ns
(+1.56%)Baseline: 2,077.44 ns
2,796.17 ns
(75.46%)
fernet token/project📈 view plot
🚷 view threshold		1,446.40 ns
(+13.84%)Baseline: 1,270.52 ns
1,758.55 ns
(82.25%)
get_data_keyspace📈 view plot
🚷 view threshold		0.31 ns
(+6.19%)Baseline: 0.29 ns
0.38 ns
(82.04%)
get_db📈 view plot
🚷 view threshold		0.31 ns
(+6.06%)Baseline: 0.29 ns
0.38 ns
(82.02%)
get_fernet_token_timestamp/project📈 view plot
🚷 view threshold		144.53 ns
(+10.03%)Baseline: 131.35 ns
184.39 ns
(78.38%)
get_keyspace📈 view plot
🚷 view threshold		4.10 ns
(-38.34%)Baseline: 6.65 ns
15.56 ns
(26.35%)
🐰 View full continuous benchmarking report in Bencher

@github-actions

github-actions Bot commented Oct 21, 2026

Copy link
Copy Markdown

🦢 Load Test Results

Goose Attack Report

Plan Overview

Action Started Stopped Elapsed Users
Increasing 26-10-21 11:40:46 26-10-21 11:41:09 00:00:23 0 → 45
Maintaining 26-10-21 11:41:09 26-10-21 11:41:39 00:00:30 45
Decreasing 26-10-21 11:41:39 26-10-21 11:41:40 00:00:01 0 ← 45

Request Metrics

Method Name # Requests # Fails Average (ms) Min (ms) Max (ms) RPS Failures/s
DELETE DELETE /v3/auth/tokens 56 0 427.75 28 629 1.87 0.00
DELETE DELETE /v3/projects/:id (teardown) 1 0 65.00 65 65 0.03 0.00
DELETE DELETE /v3/roles/:id (teardown) 1 0 66.00 66 66 0.03 0.00
DELETE DELETE /v3/users/:id (teardown) 2 0 94.00 62 126 0.07 0.00
DELETE DELETE /v4/mappings/rulesets/:mapping_id (cc teardown) 1 0 16.00 16 16 0.03 0.00
DELETE DELETE /v4/mappings/rulesets/:mapping_id (teardown) 1 0 81.00 81 81 0.03 0.00
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (cc teardown) 1 0 16.00 16 16 0.03 0.00
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown) 1 0 111.00 111 111 0.03 0.00
GET 628 0 464.36 135 790 20.93 0.00
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 52 31 194.81 2 619 1.73 1.03
GET GET /v3/auth/tokens (validate new) 56 0 406.88 72 598 1.87 0.00
GET GET /v3/auth/tokens (validate revoked) 57 0 385.96 10 574 1.90 0.00
GET GET /v3/projects/:id 71 0 428.42 202 653 2.37 0.00
GET GET /v3/projects/:id (catalog) 104 0 419.99 215 646 3.47 0.00
GET GET /v3/role_assignments 55 0 443.29 134 683 1.83 0.00
GET GET /v3/role_assignments?role.id 55 0 421.25 221 623 1.83 0.00
GET GET /v3/role_assignments?scope.domain.id 54 0 410.39 275 666 1.80 0.00
GET GET /v3/role_assignments?user.id 54 0 396.33 217 584 1.80 0.00
GET GET /v3/roles 142 0 427.85 119 644 4.73 0.00
GET GET /v3/roles/:id 70 0 431.19 182 614 2.33 0.00
GET GET /v3/users/:id 137 0 443.55 149 704 4.57 0.00
GET GET /v3/users/:id (catalog) 132 0 442.85 262 699 4.40 0.00
GET GET /v4/api-keys 38 0 380.55 105 516 1.27 0.00
GET GET /v4/api-keys/:client_id 38 0 418.95 254 596 1.27 0.00
GET GET /v4/mappings/rulesets 38 0 413.11 234 597 1.27 0.00
GET GET /v4/mappings/rulesets/:mapping_id 38 0 386.29 201 581 1.27 0.00
GET GET /v4/oauth2/:domain_id/.well-known/openid-configuration 2376 0 18.53 2 136 79.20 0.00
GET GET /v4/oauth2/:domain_id/clients 37 0 394.59 241 572 1.23 0.00
GET GET /v4/oauth2/:domain_id/clients/:provider_id 38 0 412.42 236 633 1.27 0.00
GET GET /v4/oauth2/:domain_id/jwks 2376 0 18.41 2 119 79.20 0.00
GET GET /v4/scim_realms 24 0 412.67 201 563 0.80 0.00
GET GET /v4/scim_realms/:domain_id/:provider_id 25 0 406.44 268 561 0.83 0.00
POST POST /v3/auth/tokens 56 0 400.89 218 577 1.87 0.00
POST POST /v3/auth/tokens (password, invalid) 52 0 593.94 336 924 1.73 0.00
POST POST /v3/auth/tokens (password, project-scoped) 79 0 860.14 526 1480 2.63 0.00
POST POST /v3/auth/tokens (password, unscoped) 80 0 673.53 411 1187 2.67 0.00
POST POST /v3/auth/tokens (rescope to system) 126 0 480.19 169 745 4.20 0.00
POST POST /v3/auth/tokens (rescope, invalid project) 77 0 396.65 184 583 2.57 0.00
POST POST /v3/auth/tokens (system-scoped, bootstrap admin) 71 0 866.83 330 1328 2.37 0.00
POST POST /v4/api-keys/:client_id/revoke (teardown) 1 0 66.00 66 66 0.03 0.00
POST POST /v4/oauth2/:domain_id/device_authorization 679 0 43.79 6 185 22.63 0.00
POST POST /v4/oauth2/:domain_id/token (client_credentials) 16 0 406.19 284 610 0.53 0.00
PUT PUT /v4/scim_realms/:domain_id/:provider_id 24 0 431.92 257 586 0.80 0.00
Aggregated 8020 31 164.55 2 1480 267.33 1.03

