Skip to content

feat: Initiate work on SingleUseStore - #1641

Merged
gtema merged 3 commits into
mainfrom
replaycache
Nov 13, 2026
Merged

feat: Initiate work on SingleUseStore#1641
gtema merged 3 commits into
mainfrom
replaycache

Conversation

@gtema

@gtema gtema commented Nov 13, 2026

Copy link
Copy Markdown
Collaborator
  • docs(adr): Add single-use credential registry
  • feat(core): Add single-use credential store trait
  • feat(config): Add replay cache bound options

gtema added 3 commits November 13, 2026 12:39
@gtema
docs(adr): Add single-use credential registry
f334282 
Add ADR 0044 for replay protection of external IdP assertions,
TOTP passcodes and DPoP proofs. Each credential is accepted at
most once inside its validity window.

The ADR defines a SingleUseStore trait with a bounded local
implementation and a Raft-backed cluster implementation. The
cluster store uses durable CreateIfAbsent records in time-bucketed
keyspaces that a new replicated DropKeyspace mutation removes.

It also sets per-use-case defaults with the CRA and NIS2
rationale, the order of checks, error mapping, rolling upgrade
gate and clock skew requirements.

Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
@gtema
feat(core): Add single-use credential store trait
8924771 
Add the SingleUseStore trait, SingleUseError, the shared
preconditions and the assertion scope helpers from ADR 0044, plus a
behavioural suite every implementation must pass. No implementation
is included: the local store lands with the replay cache and the
Raft store later.

Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
@gtema
feat(config): Add replay cache bound options
4d4ebf1 
Add the assertion replay cache options to [oauth2] and the TOTP
replay cache options to [auth], with validation that a per-scope
bound does not exceed its total (ADR 0044 section 2).

Signed-off-by: Artem Goncharov <artem.goncharov@gmail.com>
@github-actions

github-actions Bot commented Nov 13, 2026

Copy link
Copy Markdown

🦢 Load Test Results

Goose Attack Report

Plan Overview

Action Started Stopped Elapsed Users
Increasing 26-11-13 12:14:50 26-11-13 12:15:12 00:00:22 0 → 45
Maintaining 26-11-13 12:15:12 26-11-13 12:15:42 00:00:30 45
Decreasing 26-11-13 12:15:42 26-11-13 12:15:44 00:00:02 0 ← 45

