9440: Assuming a Non Global Role Drops All Subject Visibility

Scenario #9440: Assuming a Non Global Role Drops All Subject Visibility

This scenario verifies that once a non-global ReBAC role is assumed, the subject visibility otherwise stemming from the login subject and its groups is dropped, keeping this endpoint consistent with purely ReBAC-based APIs in which the concrete subject contributes no rights anymore once a role got assumed.

Properties

Given

name	value
assumedRoleIdName	hs_office.relation#FirstGmbH-with-DEBITOR-FirstGmbH:AGENT

Expected

name	value
expectedExactSubjectNames	[]

Fetch visible RBAC subjects while assuming a non-global role

HTTP GET "/api/rbac/subjects" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "comment" : "a regular user who is member of a group and can assume a non-global role",` \
  `#   "sub" : "uuid<tst-person_firbysusan>",` \
  `#   "groups" : [` \
  `#     "/xyz-Service"` \
  `#   ]` \
  `# }` \
  -H 'Hostsharing-Assumed-Roles: hs_office.relation#FirstGmbH-with-DEBITOR-FirstGmbH:AGENT'
=> status: 200 OK 
[ ]

generated on 2026-07-17 01:42:21 for branch