Response Time Metrics

Method Name 50%ile (ms) 60%ile (ms) 70%ile (ms) 80%ile (ms) 90%ile (ms) 95%ile (ms) 99%ile (ms) 100%ile (ms)
DELETE DELETE /v3/auth/tokens 440 460 500 500 500 600 600 600
DELETE DELETE /v3/projects/:id (teardown) 65 65 65 65 65 65 65 65
DELETE DELETE /v3/roles/:id (teardown) 66 66 66 66 66 66 66 66
DELETE DELETE /v3/users/:id (teardown) 62 62 62 126 126 126 126 126
DELETE DELETE /v4/mappings/rulesets/:mapping_id (cc teardown) 16 16 16 16 16 16 16 16
DELETE DELETE /v4/mappings/rulesets/:mapping_id (teardown) 81 81 81 81 81 81 81 81
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (cc teardown) 16 16 16 16 16 16 16 16
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown) 111 111 111 111 111 111 111 111
GET 460 500 500 600 600 600 700 790
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 190 240 280 370 440 470 600 600
GET GET /v3/auth/tokens (validate new) 420 440 460 480 500 598 598 598
GET GET /v3/auth/tokens (validate revoked) 410 420 450 490 500 500 574 574
GET GET /v3/projects/:id 430 450 490 500 600 600 600 653
GET GET /v3/projects/:id (catalog) 400 440 470 500 500 600 600 600
GET GET /v3/role_assignments 460 480 500 500 600 600 600 683
GET GET /v3/role_assignments?role.id 420 440 480 500 500 600 600 600
GET GET /v3/role_assignments?scope.domain.id 410 420 450 490 500 500 600 666
GET GET /v3/role_assignments?user.id 380 410 430 460 500 500 584 584
GET GET /v3/roles 430 450 490 500 500 600 600 600
GET GET /v3/roles/:id 420 470 490 500 600 600 600 600
GET GET /v3/users/:id 440 470 500 500 600 600 600 700
GET GET /v3/users/:id (catalog) 440 460 490 500 600 600 600 699
GET GET /v4/api-keys 390 420 440 450 470 490 500 500
GET GET /v4/api-keys/:client_id 400 430 480 500 500 596 596 596
GET GET /v4/mappings/rulesets 390 420 490 500 500 500 597 597
GET GET /v4/mappings/rulesets/:mapping_id 380 410 440 460 500 500 581 581
GET GET /v4/oauth2/:domain_id/.well-known/openid-configuration 16 18 21 25 32 41 61 136
GET GET /v4/oauth2/:domain_id/clients 410 410 430 460 490 572 572 572
GET GET /v4/oauth2/:domain_id/clients/:provider_id 410 450 460 470 600 600 600 600
GET GET /v4/oauth2/:domain_id/jwks 16 18 21 26 33 40 61 119
GET GET /v4/scim_realms 410 440 460 500 500 563 563 563
GET GET /v4/scim_realms/:domain_id/:provider_id 390 410 470 490 500 500 561 561
POST POST /v3/auth/tokens 420 430 450 490 500 500 577 577
POST POST /v3/auth/tokens (password, invalid) 600 700 700 700 800 800 900 900
POST POST /v3/auth/tokens (password, project-scoped) 800 900 900 1,000 1,000 1,000 1,000 1,000
POST POST /v3/auth/tokens (password, unscoped) 600 700 700 800 900 1,000 1,000 1,000
POST POST /v3/auth/tokens (rescope to system) 470 500 600 600 600 700 700 700
POST POST /v3/auth/tokens (rescope, invalid project) 390 420 450 480 500 583 583 583