Request Metrics

Method Name # Requests # Fails Average (ms) Min (ms) Max (ms) RPS Failures/s
DELETE DELETE /SCIM/v2/:domain_id/Users/:id (sync offboard) 1 0 158 158 158 0.03 0.00
DELETE DELETE /v3/OS-TRUST/trusts/:id 26 0 240 6.28 354 0.87 0.00
DELETE DELETE /v3/auth/tokens 90 0 196 117 338 3.00 0.00
DELETE DELETE /v3/auth/tokens (churn) 24 0 216 26 335 0.80 0.00
DELETE DELETE /v3/credentials/:id 24 0 181 13 334 0.80 0.00
DELETE DELETE /v3/endpoints/:id 34 0 161 18 281 1.13 0.00
DELETE DELETE /v3/groups/:id 37 0 209 71 372 1.23 0.00
DELETE DELETE /v3/groups/:id/users/:id 37 0 263 115 461 1.23 0.00
DELETE DELETE /v3/projects/:id (churn) 24 0 313 13 468 0.80 0.00
DELETE DELETE /v3/projects/:id (teardown) 1 0 119 119 119 0.03 0.00
DELETE DELETE /v3/projects/:id/users/:id/roles/:id (churn) 24 0 207 21 312 0.80 0.00
DELETE DELETE /v3/regions/:id 34 0 163 9.57 354 1.13 0.00
DELETE DELETE /v3/roles/:id (teardown) 1 0 69 69 69 0.03 0.00
DELETE DELETE /v3/services/:id 34 0 157 11 296 1.13 0.00
DELETE DELETE /v3/users/:id (churn) 50 0 289 8.2 504 1.67 0.00
DELETE DELETE /v3/users/:id (teardown) 2 0 184 175 193 0.07 0.00
DELETE DELETE /v4/mappings/rulesets/:mapping_id (cc teardown) 1 0 7.99 7.99 7.99 0.03 0.00
DELETE DELETE /v4/mappings/rulesets/:mapping_id (teardown) 1 0 197 197 197 0.03 0.00
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (cc teardown) 1 0 9.86 9.86 9.86 0.03 0.00
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown) 1 0 227 227 227 0.03 0.00
GET 109 0 165 75 310 3.63 0.00
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 15 0 379 1.3 600 0.50 0.00
└─ 200 (86.7%) 13 437 308 600
└─ 429 (13.3%) 2 2.26 1.3 3.23
GET GET /SCIM/v2/:domain_id/Users/:id (sync reconcile show) 16 0 107 1.38 641 0.53 0.00
└─ 200 (18.8%) 3 553 414 641
└─ 429 (81.2%) 13 4.31 1.38 7.18
GET GET /v3/OS-TRUST/trusts (by trustor) 26 0 166 5.12 247 0.87 0.00
GET GET /v3/OS-TRUST/trusts/:id 25 0 174 4.75 351 0.83 0.00
GET GET /v3/auth/tokens (churn validate) 24 0 208 48 384 0.80 0.00
GET GET /v3/auth/tokens (trustor) 24 0 211 134 369 0.80 0.00
GET GET /v3/auth/tokens (validate new) 89 0 164 81 315 2.97 0.00
GET GET /v3/auth/tokens (validate revoked) 90 0 167 64 269 3.00 0.00
GET GET /v3/auth/tokens (validate token) 288 0 208 85 382 9.60 0.00
GET GET /v3/credentials (by user) 24 0 134 5.29 259 0.80 0.00
GET GET /v3/credentials/:id 24 0 133 4.88 198 0.80 0.00
GET GET /v3/endpoints (by service) 33 0 138 5.05 262 1.10 0.00
GET GET /v3/endpoints/:id 33 0 139 4.73 246 1.10 0.00
GET GET /v3/groups 36 0 130 71 233 1.20 0.00
GET GET /v3/groups/:id 36 0 138 74 212 1.20 0.00
GET GET /v3/groups/:id/users 36 0 202 113 320 1.20 0.00
GET GET /v3/projects/:id 214 0 141 40 287 7.13 0.00
GET GET /v3/projects/:id (catalog) 187 0 140 55 284 6.23 0.00
GET GET /v3/projects?domain_id 297 0 182 67 319 9.90 0.00
GET GET /v3/regions/:id 33 0 144 29 274 1.10 0.00
GET GET /v3/role_assignments 104 0 155 62 271 3.47 0.00
GET GET /v3/role_assignments?role.id 105 0 141 56 243 3.50 0.00
GET GET /v3/role_assignments?scope.domain.id 106 0 132 49 260 3.53 0.00
GET GET /v3/role_assignments?user.id 106 0 147 63 272 3.53 0.00
GET GET /v3/roles 376 0 161 68 314 12.53 0.00
GET GET /v3/roles/:id 258 0 117 35 255 8.60 0.00
GET GET /v3/services 34 0 131 28 198 1.13 0.00
GET GET /v3/services/:id 33 0 137 8.94 241 1.10 0.00
GET GET /v3/users/:id 409 0 142 59 282 13.63 0.00
GET GET /v3/users/:id (catalog) 185 0 140 58 266 6.17 0.00
GET GET /v3/users?domain_id 294 0 191 82 372 9.80 0.00
GET GET /v4/api-keys 106 0 141 69 279 3.53 0.00
GET GET /v4/api-keys/:client_id 106 0 145 72 341 3.53 0.00
GET GET /v4/mappings/rulesets 105 0 141 79 288 3.50 0.00
GET GET /v4/mappings/rulesets/:mapping_id 106 0 146 57 263 3.53 0.00
GET GET /v4/oauth2/:domain_id/.well-known/openid-configuration 2293 0 13 1.47 228 76.43 0.00
GET GET /v4/oauth2/:domain_id/clients 106 0 144 68 275 3.53 0.00
GET GET /v4/oauth2/:domain_id/clients/:provider_id 107 0 141 67 245 3.57 0.00
GET GET /v4/oauth2/:domain_id/jwks 2294 0 13 1.45 176 76.47 0.00
GET GET /v4/scim_realms 66 0 136 70 281 2.20 0.00
GET GET /v4/scim_realms/:domain_id/:provider_id 66 0 144 87 269 2.20 0.00
HEAD HEAD /v3/groups/:id/users/:id 36 0 185 101 281 1.20 0.00
PATCH PATCH /SCIM/v2/:domain_id/Users/:id (sync attribute drift) 15 0 592 516 688 0.50 0.00
PATCH PATCH /v3/credentials/:id 24 0 255 15 390 0.80 0.00
PATCH PATCH /v3/groups/:id 36 0 198 93 360 1.20 0.00
PATCH PATCH /v3/services/:id 34 0 185 60 312 1.13 0.00
POST POST /v3/OS-TRUST/trusts 25 0 258 6.89 441 0.83 0.00
POST POST /v3/auth/tokens 89 0 133 56 267 2.97 0.00
POST POST /v3/auth/tokens (churn user) 24 0 1377 1006 2077 0.80 0.00
POST POST /v3/auth/tokens (password, invalid) 24 0 1308 1016 1998 0.80 0.00
POST POST /v3/auth/tokens (password, project-scoped) 24 0 1415 975 2116 0.80 0.00
POST POST /v3/auth/tokens (password, unscoped) 25 0 1310 900 2154 0.83 0.00
POST POST /v3/auth/tokens (rescope to system) 373 0 162 65 304 12.43 0.00
POST POST /v3/auth/tokens (rescope, invalid project) 213 0 142 50 264 7.10 0.00
POST POST /v3/auth/tokens (system-scoped, bootstrap admin) 46 0 1344 945 2267 1.53 0.00
POST POST /v3/credentials 24 0 145 6.2 290 0.80 0.00
POST POST /v3/endpoints 33 0 184 88 293 1.10 0.00
POST POST /v3/groups 36 0 156 79 317 1.20 0.00
POST POST /v3/projects (churn) 22 0 156 69 273 0.73 0.00
POST POST /v3/regions 32 0 152 57 270 1.07 0.00
POST POST /v3/services 33 0 148 97 196 1.10 0.00
POST POST /v3/users (churn) 49 0 1351 862 2260 1.63 0.00
POST POST /v3/users (setup) 1 0 2100 2100 2100 0.03 0.00
POST POST /v4/api-keys/:client_id/revoke (teardown) 1 0 187 187 187 0.03 0.00
POST POST /v4/oauth2/:domain_id/device_authorization 943 0 32 7.13 241 31.43 0.00
POST POST /v4/oauth2/:domain_id/token (client_credentials) 17 0 474 272 713 0.57 0.00
PUT PUT /v3/groups/:id/users/:id 36 0 207 124 323 1.20 0.00
PUT PUT /v3/projects/:id/users/:id/roles/:id (churn) 24 0 172 97 235 0.80 0.00
PUT PUT /v4/scim_realms/:domain_id/:provider_id 65 0 184 95 407 2.17 0.00
Aggregated 11775 0 114 1.3 2267 392.50 0.00

