Scenario #9330: Create Account for Preexisting User Subject Via Subject Uuid

UseCase Create Account For Preexisting Subject => Account: xyz-jack.tucker

An account combines an RBAC subject with a natural person and thus grant’s access to data in hsadmin-NG. Here, the USER subject already exists, e.g. previously synchronized from Keycloak, and is referenced just by its UUID when the account gets created.

Properties

Given

name	value
personFamilyName	Tucker
personGivenName	Jack
personGivenType	NATURAL_PERSON
subjectUuid	242a0001-0000-0000-0000-000000000001
subjectName	xyz-jack.tucker
globalUid	21015
globalGid	21015

Synchronize the USER Subject from Keycloak

HTTP PUT "/api/rbac/subjects/242a0001-0000-0000-0000-000000000001" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }` \
  -H 'Content-Type: application/json' \
  --data-binary @- <<EOF
{
  "name" : "xyz-jack.tucker",
  "type" : "USER"
}
EOF
=> status: 201 CREATED 242a0001-0000-0000-0000-000000000001

This is what the Keycloak sync program does for each new Keycloak user.

Person: Jack Tucker

HTTP GET "/api/hs/office/persons?name=Tucker&type=NATURAL_PERSON" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }`
=> status: 200 OK 
[ {
  "uuid" : "26610d4b-2260-467c-b1a8-9847d04bdb82",
  "personType" : "NATURAL_PERSON",
  "tradeName" : null,
  "salutation" : null,
  "title" : null,
  "givenName" : "Jack",
  "familyName" : "Tucker"
} ]

In real situations we have more precise measures to find the related person.

theAccount

HTTP POST "/api/hs/accounts/accounts" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }` \
  -H 'Content-Type: application/json' \
  --data-binary @- <<EOF
{
  "person.uuid" : "26610d4b-2260-467c-b1a8-9847d04bdb82", // Person: Jack Tucker
  "subject.uuid" : "242a0001-0000-0000-0000-000000000001",
  "globalUid" : 21015,
  "globalGid" : 21015
}
EOF
=> status: 201 CREATED 242a0001-0000-0000-0000-000000000001

Verify the new Account as its own Subject

HTTP GET "/api/hs/accounts/accounts/242a0001-0000-0000-0000-000000000001" // theAccount \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<xyz-jack.tucker>"` \
  `# }`
=> status: 200 OK 
{
  "uuid" : "242a0001-0000-0000-0000-000000000001", // theAccount
  "person" : {
    "uuid" : "26610d4b-2260-467c-b1a8-9847d04bdb82", // Person: Jack Tucker
    "personType" : "NATURAL_PERSON",
    "tradeName" : null,
    "salutation" : null,
    "title" : null,
    "givenName" : "Jack",
    "familyName" : "Tucker"
  },
  "subject" : {
    "uuid" : "242a0001-0000-0000-0000-000000000001", // theAccount
    "name" : "xyz-jack.tucker",
    "type" : "USER"
  },
  "globalUid" : 21015,
  "globalGid" : 21015
}

---

generated on 2026-07-17 01:42:21 for branch