Scenario #9520: Granting a Project Admin Role to a Group

UseCase Grant Project Admin Role To Group => GrantOfProjectAdminRoleToGroupSubject

This scenario demonstrates how a debitor AGENT can grant the ADMIN role of one of their projects to a GROUP Subject.

Properties

Given

name	value
roleIdNameToAssume	hs_office.relation#FirstGmbH-with-DEBITOR-FirstGmbH:AGENT
projectCaption	D-1000111 default project
projectIdName	D-1000111-D-1000111defaultproject
nameOfGroupSubject	/xyz-Service

Prerequisite: Resolving the projects UUID

In a real-world scenario, there could be multiple results and the user has to select the correct one.

HTTP GET "/api/hs/booking/projects" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "comment" : "a Debitor-Admin, here concretely the Partner-Representative",` \
  `#   "sub" : "uuid<tst-person_firbysusan>",` \
  `#   "groups" : [` \
  `#     "/xyz-Service"` \
  `#   ]` \
  `# }` \
  -H 'Hostsharing-Assumed-Roles: hs_office.relation#FirstGmbH-with-DEBITOR-FirstGmbH:AGENT'
=> status: 200 OK 
[ {
  "uuid" : "14454da0-b24f-4201-a7d7-4c53126af96e",
  "caption" : "D-1000111 default project"
} ]

Prerequisite: Resolve group subject UUID for ‘/xyz-Service’

To use the grant API, we need the UUID of the group-subject. The granting user finds the groups they are assigned to, including their UUIDs, in their own RBAC context.

HTTP GET "/api/rbac/context" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "comment" : "a Debitor-Admin, here concretely the Partner-Representative",` \
  `#   "sub" : "uuid<tst-person_firbysusan>",` \
  `#   "groups" : [` \
  `#     "/xyz-Service"` \
  `#   ]` \
  `# }`
=> status: 200 OK 
{
  "subject" : {
    "uuid" : "94b99766-0d93-5900-b2c9-ded8e73325ff",
    "name" : "tst-person_firbysusan",
    "type" : "USER"
  },
  "assumedRoles" : [ ],
  "claimedGroups" : [ "/xyz-Service" ],
  "effectiveGroups" : [ {
    "uuid" : "0c6b921a-0ba0-59a6-98d5-26b8727f274b",
    "name" : "/xyz-Service"
  } ],
  "globalAdmin" : false
}

Prerequisite: Resolve project ADMIN role UUID

The grant API needs the UUID of the role which we want to grant. We could use the project’s IdName for the assume, but in the real world that could be ambiguous.

HTTP GET "/api/rbac/roles?name=hs_booking.project%23D-1000111-D-1000111defaultproject%3AADMIN" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "comment" : "a Debitor-Admin, here concretely the Partner-Representative",` \
  `#   "sub" : "uuid<tst-person_firbysusan>",` \
  `#   "groups" : [` \
  `#     "/xyz-Service"` \
  `#   ]` \
  `# }` \
  -H 'Hostsharing-Assumed-Roles: hs_booking.project#14454da0-b24f-4201-a7d7-4c53126af96e:OWNER' // projectUuid
=> status: 200 OK 
[ {
  "uuid" : "963a0a31-9133-4d0a-af1f-56611a172498",
  "object.uuid" : "14454da0-b24f-4201-a7d7-4c53126af96e", // projectUuid
  "objectTable" : "hs_booking.project",
  "objectIdName" : "D-1000111-D-1000111defaultproject",
  "roleType" : "ADMIN",
  "roleName" : "hs_booking.project#14454da0-b24f-4201-a7d7-4c53126af96e:ADMIN", // projectUuid
  "roleIdName" : "hs_booking.project#D-1000111-D-1000111defaultproject:ADMIN"
} ]

Precondition: Expect that the grant does not yet exist

This check is not necessary in a real user journey. For the test-aspect of this scenario, though, we want to make sure that the role grant does not yet exist.

HTTP GET "/api/rbac/grants/963a0a31-9133-4d0a-af1f-56611a172498/0c6b921a-0ba0-59a6-98d5-26b8727f274b" // projectAdminRoleUuidToGrant \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "comment" : "a Debitor-Admin, here concretely the Partner-Representative",` \
  `#   "sub" : "uuid<tst-person_firbysusan>",` \
  `#   "groups" : [` \
  `#     "/xyz-Service"` \
  `#   ]` \
  `# }`
=> status: 404 NOT_FOUND 

Grant project ADMIN role to the group-subject without auto-assume

This grant allows members of the group ‘/xyz-Service’ to explicitly assume the project ADMIN role.

HTTP POST "/api/rbac/grants" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "comment" : "a Debitor-Admin, here concretely the Partner-Representative",` \
  `#   "sub" : "uuid<tst-person_firbysusan>",` \
  `#   "groups" : [` \
  `#     "/xyz-Service"` \
  `#   ]` \
  `# }` \
  -H 'Hostsharing-Assumed-Roles: hs_booking.project#14454da0-b24f-4201-a7d7-4c53126af96e:OWNER' // projectUuid \
  -H 'Content-Type: application/json' \
  --data-binary @- <<EOF
{
  "assumed" : true,
  "grantedRole.uuid" : "963a0a31-9133-4d0a-af1f-56611a172498", // projectAdminRoleUuidToGrant
  "granteeSubject.uuid" : "0c6b921a-0ba0-59a6-98d5-26b8727f274b" // groupSubjectUuidToGrantTo
}
EOF
=> status: 201 CREATED 963a0a31-9133-4d0a-af1f-56611a172498 // projectAdminRoleUuidToGrant

---

generated on 2026-07-17 01:42:23 for branch