POST POST /v3/auth/tokens (system-scoped, bootstrap admin) 800 900 900 1,000 1,000 1,000 1,000 1,000
POST POST /v4/api-keys/:client_id/revoke (teardown) 66 66 66 66 66 66 66 66
POST POST /v4/oauth2/:domain_id/device_authorization 40 44 49 58 70 85 120 185
POST POST /v4/oauth2/:domain_id/token (client_credentials) 360 410 410 470 490 600 600 600
PUT PUT /v4/scim_realms/:domain_id/:provider_id 430 440 500 500 586 586 586 586
Aggregated 26 38 290 410 500 600 900 1,000

Status Code Metrics

Method Name Status Codes
DELETE DELETE /v3/auth/tokens 56 [204]
DELETE DELETE /v3/projects/:id (teardown) 1 [204]
DELETE DELETE /v3/roles/:id (teardown) 1 [204]
DELETE DELETE /v3/users/:id (teardown) 2 [204]
DELETE DELETE /v4/mappings/rulesets/:mapping_id (cc teardown) 1 [204]
DELETE DELETE /v4/mappings/rulesets/:mapping_id (teardown) 1 [204]
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (cc teardown) 1 [204]
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown) 1 [204]
GET 628 [200]
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 21 [429], 31 [401]
GET GET /v3/auth/tokens (validate new) 56 [200]
GET GET /v3/auth/tokens (validate revoked) 57 [404]
GET GET /v3/projects/:id 71 [200]
GET GET /v3/projects/:id (catalog) 104 [200]
GET GET /v3/role_assignments 55 [200]
GET GET /v3/role_assignments?role.id 55 [200]
GET GET /v3/role_assignments?scope.domain.id 54 [200]
GET GET /v3/role_assignments?user.id 54 [200]
GET GET /v3/roles 142 [200]
GET GET /v3/roles/:id 70 [200]
GET GET /v3/users/:id 137 [200]
GET GET /v3/users/:id (catalog) 132 [200]
GET GET /v4/api-keys 38 [200]
GET GET /v4/api-keys/:client_id 38 [200]
GET GET /v4/mappings/rulesets 38 [200]
GET GET /v4/mappings/rulesets/:mapping_id 38 [200]
GET GET /v4/oauth2/:domain_id/.well-known/openid-configuration 2,376 [200]
GET GET /v4/oauth2/:domain_id/clients 37 [200]
GET GET /v4/oauth2/:domain_id/clients/:provider_id 38 [200]
GET GET /v4/oauth2/:domain_id/jwks 2,376 [200]
GET GET /v4/scim_realms 24 [200]
GET GET /v4/scim_realms/:domain_id/:provider_id 25 [200]
POST POST /v3/auth/tokens 56 [201]
POST POST /v3/auth/tokens (password, invalid) 52 [401]
POST POST /v3/auth/tokens (password, project-scoped) 79 [201]
POST POST /v3/auth/tokens (password, unscoped) 80 [201]
POST POST /v3/auth/tokens (rescope to system) 126 [201]
POST POST /v3/auth/tokens (rescope, invalid project) 77 [401]
POST POST /v3/auth/tokens (system-scoped, bootstrap admin) 71 [201]
POST POST /v4/api-keys/:client_id/revoke (teardown) 1 [200]
POST POST /v4/oauth2/:domain_id/device_authorization 679 [200]
POST POST /v4/oauth2/:domain_id/token (client_credentials) 16 [200]
PUT PUT /v4/scim_realms/:domain_id/:provider_id 24 [200]
Aggregated 412 [201], 7,306 [200], 21 [429], 160 [401], 57 [404], 64 [204]

