Scenario #9521: Users of a Group Can Assume a Role Granted to That Group

This scenario verifies that a user whose JWT contains a GROUP Subject can assume a hs_booking.project ADMIN role which was granted to that group. For this, the USER-subject itself does not need any grants at all.

Properties

Required

• GrantOfProjectAdminRoleToGroupSubject from 9520: Granting a Project Admin Role to a Group

Given

name	value
nameOfGroupSubject	/xyz-Service
nameOfUserSubject	tst-drew_selfregistered
projectCaption	D-1000111 default project

Expected

name	value
expectedAssumedRoleIdName	hs_booking.project#D-1000111-D-1000111defaultproject:ADMIN

Prerequisite: Resolving the project’s UUID

In a real-world scenario, there could be multiple results and the user has to select the correct one.

HTTP GET "/api/hs/booking/projects" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "comment" : "any user which does not even need to have any roles granted yet",` \
  `#   "sub" : "uuid<tst-drew_selfregistered>",` \
  `#   "groups" : [` \
  `#     "/xyz-Service"` \
  `#   ]` \
  `# }`
=> status: 200 OK 
[ {
  "uuid" : "14454da0-b24f-4201-a7d7-4c53126af96e", // projectUuid
  "caption" : "D-1000111 default project"
} ]

Assume a booking project ADMIN role using a group-assignment

The booking project ADMIN role was granted to the group ‘/xyz-Service’. The user ‘tst-drew_selfregistered’ is a member of the group ‘/xyz-Service’. Therefore, the user ‘tst-drew_selfregistered’ is now expected to be able to assume that role.

HTTP GET "/api/rbac/context" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "comment" : "any user which does not even need to have any roles granted yet",` \
  `#   "sub" : "uuid<tst-drew_selfregistered>",` \
  `#   "groups" : [` \
  `#     "/xyz-Service"` \
  `#   ]` \
  `# }` \
  -H 'Hostsharing-Assumed-Roles: hs_booking.project#14454da0-b24f-4201-a7d7-4c53126af96e:ADMIN' // projectUuid
=> status: 200 OK 
{
  "subject" : {
    "uuid" : "9146ab47-4766-5d9c-b3c8-9ea1b8df568b",
    "name" : "tst-drew_selfregistered",
    "type" : "USER"
  },
  "assumedRoles" : [ {
    "uuid" : "963a0a31-9133-4d0a-af1f-56611a172498", // projectAdminRoleUuidToGrant
    "object.uuid" : "14454da0-b24f-4201-a7d7-4c53126af96e", // projectUuid
    "objectTable" : "hs_booking.project",
    "objectIdName" : "D-1000111-D-1000111defaultproject",
    "roleType" : "ADMIN",
    "roleName" : "hs_booking.project#14454da0-b24f-4201-a7d7-4c53126af96e:ADMIN", // projectUuid
    "roleIdName" : "hs_booking.project#D-1000111-D-1000111defaultproject:ADMIN"
  } ],
  "claimedGroups" : [ "/xyz-Service" ],
  "effectiveGroups" : [ ],
  "globalAdmin" : false
}

List booking projects after assuming the project role

With the assumed project role, the user expected to see the booking project through the assigned group.

HTTP GET "/api/hs/booking/projects" \
  -H "Authorization: Bearer $HSADMINNG_JWT_BEARER" \
  `# {` \
  `#   "comment" : "any user which does not even need to have any roles granted yet",` \
  `#   "sub" : "uuid<tst-drew_selfregistered>",` \
  `#   "groups" : [` \
  `#     "/xyz-Service"` \
  `#   ]` \
  `# }` \
  -H 'Hostsharing-Assumed-Roles: hs_booking.project#14454da0-b24f-4201-a7d7-4c53126af96e:ADMIN' // projectUuid
=> status: 200 OK 
[ {
  "uuid" : "14454da0-b24f-4201-a7d7-4c53126af96e", // projectUuid
  "caption" : "D-1000111 default project"
} ]

---

generated on 2026-07-17 01:42:23 for branch