Scenario #9210: Create Global Admin Subject Without an Own Account

UseCase Create Global Admin Subject Without Account => Global-Admin Subject: hsh-keycloak_sync

Creating accounts needs an acting global-admin USER subject, but that subject does not need to have an own account (and thus a person) itself. Here, such a subject gets created: it is synchronized from Keycloak, and the global ADMIN role is granted to it, but no account is created for it.

Properties

Given

name	value
subjectUuid	242a0007-0000-0000-0000-000000000007
subjectName	hsh-keycloak_sync

Synchronize the new USER Subject from Keycloak

HTTP PUT "/api/rbac/subjects/242a0007-0000-0000-0000-000000000007" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }` \
  <<EOF
{
  "name" : "hsh-keycloak_sync",
  "type" : "USER"
}
EOF
=> status: 201 CREATED 242a0007-0000-0000-0000-000000000007

This is what the Keycloak sync program does for each new Keycloak user.

Prerequisite: Resolve the UUID of the global ADMIN role

The grant API needs the UUID of the role which we want to grant.

HTTP GET "/api/rbac/roles?name=rbac.global%23global%3AADMIN" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }`
=> status: 200 OK 
[ {
  "uuid" : "7ea7e6cb-16dd-4fb9-aa82-427df5f205d7",
  "object.uuid" : "6ec9aacc-2bd3-4678-a8f9-31e61eef3b0a",
  "objectTable" : "rbac.global",
  "objectIdName" : "global",
  "roleType" : "ADMIN",
  "roleName" : "rbac.global#6ec9aacc-2bd3-4678-a8f9-31e61eef3b0a:ADMIN",
  "roleIdName" : "rbac.global#global:ADMIN"
} ]

Grant the global ADMIN role to the new USER Subject

HTTP POST "/api/rbac/grants" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }` \
  -H 'Hostsharing-Assumed-Roles: rbac.global#global:ADMIN' \
  <<EOF
{
  "assumed" : true,
  "grantedRole.uuid" : "7ea7e6cb-16dd-4fb9-aa82-427df5f205d7", // globalAdminRoleUuidToGrant
  "granteeSubject.uuid" : "242a0007-0000-0000-0000-000000000007"
}
EOF
=> status: 201 CREATED 7ea7e6cb-16dd-4fb9-aa82-427df5f205d7 // globalAdminRoleUuidToGrant

Verify the new global-admin Subject does not have an own Account

HTTP GET "/api/hs/accounts/current" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-keycloak_sync>"` \
  `# }`
=> status: 200 OK 
{
  "subject" : {
    "uuid" : "242a0007-0000-0000-0000-000000000007",
    "name" : "hsh-keycloak_sync",
    "organization" : "hsh",
    "type" : "USER"
  },
  "person" : null,
  "globalAdmin" : true
}

---

generated on 2026-08-10 01:37:47 for branch