Response Time Metrics

Method Name 50%ile (ms) 60%ile (ms) 70%ile (ms) 80%ile (ms) 90%ile (ms) 95%ile (ms) 99%ile (ms) 100%ile (ms)
DELETE DELETE /SCIM/v2/:domain_id/Users/:id (sync offboard) 158 158 158 158 158 158 158 158
DELETE DELETE /v3/OS-TRUST/trusts/:id 253 257 264 301 301 338 354 354
DELETE DELETE /v3/auth/tokens 187 196 216 237 268 289 334 338
DELETE DELETE /v3/auth/tokens (churn) 216 228 241 253 281 285 335 335
DELETE DELETE /v3/credentials/:id 187 198 204 228 255 255 334 334
DELETE DELETE /v3/endpoints/:id 161 163 183 196 216 220 281 281
DELETE DELETE /v3/groups/:id 212 218 253 276 297 309 372 372
DELETE DELETE /v3/groups/:id/users/:id 264 289 297 317 387 408 461 461
DELETE DELETE /v3/projects/:id (churn) 309 330 367 371 453 465 468 468
DELETE DELETE /v3/projects/:id (teardown) 119 119 119 119 119 119 119 119
DELETE DELETE /v3/projects/:id/users/:id/roles/:id (churn) 206 222 228 237 301 305 312 312
DELETE DELETE /v3/regions/:id 148 167 183 198 230 243 354 354
DELETE DELETE /v3/roles/:id (teardown) 69 69 69 69 69 69 69 69
DELETE DELETE /v3/services/:id 157 169 173 177 204 218 296 296
DELETE DELETE /v3/users/:id (churn) 301 322 334 350 383 416 504 504
DELETE DELETE /v3/users/:id (teardown) 175 175 175 193 193 193 193 193
DELETE DELETE /v4/mappings/rulesets/:mapping_id (cc teardown) 7.99 7.99 7.99 7.99 7.99 7.99 7.99 7.99
DELETE DELETE /v4/mappings/rulesets/:mapping_id (teardown) 197 197 197 197 197 197 197 197
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (cc teardown) 9.86 9.86 9.86 9.86 9.86 9.86 9.86 9.86
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown) 227 227 227 227 227 227 227 227
GET 159 167 175 191 232 259 297 310
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 403 416 453 485 578 578 600 600
GET GET /SCIM/v2/:domain_id/Users/:id (sync reconcile show) 4.51 5.34 5.92 7.2 416 602 641 641
GET GET /v3/OS-TRUST/trusts (by trustor) 159 183 196 208 224 245 247 247
GET GET /v3/OS-TRUST/trusts/:id 177 187 191 202 237 245 351 351
GET GET /v3/auth/tokens (churn validate) 196 204 245 264 281 285 384 384
GET GET /v3/auth/tokens (trustor) 196 208 228 245 313 317 369 369
GET GET /v3/auth/tokens (validate new) 159 171 183 196 222 245 305 315
GET GET /v3/auth/tokens (validate revoked) 165 175 185 202 216 243 261 269
GET GET /v3/auth/tokens (validate token) 208 216 228 253 272 301 334 382
GET GET /v3/credentials (by user) 140 140 163 171 183 183 259 259
GET GET /v3/credentials/:id 134 138 155 161 177 187 198 198
GET GET /v3/endpoints (by service) 136 144 153 169 189 210 262 262
GET GET /v3/endpoints/:id 136 142 155 159 198 218 246 246
GET GET /v3/groups 124 132 138 148 157 177 233 233
GET GET /v3/groups/:id 138 142 146 167 179 187 212 212
GET GET /v3/groups/:id/users 194 202 216 239 255 293 320 320
GET GET /v3/projects/:id 138 144 155 173 202 214 245 287
GET GET /v3/projects/:id (catalog) 138 146 157 171 187 220 257 284
GET GET /v3/projects?domain_id 177 189 204 220 243 268 305 319
GET GET /v3/regions/:id 134 140 155 167 218 232 274 274
GET GET /v3/role_assignments 155 159 177 185 216 232 264 271
GET GET /v3/role_assignments?role.id 142 148 161 167 187 198 216 243
GET GET /v3/role_assignments?scope.domain.id 126 134 148 163 177 196 230 260
GET GET /v3/role_assignments?user.id 138 151 161 173 210 224 268 272
GET GET /v3/roles 159 167 181 189 216 241 285 314
GET GET /v3/roles/:id 113 119 132 142 155 175 216 255
GET GET /v3/services 132 138 144 159 189 194 198 198
GET GET /v3/services/:id 146 153 157 167 183 196 241 241
GET GET /v3/users/:id 138 144 157 171 194 210 257 282
GET GET /v3/users/:id (catalog) 134 142 155 167 189 216 253 266
GET GET /v3/users?domain_id 187 198 212 230 257 276 309 372
GET GET /v4/api-keys 132 140 153 169 202 226 268 279
GET GET /v4/api-keys/:client_id 134 148 155 171 210 232 297 341
GET GET /v4/mappings/rulesets 132 144 155 169 202 226 243 288
GET GET /v4/mappings/rulesets/:mapping_id 138 155 163 175 206 220 251 263
GET GET /v4/oauth2/:domain_id/.well-known/openid-configuration 9.54 11 13 15 21 28 87 228
GET GET /v4/oauth2/:domain_id/clients 140 146 155 175 189 222 239 275
GET GET /v4/oauth2/:domain_id/clients/:provider_id 132 142 153 171 204 226 243 245
GET GET /v4/oauth2/:domain_id/jwks 9.54 11 13 15 21 29 91 176
GET GET /v4/scim_realms 127 134 140 163 194 216 239 281
GET GET /v4/scim_realms/:domain_id/:provider_id 134 144 159 175 194 220 251 269
HEAD HEAD /v3/groups/:id/users/:id 183 191 196 224 251 264 281 281
PATCH PATCH /SCIM/v2/:domain_id/Users/:id (sync attribute drift) 586 586 635 635 651 651 688 688
PATCH PATCH /v3/credentials/:id 261 268 313 317 326 390 390 390
PATCH PATCH /v3/groups/:id 189 198 208 234 245 281 360 360
PATCH PATCH /v3/services/:id 185 187 202 218 253 259 312 312
POST POST /v3/OS-TRUST/trusts 255 261 297 330 399 403 441 441
POST POST /v3/auth/tokens 124 132 144 165 194 212 249 267
POST POST /v3/auth/tokens (churn user) 1,352 1,384 1,417 1,548 1,696 1,909 2,077 2,077
POST POST /v3/auth/tokens (password, invalid) 1,303 1,335 1,352 1,401 1,565 1,597 1,998 1,998
POST POST /v3/auth/tokens (password, project-scoped) 1,401 1,401 1,450 1,516 1,614 2,040 2,116 2,116
POST POST /v3/auth/tokens (password, unscoped) 1,237 1,270 1,352 1,417 1,729 1,876 2,154 2,154
POST POST /v3/auth/tokens (rescope to system) 159 169 179 194 216 237 285 304
POST POST /v3/auth/tokens (rescope, invalid project) 138 144 155 169 200 218 247 264
POST POST /v3/auth/tokens (system-scoped, bootstrap admin) 1,270 1,352 1,368 1,401 1,548 1,761 2,267 2,267
POST POST /v3/credentials 140 146 159 171 202 208 290 290
POST POST /v3/endpoints 185 198 206 216 239 243 293 293
POST POST /v3/groups 142 155 167 175 202 261 317 317
POST POST /v3/projects (churn) 153 161 165 198 204 232 273 273
POST POST /v3/regions 148 155 157 194 228 251 270 270
POST POST /v3/services 146 153 159 167 183 189 196 196
POST POST /v3/users (churn) 1,368 1,384 1,417 1,483 1,614 1,810 2,260 2,260
POST POST /v3/users (setup) 2,100 2,100 2,100 2,100 2,100 2,100 2,100 2,100
POST POST /v4/api-keys/:client_id/revoke (teardown) 187 187 187 187 187 187 187 187
POST POST /v4/oauth2/:domain_id/device_authorization 24 28 32 39 53 78 181 241
POST POST /v4/oauth2/:domain_id/token (client_credentials) 481 489 522 545 610 709 713 713
PUT PUT /v3/groups/:id/users/:id 189 200 206 259 276 305 323 323
PUT PUT /v3/projects/:id/users/:id/roles/:id (churn) 175 181 185 196 220 226 235 235
PUT PUT /v4/scim_realms/:domain_id/:provider_id 165 181 208 230 264 281 371 407
Aggregated 94 125 148 173 214 259 1,253 2,267

