Scenario #9320: Create Account with New Person for Preexisting User Subject

UseCase Create Account With New Person For Preexisting Subject => Account: xyz-tom.sawyer

An account combines an RBAC subject with a natural person and thus grant’s access to data in hsadmin-NG. Here, the USER subject already exists, e.g. previously synchronized from Keycloak, and is referenced just by its UUID, while the natural person does not exist yet and is created from the given person details along with the account.

Properties

Given

name	value
personFamilyName	Sawyer
personGivenName	Tom
subjectUuid	242a0004-0000-0000-0000-000000000004
subjectName	xyz-tom.sawyer
globalUid	21016
globalGid	21016

Synchronize the USER Subject from Keycloak

HTTP PUT "/api/rbac/subjects/242a0004-0000-0000-0000-000000000004" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }` \
  -H 'Content-Type: application/json' \
  --data-binary @- <<EOF
{
  "name" : "xyz-tom.sawyer",
  "type" : "USER"
}
EOF
=> status: 201 CREATED 242a0004-0000-0000-0000-000000000004

This is what the Keycloak sync program does for each new Keycloak user.

newAccount

HTTP POST "/api/hs/accounts/accounts" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }` \
  -H 'Content-Type: application/json' \
  --data-binary @- <<EOF
{
  "person" : {
    "personType" : "NATURAL_PERSON",
    "salutation" : "Hallo",
    "givenName" : "Tom",
    "familyName" : "Sawyer"
  },
  "subject.uuid" : "242a0004-0000-0000-0000-000000000004",
  "globalUid" : 21016,
  "globalGid" : 21016
}
EOF
=> status: 201 CREATED 242a0004-0000-0000-0000-000000000004

Person: Tom Sawyer

HTTP GET "/api/hs/office/persons?name=Sawyer" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }`
=> status: 200 OK 
[ {
  "uuid" : "0e81bae3-da1c-4ec4-b1da-3c1928d1f718",
  "personType" : "NATURAL_PERSON",
  "tradeName" : null,
  "salutation" : "Hallo",
  "title" : null,
  "givenName" : "Tom",
  "familyName" : "Sawyer"
} ]

In real situations we have more precise measures to find the related person.

Verify the new Account as its own Subject

HTTP GET "/api/hs/accounts/accounts/242a0004-0000-0000-0000-000000000004" // newAccount \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<xyz-tom.sawyer>"` \
  `# }`
=> status: 200 OK 
{
  "uuid" : "242a0004-0000-0000-0000-000000000004", // newAccount
  "person" : {
    "uuid" : "0e81bae3-da1c-4ec4-b1da-3c1928d1f718", // Person: Tom Sawyer
    "personType" : "NATURAL_PERSON",
    "tradeName" : null,
    "salutation" : "Hallo",
    "title" : null,
    "givenName" : "Tom",
    "familyName" : "Sawyer"
  },
  "subject" : {
    "uuid" : "242a0004-0000-0000-0000-000000000004", // newAccount
    "name" : "xyz-tom.sawyer",
    "type" : "USER"
  },
  "globalUid" : 21016,
  "globalGid" : 21016
}

---

generated on 2026-07-17 01:42:20 for branch