openstack/keystone — Week of 2026-09-05

Delegated-token hardening. Nearly the entire week's ~5,400 lines land a coordinated tightening of what delegated credentials are allowed to do. The centerpiece rejects delegated tokens (trusts, OAuth1, application credentials) across all endpoints, shipped four times as a master change plus stable-branch backports at ~917 lines each. A companion series closes the same gap on token-method reauthentication so a delegated token cannot be exchanged for a fresh one, again fanned out across four branches. Rounding out the set, ec2credential tokens are now banned from the Keystone API itself on master and two stable branches, and a smaller four-branch fix prevents unauthorized project-scoped assignment listing. A single-branch change also caps trust-scoped token expiry at the trust's own expiry.

LDAP identity backend. The LDAP driver picks up documentation clarifying that marker-based pagination is unsupported, alongside a fix for sizelimit pool poisoning that had been leaking constrained search state back into the connection pool.

Maintenance. A one-liner escapes a stray % sign in a format string.