Status Code Metrics

Method Name Status Codes
DELETE DELETE /SCIM/v2/:domain_id/Users/:id (sync offboard) 1 [204]
DELETE DELETE /v3/OS-TRUST/trusts/:id 26 [204]
DELETE DELETE /v3/auth/tokens 90 [204]
DELETE DELETE /v3/auth/tokens (churn) 24 [204]
DELETE DELETE /v3/credentials/:id 24 [204]
DELETE DELETE /v3/endpoints/:id 34 [204]
DELETE DELETE /v3/groups/:id 37 [204]
DELETE DELETE /v3/groups/:id/users/:id 37 [204]
DELETE DELETE /v3/projects/:id (churn) 24 [204]
DELETE DELETE /v3/projects/:id (teardown) 1 [204]
DELETE DELETE /v3/projects/:id/users/:id/roles/:id (churn) 24 [204]
DELETE DELETE /v3/regions/:id 34 [204]
DELETE DELETE /v3/roles/:id (teardown) 1 [204]
DELETE DELETE /v3/services/:id 34 [204]
DELETE DELETE /v3/users/:id (churn) 50 [204]
DELETE DELETE /v3/users/:id (teardown) 2 [204]
DELETE DELETE /v4/mappings/rulesets/:mapping_id (cc teardown) 1 [204]
DELETE DELETE /v4/mappings/rulesets/:mapping_id (teardown) 1 [204]
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (cc teardown) 1 [204]
DELETE DELETE /v4/oauth2/:domain_id/clients/:provider_id (teardown) 1 [204]
GET 109 [200]
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 2 [429], 13 [200]
GET GET /SCIM/v2/:domain_id/Users/:id (sync reconcile show) 13 [429], 3 [200]
GET GET /v3/OS-TRUST/trusts (by trustor) 26 [200]
GET GET /v3/OS-TRUST/trusts/:id 25 [200]
GET GET /v3/auth/tokens (churn validate) 24 [200]
GET GET /v3/auth/tokens (trustor) 24 [200]
GET GET /v3/auth/tokens (validate new) 89 [200]
GET GET /v3/auth/tokens (validate revoked) 90 [404]
GET GET /v3/auth/tokens (validate token) 288 [200]
GET GET /v3/credentials (by user) 24 [200]
GET GET /v3/credentials/:id 24 [200]
GET GET /v3/endpoints (by service) 33 [200]
GET GET /v3/endpoints/:id 33 [200]
GET GET /v3/groups 36 [200]
GET GET /v3/groups/:id 36 [200]
GET GET /v3/groups/:id/users 36 [200]
GET GET /v3/projects/:id 214 [200]
GET GET /v3/projects/:id (catalog) 187 [200]
GET GET /v3/projects?domain_id 297 [200]
GET GET /v3/regions/:id 33 [200]
GET GET /v3/role_assignments 104 [200]
GET GET /v3/role_assignments?role.id 105 [200]
GET GET /v3/role_assignments?scope.domain.id 106 [200]
GET GET /v3/role_assignments?user.id 106 [200]
GET GET /v3/roles 376 [200]
GET GET /v3/roles/:id 258 [200]
GET GET /v3/services 34 [200]
GET GET /v3/services/:id 33 [200]
GET GET /v3/users/:id 409 [200]
GET GET /v3/users/:id (catalog) 185 [200]
GET GET /v3/users?domain_id 294 [200]
GET GET /v4/api-keys 106 [200]
GET GET /v4/api-keys/:client_id 106 [200]
GET GET /v4/mappings/rulesets 105 [200]
GET GET /v4/mappings/rulesets/:mapping_id 106 [200]
GET GET /v4/oauth2/:domain_id/.well-known/openid-configuration 2,293 [200]
GET GET /v4/oauth2/:domain_id/clients 106 [200]
GET GET /v4/oauth2/:domain_id/clients/:provider_id 107 [200]
GET GET /v4/oauth2/:domain_id/jwks 2,294 [200]
GET GET /v4/scim_realms 66 [200]
GET GET /v4/scim_realms/:domain_id/:provider_id 66 [200]
HEAD HEAD /v3/groups/:id/users/:id 36 [204]
PATCH PATCH /SCIM/v2/:domain_id/Users/:id (sync attribute drift) 15 [200]
PATCH PATCH /v3/credentials/:id 24 [200]
PATCH PATCH /v3/groups/:id 36 [200]
PATCH PATCH /v3/services/:id 34 [200]
POST POST /v3/OS-TRUST/trusts 25 [201]
POST POST /v3/auth/tokens 89 [201]
POST POST /v3/auth/tokens (churn user) 24 [201]
POST POST /v3/auth/tokens (password, invalid) 24 [401]
POST POST /v3/auth/tokens (password, project-scoped) 24 [201]
POST POST /v3/auth/tokens (password, unscoped) 25 [201]
POST POST /v3/auth/tokens (rescope to system) 373 [201]
POST POST /v3/auth/tokens (rescope, invalid project) 213 [401]
POST POST /v3/auth/tokens (system-scoped, bootstrap admin) 46 [201]
POST POST /v3/credentials 24 [201]
POST POST /v3/endpoints 33 [201]
POST POST /v3/groups 36 [201]
POST POST /v3/projects (churn) 22 [201]
POST POST /v3/regions 32 [201]
POST POST /v3/services 33 [201]
POST POST /v3/users (churn) 49 [201]
POST POST /v3/users (setup) 1 [201]
POST POST /v4/api-keys/:client_id/revoke (teardown) 1 [200]
POST POST /v4/oauth2/:domain_id/device_authorization 943 [200]
POST POST /v4/oauth2/:domain_id/token (client_credentials) 17 [200]
PUT PUT /v3/groups/:id/users/:id 36 [204]
PUT PUT /v3/projects/:id/users/:id/roles/:id (churn) 24 [204]
PUT PUT /v4/scim_realms/:domain_id/:provider_id 65 [200]
Aggregated 15 [429], 543 [204], 90 [404], 836 [201], 237 [401], 10,054 [200]

