Scenario #9430: User Can View Subjects Associated with Another Account of the Same Person

This scenario verifies that subject visibility includes the group subjects of other organizations in which the same natural person also holds a user account. Because the person behind the current account also has an account in organization “abc”, the current account can see the groups of organization “abc”, such as “/abc-Team”.

Properties

Required

• Account: xyz-peter.smith from 9310: Create Account and User Subject From Given Subject Uuid and Name

Given

name	value
thePersonsFamilyName	Smith
thePersonsGivenName	Peter
nameOfAssociatedGroupSubjectFromAnotherOrg	/abc-Team
theAccountSubjectName	abc-peter.smith

Person: Peter Smith

HTTP GET "/api/hs/office/persons?name=Smith&type=NATURAL_PERSON" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }`
=> status: 200 OK 
[ {
  "uuid" : "fcf8c7df-4fcf-4869-ab61-f1220590e953", // Person: Peter Smith
  "personType" : "NATURAL_PERSON",
  "tradeName" : null,
  "salutation" : null,
  "title" : null,
  "givenName" : "Peter",
  "familyName" : "Smith"
} ]

In production, this lookup would need a more precise selector.

Create group subject /abc-Team

HTTP POST "/api/rbac/subjects" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }` \
  <<EOF
{
  "name" : "/abc-Team",
  "type" : "GROUP"
}
EOF
=> status: 201 CREATED ba2da4ec-1b23-4ecb-9f83-c4c75f187aea

Create same-person account abc-peter.smith

HTTP POST "/api/hs/accounts/accounts" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }` \
  <<EOF
{
  "person.uuid" : "fcf8c7df-4fcf-4869-ab61-f1220590e953", // Person: Peter Smith
  "subject" : {
    "uuid" : "242a0005-0000-0000-0000-000000000005",
    "name" : "abc-peter.smith"
  },
  "globalUid" : 21013,
  "globalGid" : 21013
}
EOF
=> status: 201 CREATED 242a0005-0000-0000-0000-000000000005

Precondition: abc-peter.smith is associated with /abc-Team

HTTP GET "/api/rbac/context" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<abc-peter.smith>",` \
  `#   "groups" : [` \
  `#     "/abc-Team"` \
  `#   ]` \
  `# }`
=> status: 200 OK 
{
  "subject" : {
    "uuid" : "242a0005-0000-0000-0000-000000000005",
    "name" : "abc-peter.smith",
    "organization" : null,
    "type" : "USER"
  },
  "assumedRoles" : [ ],
  "claimedGroups" : [ "/abc-Team" ],
  "effectiveGroups" : [ {
    "uuid" : "ba2da4ec-1b23-4ecb-9f83-c4c75f187aea",
    "name" : "/abc-Team"
  } ],
  "globalAdmin" : false,
  "apiKey" : null
}

Fetch visible RBAC subjects

HTTP GET "/api/rbac/subjects" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<xyz-peter.smith>"` \
  `# }`
=> status: 200 OK 
[ {
  "uuid" : "ba2da4ec-1b23-4ecb-9f83-c4c75f187aea",
  "name" : "/abc-Team",
  "organization" : "abc",
  "type" : "GROUP"
}, {
  "uuid" : "242a0001-0000-0000-0000-000000000001", // theAccount
  "name" : "xyz-jack.tucker",
  "organization" : "xyz",
  "type" : "USER"
}, {
  "uuid" : "242a0003-0000-0000-0000-000000000003", // Account: xyz-peter.newman
  "name" : "xyz-peter.newman",
  "organization" : "xyz",
  "type" : "USER"
}, {
  "uuid" : "242a0002-0000-0000-0000-000000000002", // Account: xyz-peter.smith
  "name" : "xyz-peter.smith",
  "organization" : "xyz",
  "type" : "USER"
}, {
  "uuid" : "0c6b921a-0ba0-59a6-98d5-26b8727f274b",
  "name" : "/xyz-Service",
  "organization" : "xyz",
  "type" : "GROUP"
}, {
  "uuid" : "a366695d-3abc-5197-82ff-31090bd8c314",
  "name" : "/xyz-Team",
  "organization" : "xyz",
  "type" : "GROUP"
}, {
  "uuid" : "242a0004-0000-0000-0000-000000000004", // Account: xyz-tom.sawyer
  "name" : "xyz-tom.sawyer",
  "organization" : "xyz",
  "type" : "USER"
} ]

---

generated on 2026-08-10 03:08:26 for branch HEAD