Scenario #9037: Invalid Subject Names Are Rejected

The external Keycloak sync program synchronizes a single subject through the UUID-keyed idempotent upsert PUT /api/rbac/subjects/{subjectUuid}. The UUID in the path is the same UUID as in Keycloak. Creating a new subject returns 201 Created, updating an existing subject’s name returns 200 OK. Only a global-admin may synchronize subjects (others are rejected with 403), and only realm-prefixed names are accepted (others are rejected with 400).

Properties

Given

name	value
subjectUuid	238a0007-0000-0000-0000-000000000007
subjectName	invalidusername@example.com
subjectType	USER

Synchronize (upsert) the subject via PUT

HTTP PUT "/api/rbac/subjects/238a0007-0000-0000-0000-000000000007" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }` \
  -H 'Content-Type: application/json' \
  --data-binary @- <<EOF
{
  "name" : "invalidusername@example.com",
  "type" : "USER"
}
EOF
=> status: 400 BAD_REQUEST 
{
  "timestamp" : "2026-07-17 01:44:28",
  "path" : "",
  "statusCode" : 400,
  "statusPhrase" : "Bad Request",
  "message" : "ERROR: [400] [USER subject name 'invalidusername@example.com' does not match required pattern]"
}

---

generated on 2026-07-17 01:44:28 for branch