Transaction Metrics

Transaction # Times Run # Fails Average (ms) Min (ms) Max (ms) RPS Failures/s
ReadHeavy
0.0 1 0 24.00 24 24 0.03 0.00
0.1 91 0 480.04 270 710 3.03 0.00
0.2 91 0 417.98 135 639 3.03 0.00
0.3 90 0 438.84 267 618 3.00 0.00
TokenLifecycle
1.0 0 0 0.00 0 0 0.00 0.00
1.1 57 0 1626.26 459 2048 1.90 0.00
ValidateToken
2.0 0 0 0.00 0 0 0.00 0.00
2.1 119 0 511.23 227 734 3.97 0.00
UserCRUD
3.0 0 0 0.00 0 0 0.00 0.00
3.1 0 0 0.00 0 0 0.00 0.00
3.2 137 0 443.56 149 704 4.57 0.00
3.3 2 0 94.00 62 126 0.07 0.00
ProjectCRUD
4.0 0 0 0.00 0 0 0.00 0.00
4.1 0 0 0.00 0 0 0.00 0.00
4.2 71 0 428.44 202 653 2.37 0.00
4.3 1 0 65.00 65 65 0.03 0.00
RoleCRUD
5.0 0 0 0.00 0 0 0.00 0.00
5.1 0 0 0.00 0 0 0.00 0.00
5.2 70 0 431.21 182 614 2.33 0.00
5.3 1 0 66.00 66 66 0.03 0.00
RoleList
6.0 0 0 0.00 0 0 0.00 0.00
6.1 142 0 427.87 119 644 4.73 0.00
RoleAssignmentList
7.0 0 0 0.00 0 0 0.00 0.00
7.1 55 0 443.35 134 683 1.83 0.00
7.2 54 0 396.37 217 584 1.80 0.00
7.3 54 0 410.46 275 666 1.80 0.00
7.4 55 0 421.29 221 623 1.83 0.00
UserRead
8.0 0 0 0.00 0 0 0.00 0.00
8.1 132 0 475.11 162 790 4.40 0.00
8.2 132 0 442.87 262 699 4.40 0.00
ProjectRead
9.0 0 0 0.00 0 0 0.00 0.00
9.1 105 0 446.34 163 689 3.50 0.00
9.2 104 0 420.04 215 646 3.47 0.00
PasswordAuth
10.0 80 0 673.62 411 1187 2.67 0.00
10.1 79 0 860.19 526 1480 2.63 0.00
PasswordAuthNegative
11.0 52 0 594.02 336 924 1.73 0.00
Rescope
12.0 0 0 0.00 0 0 0.00 0.00
12.1 126 0 480.21 169 745 4.20 0.00
RescopeNegative
13.0 0 0 0.00 0 0 0.00 0.00
13.1 77 0 396.68 184 583 2.57 0.00
SystemScopeAuth
14.0 71 0 866.90 330 1328 2.37 0.00
ApiKeyCRUD
15.0 0 0 0.00 0 0 0.00 0.00
15.1 0 0 0.00 0 0 0.00 0.00
15.2 38 0 419.00 254 596 1.27 0.00
15.3 38 0 380.58 105 516 1.27 0.00
15.4 1 0 66.00 66 66 0.03 0.00
MappingCRUD
16.0 0 0 0.00 0 0 0.00 0.00
16.1 0 0 0.00 0 0 0.00 0.00
16.2 38 0 386.29 201 581 1.27 0.00
16.3 38 0 413.11 234 597 1.27 0.00
16.4 1 0 81.00 81 81 0.03 0.00
OAuth2ClientCRUD
17.0 0 0 0.00 0 0 0.00 0.00
17.1 0 0 0.00 0 0 0.00 0.00
17.2 38 0 412.42 236 633 1.27 0.00
17.3 37 0 394.62 241 572 1.23 0.00
17.4 1 0 111.00 111 111 0.03 0.00
OAuth2ClientCredentials
18.0 0 0 0.00 0 0 0.00 0.00
18.1 0 0 0.00 0 0 0.00 0.00
18.2 16 0 406.19 284 610 0.53 0.00
18.3 1 0 32.00 32 32 0.03 0.00
OAuth2DeviceAuthorization
19.0 679 0 43.82 6 185 22.63 0.00
OAuth2Discovery
20.0 2376 0 18.44 2 119 79.20 0.00
20.1 2376 0 18.56 2 136 79.20 0.00
ScimRealmRead
21.0 0 0 0.00 0 0 0.00 0.00
21.1 25 0 406.44 268 561 0.83 0.00
21.2 24 0 412.75 201 564 0.80 0.00
21.3 24 0 432.00 257 586 0.80 0.00
ScimSync
22.0 0 0 0.00 0 0 0.00 0.00
22.1 0 0 0.00 0 0 0.00 0.00
22.2 0 0 0.00 0 0 0.00 0.00
22.3 52 0 599.08 137 1036 1.73 0.00
22.4 51 0 0.00 0 0 1.70 0.00
22.5 51 0 0.00 0 0 1.70 0.00
22.6 1 0 0.00 0 0 0.03 0.00
Aggregated 7955 0 165.90 2 2048 265.17 0.00