Transaction Metrics

Transaction # Times Run # Fails Average (ms) Min (ms) Max (ms) RPS Failures/s
ReadHeavy
0.0 1 0 2325 2325 2325 0.03 0.00
0.1 108 0 196 106 372 3.60 0.00
0.2 108 0 179 82 305 3.60 0.00
0.3 109 0 165 75 310 3.63 0.00
TokenLifecycle
1.0 1 0 2518 2518 2518 0.03 0.00
1.1 90 0 660 422 924 3.00 0.00
ValidateToken
2.0 1 0 1984 1984 1984 0.03 0.00
2.1 288 0 208 85 382 9.60 0.00
UserCRUD
3.0 1 0 2160 2160 2160 0.03 0.00
3.1 1 0 2100 2100 2100 0.03 0.00
3.2 409 0 142 59 282 13.63 0.00
3.3 2 0 184 175 193 0.07 0.00
ProjectCRUD
4.0 0 0 0 0 0 0.00 0.00
4.1 0 0 0 0 0 0.00 0.00
4.2 214 0 141 40 287 7.13 0.00
4.3 1 0 119 119 119 0.03 0.00
RoleCRUD
5.0 0 0 0 0 0 0.00 0.00
5.1 0 0 0 0 0 0.00 0.00
5.2 258 0 117 35 255 8.60 0.00
5.3 1 0 69 69 69 0.03 0.00
RoleList
6.0 0 0 0 0 0 0.00 0.00
6.1 376 0 161 68 314 12.53 0.00
RoleAssignmentList
7.0 0 0 0 0 0 0.00 0.00
7.1 104 0 155 62 271 3.47 0.00
7.2 104 0 147 63 272 3.47 0.00
7.3 106 0 132 49 260 3.53 0.00
7.4 105 0 141 56 243 3.50 0.00
UserRead
8.0 0 0 0 0 0 0.00 0.00
8.1 184 0 188 82 332 6.13 0.00
8.2 185 0 140 58 266 6.17 0.00
ProjectRead
9.0 0 0 0 0 0 0.00 0.00
9.1 187 0 183 67 319 6.23 0.00
9.2 187 0 140 55 284 6.23 0.00
PasswordAuth
10.0 24 0 1275 900 1869 0.80 0.00
10.1 24 0 1415 975 2116 0.80 0.00
PasswordAuthNegative
11.0 24 0 1308 1016 1998 0.80 0.00
Rescope
12.0 0 0 0 0 0 0.00 0.00
12.1 373 0 162 66 304 12.43 0.00
RescopeNegative
13.0 0 0 0 0 0 0.00 0.00
13.1 213 0 142 50 264 7.10 0.00
SystemScopeAuth
14.0 46 0 1344 945 2267 1.53 0.00
GroupChurn
15.0 0 0 0 0 0 0.00 0.00
15.1 37 0 1680 1186 2074 1.23 0.00
CatalogChurn
16.0 0 0 0 0 0 0.00 0.00
16.1 34 0 1833 467 2244 1.13 0.00
CredentialChurn
17.0 0 0 0 0 0 0.00 0.00
17.1 24 0 2612 1220 3346 0.80 0.00
TrustChurn
18.0 0 0 0 0 0 0.00 0.00
18.1 26 0 2597 1115 3321 0.87 0.00
IdentityChurn
19.0 0 0 0 0 0 0.00 0.00
19.1 24 0 2646 1478 3231 0.80 0.00
ApiKeyCRUD
20.0 0 0 0 0 0 0.00 0.00
20.1 0 0 0 0 0 0.00 0.00
20.2 105 0 145 72 341 3.50 0.00
20.3 106 0 141 69 279 3.53 0.00
20.4 1 0 187 187 187 0.03 0.00
MappingCRUD
21.0 0 0 0 0 0 0.00 0.00
21.1 0 0 0 0 0 0.00 0.00
21.2 106 0 146 57 263 3.53 0.00
21.3 105 0 141 79 288 3.50 0.00
21.4 1 0 197 197 197 0.03 0.00
OAuth2ClientCRUD
22.0 0 0 0 0 0 0.00 0.00
22.1 0 0 0 0 0 0.00 0.00
22.2 106 0 141 67 245 3.53 0.00
22.3 106 0 144 68 275 3.53 0.00
22.4 1 0 227 227 227 0.03 0.00
OAuth2ClientCredentials
23.0 0 0 0 0 0 0.00 0.00
23.1 0 0 0 0 0 0.00 0.00
23.2 17 0 474 272 713 0.57 0.00
23.3 1 0 18 18 18 0.03 0.00
OAuth2DeviceAuthorization
24.0 943 0 32 7.15 241 31.43 0.00
OAuth2Discovery
25.0 2293 0 13 1.46 176 76.43 0.00
25.1 2293 0 13 1.48 228 76.43 0.00
ScimRealmRead
26.0 0 0 0 0 0 0.00 0.00
26.1 65 0 143 87 269 2.17 0.00
26.2 66 0 136 70 281 2.20 0.00
26.3 65 0 184 95 407 2.17 0.00
ScimSync
27.0 0 0 0 0 0 0.00 0.00
27.1 0 0 0 0 0 0.00 0.00
27.2 0 0 0 0 0 0.00 0.00
27.3 15 0 513 308 1004 0.50 0.00
27.4 15 0 954 604 1008 0.50 0.00
27.5 15 0 592 516 688 0.50 0.00
27.6 1 0 158 158 158 0.03 0.00
Aggregated 10406 0 131 1.46 3346 346.87 0.00

