Scenario #9630: A Non Global Admin Cannot Create Api Key Subjects

API_KEY subjects authenticate technical clients via the Hostsharing-Api-Key HTTP header instead of a Keycloak OIDC JWT, e.g. automation programs, completely bypassing Keycloak. Only a global-admin may create API_KEY subjects. The clear-text API-key is returned only once, in the response of creating the API_KEY subject; just its hash gets stored. Like GROUP subjects, API_KEY subjects cannot have an account. Global API_KEY subjects do not belong to a realm, thus their name must neither contain a - (the realm-prefix delimiter) nor a / (the GROUP subject marker).

Properties

Given

name	value
subjectUuid	a91c0003-0000-0000-0000-000000000003
subjectName	forbidden.key

Create the API_KEY Subject

The response contains the generated clear-text API-key (property apiKey) exactly once; it cannot be retrieved again.

HTTP POST "/api/rbac/subjects" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "comment" : "an authenticated user without the global-admin role",` \
  `#   "sub" : "uuid<tst-customer_admin_xxx>"` \
  `# }` \
  <<EOF
{
  "uuid" : "a91c0003-0000-0000-0000-000000000003",
  "name" : "forbidden.key",
  "type" : "API_KEY"
}
EOF
=> status: 403 FORBIDDEN 
{
  "timestamp" : "2026-08-10 04:42:38",
  "path" : "",
  "statusCode" : 403,
  "statusPhrase" : "Forbidden",
  "message" : "ERROR: [403] only a global-admin may create subjects"
}

---

generated on 2026-08-10 04:42:38 for branch HEAD