Scenario Metrics

Transaction # Users # Times Run Average (ms) Min (ms) Max (ms) Scenarios/s Iterations
ReadHeavy 4 89 1341.37 986 1679 2.97 22.25
TokenLifecycle 3 54 1672.52 1185 2048 1.80 18.00
ValidateToken 2 117 514.47 287 734 3.90 58.50
UserCRUD 2 135 445.09 239 704 4.50 67.50
ProjectCRUD 1 70 431.67 250 653 2.33 70.00
RoleCRUD 1 69 434.83 245 614 2.30 69.00
RoleList 2 140 430.54 237 644 4.67 70.00
RoleAssignmentList 3 54 1680.63 1190 1962 1.80 18.00
UserRead 4 130 918.56 583 1318 4.33 32.50
ProjectRead 3 104 865.62 540 1162 3.47 34.67
PasswordAuth 4 76 1538.99 1101 2150 2.53 19.00
PasswordAuthNegative 1 51 595.94 336 924 1.70 51.00
Rescope 2 124 481.90 275 745 4.13 62.00
RescopeNegative 1 76 399.47 209 583 2.53 76.00
SystemScopeAuth 2 69 874.16 544 1328 2.30 34.50
ApiKeyCRUD 1 37 804.62 540 1050 1.23 37.00
MappingCRUD 1 38 799.89 557 1040 1.27 38.00
OAuth2ClientCRUD 1 37 806.49 510 1163 1.23 37.00
OAuth2ClientCredentials 1 16 1882.00 1570 2567 0.53 16.00
OAuth2DeviceAuthorization 1 678 43.86 6 185 22.60 678.00
OAuth2Discovery 3 2375 37.50 5 176 79.17 791.67
ScimRealmRead 1 24 1251.58 850 1633 0.80 24.00
ScimSync 1 51 590.80 137 1036 1.70 51.00
Aggregated 45 4614 292.05 5 2567 153.80 2375.58