Scenario Metrics

Scenario # Users # Times Run Average (ms) Min (ms) Max (ms) Scenarios/s Iterations
ReadHeavy 2 107 543 266 780 3.57 53.50
TokenLifecycle 2 88 664 422 924 2.93 44.00
ValidateToken 2 286 209 85 382 9.53 143.00
UserCRUD 2 407 142 59 282 13.57 203.50
ProjectCRUD 1 213 141 40 287 7.10 213.00
RoleCRUD 1 257 117 35 255 8.57 257.00
RoleList 2 374 161 68 314 12.47 187.00
RoleAssignmentList 2 104 579 344 821 3.47 52.00
UserRead 2 184 329 145 531 6.13 92.00
ProjectRead 2 186 325 167 551 6.20 93.00
PasswordAuth 2 23 2762 2354 4270 0.77 11.50
PasswordAuthNegative 1 23 1315 1016 1998 0.77 23.00
Rescope 2 371 162 66 304 12.37 185.50
RescopeNegative 1 212 142 50 264 7.07 212.00
SystemScopeAuth 2 44 1353 945 2267 1.47 22.00
GroupChurn 2 35 1704 1186 2074 1.17 17.50
CatalogChurn 2 32 1883 1341 2244 1.07 16.00
CredentialChurn 2 22 2708 2310 3346 0.73 11.00
TrustChurn 2 24 2719 2395 3321 0.80 12.00
IdentityChurn 2 22 2705 2226 3231 0.73 11.00
ApiKeyCRUD 1 105 286 176 470 3.50 105.00
MappingCRUD 1 105 288 136 469 3.50 105.00
OAuth2ClientCRUD 1 106 285 151 462 3.53 106.00
OAuth2ClientCredentials 1 16 1905 1526 2499 0.53 16.00
OAuth2DeviceAuthorization 1 942 32 7.15 241 31.40 942.00
OAuth2Discovery 2 2292 26 4.25 286 76.40 1146.00
ScimRealmRead 1 65 463 279 644 2.17 65.00
ScimSync 1 15 2058 1965 2227 0.50 15.00
Aggregated 45 6660 204 4.25 4270 222.00 148.00

Error Metrics

Method Name # Error
POST POST /v3/auth/tokens (password, invalid) 48 401 Unauthorized: POST /v3/auth/tokens (password, invalid)
POST POST /v3/auth/tokens (rescope, invalid project) 426 401 Unauthorized: POST /v3/auth/tokens (rescope, invalid project)
GET GET /v3/auth/tokens (validate revoked) 180 404 Not Found: GET /v3/auth/tokens (validate revoked)
GET GET /SCIM/v2/:domain_id/Users (sync reconcile list) 4 429 Too Many Requests: GET /SCIM/v2/:domain_id/Users (sync reconcile list)
GET GET /SCIM/v2/:domain_id/Users/:id (sync reconcile show) 26 429 Too Many Requests: GET /SCIM/v2/:domain_id/Users/:id (sync reconcile show)

