Scenario #9042: A Subject Synchronized Without Explicit Organization Gets It Derived From the Name Prefix

UseCase Synchronize Subject => SubjectSync: xyz-carol

The sync program synchronizes a subject with a realm-prefixed name and no explicit organization through the UUID-keyed idempotent PUT /api/rbac/subjects/{subjectUuid}, just like all PR#238 sync requests. The organization is derived from the name prefix (the part before the first -, without the leading / of GROUP names) and stored with the subject.

Properties

Given

name	value
subjectUuid	239a0003-0000-0000-0000-000000000003
subjectName	xyz-carol
subjectType	USER

Expected

name	value
expectedOrganization	xyz

Synchronize the subject via HTTP PUT

HTTP PUT "/api/rbac/subjects/239a0003-0000-0000-0000-000000000003" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }` \
  <<EOF
{
  "name" : "xyz-carol",
  "type" : "USER"
}
EOF
=> status: 201 CREATED 239a0003-0000-0000-0000-000000000003

The stored subject carries the expected organization

HTTP GET "/api/rbac/subjects/239a0003-0000-0000-0000-000000000003" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }`
=> status: 200 OK 
{
  "uuid" : "239a0003-0000-0000-0000-000000000003",
  "name" : "xyz-carol",
  "organization" : "xyz",
  "type" : "USER"
}

---

generated on 2026-08-10 04:34:39 for branch HEAD