Error Metrics

Method Name # Error
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 49 401 Unauthorized: GET /SCIM/v2/:domain_id/Users (sync reconcile list)
POST POST /SCIM/v2/:domain_id/Users (sync provision) 1 401 Unauthorized: POST /SCIM/v2/:domain_id/Users (sync provision)
POST POST /v3/auth/tokens (password, invalid) 120 401 Unauthorized: POST /v3/auth/tokens (password, invalid)
POST POST /v3/auth/tokens (rescope, invalid project) 190 401 Unauthorized: POST /v3/auth/tokens (rescope, invalid project)
GET GET /v3/auth/tokens (validate revoked) 210 404 Not Found: GET /v3/auth/tokens (validate revoked)
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 52 429 Too Many Requests: GET /SCIM/v2/:domain_id/Users (sync reconcile list)

View full report

@github-actions

github-actions Bot commented Oct 21, 2026

Copy link
Copy Markdown

🧪 Tempest Identity Compatibility Results (advisory, non-blocking)

rust

Totals
======
Ran: 133 tests in 22.5467 sec.
 - Passed: 83
 - Skipped: 4
 - Expected Fail: 0
 - Unexpected Success: 0
 - Failed: 46
Sum of execute time for each test: 24.5440 sec.
Failed test IDs 
===== FAILED TESTS (target=rust) =====
tempest.api.identity.admin.v3.test_domains_negative.DomainsNegativeTestJSON.test_delete_active_domain[gate,id-1f3fbff5-4e44-400d-9ca1-d953f05f609b,negative]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_create_domain_config_and_show_config_groups_and_options[id-9e3ff13c-f597-4f01-9377-d6c06c2a1477]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_create_update_and_delete_domain_config_groups_and_opts[id-c7510fa2-6661-4170-9c6b-4783a80651e9]
tempest.api.identity.admin.v3.test_default_project_id.TestDefaultProjectId.test_default_project_id[id-d6110661-6a71-49a7-a453-b5e26640ff6d]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_show_default_group_config_and_options[id-11a02bf0-6f94-4380-b3b0-c8dc18fc0d22]
tempest.api.identity.admin.v3.test_credentials.CredentialsTestJSON.test_credentials_create_get_update_delete[id-7cd59bf9-bda4-4c72-9467-d21cab278355,smoke]
setUpClass (tempest.api.identity.admin.v3.test_endpoint_groups.EndPointGroupsTest)
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_check_revoke_roles_on_projects_group[id-26021436-d5a4-4256-943c-ded01e0d4b45]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_check_revoke_roles_on_projects_user[id-18b70e45-7687-4b72-8277-b8f1a47d7591]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_check_revoke_roles_on_domains_group[id-c7a8dda2-be50-4fb4-9a9c-e830771078b1]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_create_and_show_consumer[id-c8307ea6-a86c-47fd-ae7b-5b3b2caca76d]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_delete_consumer[id-fdfa1b7f-2a31-4354-b2c7-f6ae20554f93]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_list_consumers[id-09ca50de-78f2-4ffb-ac71-f2254036b2b8]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_update_consumer[id-080a9b1a-c009-47c0-9979-5305bf72e3dc]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_check_revoke_roles_on_domains_user[id-4e6f0366-97c8-423c-b2be-41eae6ac91c8]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_revoke_user_roles_on_domain[id-3acf666e-5354-42ac-8e17-8b68893bcd36]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_revoke_user_roles_on_project_tree[id-9f02ccd9-9b57-46b4-8f77-dd5a736f3a06]
tempest.api.identity.admin.v3.test_groups.GroupsV3TestJSON.test_group_users_add_list_delete[id-1598521a-2f36-4606-8df9-30772bd51339,smoke]