View full report

@github-actions

github-actions Bot commented Nov 13, 2026

Copy link
Copy Markdown

🧪 Tempest Identity Compatibility Results (advisory, non-blocking)

rust

Totals
======
Ran: 133 tests in 36.0435 sec.
 - Passed: 89
 - Skipped: 4
 - Expected Fail: 0
 - Unexpected Success: 0
 - Failed: 40
Sum of execute time for each test: 30.1608 sec.
Failed test IDs 
===== FAILED TESTS (target=rust) =====
tempest.api.identity.admin.v3.test_credentials.CredentialsTestJSON.test_credentials_create_get_update_delete[id-7cd59bf9-bda4-4c72-9467-d21cab278355,smoke]
tempest.api.identity.admin.v3.test_default_project_id.TestDefaultProjectId.test_default_project_id[id-d6110661-6a71-49a7-a453-b5e26640ff6d]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_create_domain_config_and_show_config_groups_and_options[id-9e3ff13c-f597-4f01-9377-d6c06c2a1477]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_create_update_and_delete_domain_config_groups_and_opts[id-c7510fa2-6661-4170-9c6b-4783a80651e9]
tempest.api.identity.admin.v3.test_domain_configuration.DomainConfigurationTestJSON.test_show_default_group_config_and_options[id-11a02bf0-6f94-4380-b3b0-c8dc18fc0d22]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_check_revoke_roles_on_projects_group[id-26021436-d5a4-4256-943c-ded01e0d4b45]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_check_revoke_roles_on_projects_user[id-18b70e45-7687-4b72-8277-b8f1a47d7591]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_check_revoke_roles_on_domains_group[id-c7a8dda2-be50-4fb4-9a9c-e830771078b1]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_check_revoke_roles_on_domains_user[id-4e6f0366-97c8-423c-b2be-41eae6ac91c8]
tempest.api.identity.admin.v3.test_domains_negative.DomainsNegativeTestJSON.test_delete_active_domain[gate,id-1f3fbff5-4e44-400d-9ca1-d953f05f609b,negative]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_revoke_user_roles_on_domain[id-3acf666e-5354-42ac-8e17-8b68893bcd36]
tempest.api.identity.admin.v3.test_inherits.InheritsV3TestJSON.test_inherit_assign_list_revoke_user_roles_on_project_tree[id-9f02ccd9-9b57-46b4-8f77-dd5a736f3a06]
setUpClass (tempest.api.identity.admin.v3.test_endpoint_groups.EndPointGroupsTest)
tempest.api.identity.admin.v3.test_list_projects.ListProjectsTestJSON.test_list_projects_with_parent[id-6edc66f5-2941-4a17-9526-4073311c1fac]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_create_and_show_consumer[id-c8307ea6-a86c-47fd-ae7b-5b3b2caca76d]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_delete_consumer[id-fdfa1b7f-2a31-4354-b2c7-f6ae20554f93]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_list_consumers[id-09ca50de-78f2-4ffb-ac71-f2254036b2b8]
tempest.api.identity.admin.v3.test_oauth_consumers.OAUTHConsumersV3Test.test_update_consumer[id-080a9b1a-c009-47c0-9979-5305bf72e3dc]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_get_trusts_all[id-4773ebd5-ecbf-4255-b8d8-b63e6f72b65d,smoke]
tempest.api.identity.admin.v3.test_users_negative.UsersNegativeTest.test_create_user_for_non_existent_domain[id-e75f006c-89cc-477b-874d-588e4eab4b17,negative]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_get_trusts_query[id-6268b345-87ca-47c0-9ce3-37792b43403a]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_create_is_domain_project[id-a7eb9416-6f9b-4dbb-b71b-7f73aaef59d5]
tempest.api.identity.admin.v3.test_projects.ProjectsTestJSON.test_project_create_with_parent[id-1854f9c0-70bc-4d11-a08a-1c789d339e3d]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_expire[id-0ed14b66-cefd-4b5c-a964-65759453e292]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_assignments_for_domain_roles[id-3859df7e-5b78-4e4d-b10e-214c8953842a]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_assignments_for_implied_roles_create_delete[id-c8828027-df48-4021-95df-b65b92c7429e]
tempest.api.identity.v3.test_application_credentials.ApplicationCredentialsV3Test.test_create_application_credential_expires[id-852daf0c-42b5-4239-8466-d193d0543ed3]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_implied_domain_roles[id-eb1e1c24-1bc4-4d47-9748-e127a1852c82]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_implied_roles_create_check_show_delete[id-c90c316c-d706-4728-bcba-eb1912081b69]
tempest.api.identity.admin.v3.test_roles.RolesV3TestJSON.test_role_create_update_show_list[id-18afc6c0-46cf-4911-824e-9989cc056c3a,smoke]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_impersonate[id-5a0a91a4-baef-4a14-baba-59bf4d7fcace]
tempest.api.identity.v3.test_catalog.IdentityCatalogTest.test_catalog_standardization[id-56b57ced-22b8-4127-9b8a-565dfb0207e2]
tempest.api.identity.admin.v3.test_tokens.TokensV3TestJSON.test_get_available_domain_scopes[id-ec5ecb05-af64-4c04-ac86-4d9f6f12f185]
tempest.api.identity.admin.v3.test_trusts.TrustsV3TestJSON.test_trust_noimpersonate[id-ed2a8779-a7ac-49dc-afd7-30f32f936ed2]
tempest.api.identity.admin.v3.test_tokens.TokensV3TestJSON.test_rescope_token[id-565fa210-1da1-4563-999b-f7b5b67cf112]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_api_media_types[id-657c1970-4722-4189-8831-7325f3bc4265,smoke]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_api_version_resources[id-b9232f5e-d9e5-4d97-b96c-28d3db4de1bd,smoke]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_identity_v3_existence[id-79aec9ae-710f-4c54-a4fc-3aa25b4feac3]
tempest.api.identity.v3.test_api_discovery.TestApiDiscovery.test_list_api_versions[id-721f480f-35b6-46c7-846e-047e6acea0dc,smoke]
tempest.api.identity.v3.test_tokens.TokensV3Test.test_validate_token[id-a9512ac3-3909-48a4-b395-11f438e16260]
===== END FAILED TESTS (target=rust) =====

