Scenario #9450: Assuming the Global Admin Role Keeps Global Subject Visibility

This scenario verifies that a global admin who assumed just the global admin role still sees all subjects across all realms, keeping this endpoint consistent with purely ReBAC-based APIs in which the global-admin role can see everything.

Properties

Given

name	value
assumedRoleIdName	rbac.global#global:ADMIN

Expected

name	value
expectedSubjectNames	[   { “name”: “hsh-alex_superuser” },   { “name”: “hsh-fran_superuser” },   { “name”: “tst-customer_admin_xxx” },   { “name”: “/hsh-Hostmasters” },   { “name”: “/xyz-Service” } ]

Fetch visible RBAC subjects while assuming the global admin role

HTTP GET "/api/rbac/subjects" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "comment" : "a global admin",` \
  `#   "sub" : "uuid<hsh-alex_superuser>"` \
  `# }` \
  -H 'Hostsharing-Assumed-Roles: rbac.global#global:ADMIN'
=> status: 200 OK 
[
  {
    "uuid" : "242a0005-0000-0000-0000-000000000005",
    "name" : "abc-peter.smith",
    "type" : "USER"
  },
  {
    "uuid" : "05cd4947-fa73-4b7f-af65-3ed95e4d618c",
    "name" : "/abc-Team",
    "type" : "GROUP"
  },
  {
    "uuid" : "e72bcbba-3efe-5275-b57a-5194ece1cfa9",
    "name" : "hsh-alex_superuser",
    "type" : "USER"
  },
  {
    "uuid" : "8fb32bb1-4696-534f-93d1-b03df461d689",
    "name" : "hsh-fran_superuser",
    "type" : "USER"
  },
  {
    "uuid" : "dbbe1fdb-3c6a-5a94-a561-8cc95a200893",
    "name" : "/hsh-Hostmasters",
    "type" : "GROUP"
  },
  "..."
]

---

generated on 2026-07-17 01:42:21 for branch