Scenario #9650: The Configured Provisioning Api Key Can Create Further Api Keys

UseCase Create Further Api Key Using The Provisioning Api Key => ApiKey-Subject: bootstrapped.key

When starting with a legacy database, there is neither a Keycloak-matching USER subject nor any API_KEY subject, thus nobody could create the first API-key via the API. If the SHA-256 hash of an API-key is configured in HSADMINNG_PROVISIONING_API_KEY_SHA256, the application start provisions the API_KEY subject hsadminng.provisioning.key with the global ADMIN role for it, idempotently: an already stored API-key always takes precedence. The clear-text API-key exists neither on the application server nor in the database, but only at the client. Acting as global-admin, that provisioning API-key can then bootstrap everything else via the API, e.g. create further API_KEY subjects, without any Keycloak login.

Properties

Given

name	value
subjectUuid	a91c0005-0000-0000-0000-000000000005
subjectName	bootstrapped.key

Create a further API_KEY Subject, authenticated just by the provisioning API-key

HTTP POST "/api/rbac/subjects" \
  -H "Hostsharing-Api-Key: $HSADMINNG_API_KEY" \
  <<EOF
{
  "uuid" : "a91c0005-0000-0000-0000-000000000005",
  "name" : "bootstrapped.key",
  "type" : "API_KEY"
}
EOF
=> status: 201 CREATED a91c0005-0000-0000-0000-000000000005
{
  "uuid" : "a91c0005-0000-0000-0000-000000000005",
  "name" : "bootstrapped.key",
  "organization" : "bootstrapped",
  "type" : "API_KEY",
  "apiKey" : "hsak_bootstrapped.key.0750984eab65bce5c207d017566bb3637b3fc186dab466860df74605abe716fa",
  "scopes" : null,
  "expiresAt" : null
}

Verify the provisioning API-key authenticates as its provisioned Subject with the global-admin role

HTTP GET "/api/hs/accounts/current" \
  -H "Hostsharing-Api-Key: $HSADMINNG_API_KEY"
=> status: 200 OK 
{
  "subject" : {
    "uuid" : "40c21151-9f4b-50f2-9755-a69fcb7d4d7a",
    "name" : "hsadminng.provisioning.key",
    "organization" : "hsadminng",
    "type" : "API_KEY"
  },
  "person" : null,
  "globalAdmin" : true
}

---

generated on 2026-08-10 03:08:46 for branch HEAD