View full run

@github-actions

github-actions Bot commented Nov 13, 2026

Copy link
Copy Markdown

🐰 Bencher Report

Projectkeystone
Branchreplaycache
Testbedubuntu-latest
Click to view all benchmark results
BenchmarkLatencyBenchmark Result
nanoseconds (ns)
(Result Δ%)		Upper Boundary
nanoseconds (ns)
(Limit %)
Command_Serde/apply/remove📈 view plot
🚷 view threshold		117,530.00 ns
(-5.81%)Baseline: 124,776.23 ns
203,412.05 ns
(57.78%)
Command_Serde/apply/set📈 view plot
🚷 view threshold		137,050.00 ns
(+4.65%)Baseline: 130,955.52 ns
199,966.33 ns
(68.54%)
Command_Serde/pack/delete📈 view plot
🚷 view threshold		129.13 ns
(+11.77%)Baseline: 115.53 ns
165.45 ns
(78.05%)
Command_Serde/pack/delete_index📈 view plot
🚷 view threshold		114.29 ns
(+10.38%)Baseline: 103.54 ns
144.94 ns
(78.85%)
Command_Serde/pack/set📈 view plot
🚷 view threshold		203.85 ns
(+7.59%)Baseline: 189.47 ns
274.88 ns
(74.16%)
Command_Serde/pack/set_index📈 view plot
🚷 view threshold		114.88 ns
(+11.00%)Baseline: 103.49 ns
144.84 ns
(79.31%)
Command_Serde/unpack/delete📈 view plot
🚷 view threshold		161.33 ns
(+11.90%)Baseline: 144.17 ns
216.42 ns
(74.54%)
Command_Serde/unpack/delete_index📈 view plot
🚷 view threshold		145.80 ns
(+19.36%)Baseline: 122.15 ns
181.66 ns
(80.26%)
Command_Serde/unpack/set📈 view plot
🚷 view threshold		255.05 ns
(+13.94%)Baseline: 223.85 ns
341.46 ns
(74.69%)
Command_Serde/unpack/set_index📈 view plot
🚷 view threshold		140.89 ns
(+16.08%)Baseline: 121.37 ns
178.65 ns
(78.86%)
Payload_encryption/pack/remove_cmd📈 view plot
🚷 view threshold		119.94 ns
(+11.54%)Baseline: 107.53 ns
160.03 ns
(74.95%)
Payload_encryption/pack/set_cmd📈 view plot
🚷 view threshold		201.98 ns
(+3.95%)Baseline: 194.31 ns
296.31 ns
(68.16%)
Payload_encryption/unpack/remove_cmd📈 view plot
🚷 view threshold		170.56 ns
(+16.62%)Baseline: 146.25 ns
217.43 ns
(78.44%)
Payload_encryption/unpack/set_cmd📈 view plot
🚷 view threshold		255.58 ns
(+12.03%)Baseline: 228.15 ns
348.78 ns
(73.28%)
Raft_1Node_Latency/prefix/1node📈 view plot
🚷 view threshold		3,238,100.00 ns
(-11.05%)Baseline: 3,640,411.09 ns
7,759,722.79 ns
(41.73%)
Raft_1Node_Latency/read/1node📈 view plot
🚷 view threshold		33,065.00 ns
(+1.01%)Baseline: 32,733.09 ns
50,486.45 ns
(65.49%)
Raft_1Node_Latency/remove/1node📈 view plot
🚷 view threshold		329,470.00 ns
(-5.73%)Baseline: 349,508.44 ns
646,769.07 ns
(50.94%)
Raft_1Node_Latency/write/1node📈 view plot
🚷 view threshold		342,300.00 ns
(-5.79%)Baseline: 363,354.53 ns
596,633.37 ns
(57.37%)
build_snapshot/default📈 view plot
🚷 view threshold		2,253.20 ns
(+7.16%)Baseline: 2,102.58 ns
2,830.30 ns
(79.61%)
evaluate allow (identity/role/show)📈 view plot
🚷 view threshold		97,684.00 ns
(+5.58%)Baseline: 92,523.62 ns
121,983.40 ns
(80.08%)
evaluate deny (identity/role/show)📈 view plot
🚷 view threshold		12,184.00 ns
(+2.07%)Baseline: 11,936.94 ns
15,248.73 ns
(79.90%)
fernet token/project📈 view plot
🚷 view threshold		1,437.30 ns
(+13.71%)Baseline: 1,264.03 ns
1,751.66 ns
(82.05%)
get_data_keyspace📈 view plot
🚷 view threshold		0.31 ns
(+5.96%)Baseline: 0.29 ns
0.37 ns
(83.50%)
get_db📈 view plot
🚷 view threshold		0.31 ns
(+5.70%)Baseline: 0.30 ns
0.37 ns
(83.52%)
get_fernet_token_timestamp/project📈 view plot
🚷 view threshold		146.71 ns
(+11.96%)Baseline: 131.04 ns
180.51 ns
(81.27%)
get_keyspace📈 view plot
🚷 view threshold		4.13 ns
(-40.82%)Baseline: 6.97 ns
16.27 ns
(25.35%)
load all policies📈 view plot
🚷 view threshold		443,920,000.00 ns
(+2.62%)Baseline: 432,591,250.00 ns
523,492,998.68 ns
(84.80%)
🐰 View full continuous benchmarking report in Bencher

@gtema
gtema enabled auto-merge November 13, 2026 12:43
@gtema
gtema added this pull request to the merge queue Nov 13, 2026
Merged via the queue into main with commit 890acdb Nov 13, 2026
44 checks passed
@openstack-experimental-release-plz openstack-experimental-release-plz Bot mentioned this pull request Nov 13, 2026
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@gtema