Scenario #9410: User Can View Subjects From Their Own Realm

This scenario verifies that subject visibility is based on the realm prefix of the current login subject. Groups assigned to the user always belong to the user’s own realm and are thus visible via the realm prefix as well.

Properties

Required

• Account: xyz-peter.smith from 9310: Create Account and User Subject From Given Subject Uuid and Name

Expected

name	value
expectedSubjectNames	[   { “name”: “xyz-peter.smith” },   { “name”: “/xyz-Service” },   { “name”: “/xyz-Team” } ]
unexpectedSubjectNames	[   { “name”: “hsh-alex_superuser” },   { “name”: “/hsh-Hostmasters” },   { “name”: “tst-drew_selfregistered” } ]

Fetch visible RBAC subjects

HTTP GET "/api/rbac/subjects" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "sub" : "uuid<xyz-peter.smith>",` \
  `#   "groups" : [` \
  `#     "/xyz-Team"` \
  `#   ]` \
  `# }`
=> status: 200 OK 
[
  {
    "uuid" : "242a0001-0000-0000-0000-000000000001", // theAccount
    "name" : "xyz-jack.tucker",
    "type" : "USER"
  },
  {
    "uuid" : "242a0003-0000-0000-0000-000000000003", // Account: xyz-peter.newman
    "name" : "xyz-peter.newman",
    "type" : "USER"
  },
  {
    "uuid" : "242a0002-0000-0000-0000-000000000002", // Account: xyz-peter.smith
    "name" : "xyz-peter.smith",
    "type" : "USER"
  },
  {
    "uuid" : "0c6b921a-0ba0-59a6-98d5-26b8727f274b",
    "name" : "/xyz-Service",
    "type" : "GROUP"
  },
  {
    "uuid" : "a366695d-3abc-5197-82ff-31090bd8c314",
    "name" : "/xyz-Team",
    "type" : "GROUP"
  },
  "..."
]

---

generated on 2026-07-17 01:42:21 for branch