tempest.api.identity.admin.v3.test_groups.GroupsV3TestJSON.test_list_user_groups[id-64573281-d26a-4a52-b899-503cb0f4e4ec]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_create_is_domain_project[id-a7eb9416-6f9b-4dbb-b71b-7f73aaef59d5]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_project_create_with_parent[id-1854f9c0-70bc-4d11-a08a-1c789d339e3d]
tempest.api.identity.admin.v3.test_list_projects.ListProjectsTestJSON.test_list_projects_with_parent[id-6edc66f5-2941-4a17-9526-4073311c1fac]
tempest.api.identity.admin.v3.test_project_tags.IdentityV3ProjectTagsTest.test_list_update_delete_project_tags[id-7c123aac-999d-416a-a0fb-84b915ab10de]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_assignments_for_domain_roles[id-3859df7e-5b78-4e4d-b10e-214c8953842a]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_assignments_for_implied_roles_create_delete[id-c8828027-df48-4021-95df-b65b92c7429e]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_group_on_domain[id-4bf8a70b-e785-413a-ad53-9f91ce02faa7]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_group_on_project[id-cbf11737-1904-4690-9613-97bcbb3df1c4]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_grant_list_revoke_role_to_user_on_domain[id-6c9a2940-3625-43a3-ac02-5dcec62ef3bd]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_implied_domain_roles[id-eb1e1c24-1bc4-4d47-9748-e127a1852c82]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_implied_roles_create_check_show_delete[id-c90c316c-d706-4728-bcba-eb1912081b69]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_role_create_update_show_list[id-18afc6c0-46cf-4911-824e-9989cc056c3a,smoke]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_get_trusts_all[id-4773ebd5-ecbf-4255-b8d8-b63e6f72b65d,smoke]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_get_trusts_query[id-6268b345-87ca-47c0-9ce3-37792b43403a]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_expire[id-0ed14b66-cefd-4b5c-a964-65759453e292]
tempest.api.identity.admin.v3.test_tokens.TokensV3TestJSON.test_get_available_domain_scopes[id-ec5ecb05-af64-4c04-ac86-4d9f6f12f185]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_create_application_credential_expires[id-852daf0c-42b5-4239-8466-d193d0543ed3]
tempest.api.identity.admin.v3.test_tokens.TokensV3TestJSON.test_rescope_token[id-565fa210-1da1-4563-999b-f7b5b67cf112]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_impersonate[id-5a0a91a4-baef-4a14-baba-59bf4d7fcace]
tempest.api.identity.admin.v3.test_users_negative.UsersNegativeTest.test_create_user_for_non_existent_domain[id-e75f006c-89cc-477b-874d-588e4eab4b17,negative]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_noimpersonate[id-ed2a8779-a7ac-49dc-afd7-30f32f936ed2]
tempest.api.identity.v3.test_catalog.IdentityCatalogTest.test_catalog_standardization[id-56b57ced-22b8-4127-9b8a-565dfb0207e2]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_api_media_types[id-657c1970-4722-4189-8831-7325f3bc4265,smoke]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_api_version_resources[id-b9232f5e-d9e5-4d97-b96c-28d3db4de1bd,smoke]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_identity_v3_existence[id-79aec9ae-710f-4c54-a4fc-3aa25b4feac3]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_list_api_versions[id-721f480f-35b6-46c7-846e-047e6acea0dc,smoke]
tempest.api.identity.v3.test_tokens.TokensV3Test.test_validate_token[id-a9512ac3-3909-48a4-b395-11f438e16260]
===== END FAILED TESTS (target=rust) =====

View full run

@gtema
gtema added this pull request to the merge queue Oct 21, 2026
Merged via the queue into main with commit 482a257 Oct 21, 2026
42 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@gtema