private UserRef getUserObject(final String subjectId,
                                  final UserType expectedUserType,
                                  final String argGroupName) {
        Objects.requireNonNull(expectedUserType);
        if (NullSafe.isBlankString(subjectId)) {
            throw new RuntimeException(LogUtil.message("No {} identifier supplied for arg group '{}'",
                    expectedUserType.getDisplayName(), argGroupName));
        }

        final Optional<stroom.security.shared.User> optUserOrGroup = switch (expectedUserType) {
            case USER -> userService.getUserBySubjectId(subjectId);
            case GROUP -> userService.getGroupByName(subjectId);
            case EITHER -> userService.getUserBySubjectId(subjectId).or(() -> userService.getGroupByName(subjectId));
        };

        if (optUserOrGroup.isEmpty()) {
            info(LOGGER, LogUtil.message("{} not found when treating '{}' in arg group '{}' as a unique subjectId. " +
                                         "Falling back to treating it as a displayName",
                    expectedUserType.displayName, subjectId, argGroupName));
        }
        stroom.security.shared.User userOrGroup = optUserOrGroup
                .orElseThrow(() -> new RuntimeException(LogUtil.message(
                        "A {} cannot be found with a subjectId or displayName matching identifier '{}' " +
                        "in arg group '{}'",
                        expectedUserType.displayName,
                        subjectId,
                        argGroupName)));

        LOGGER.debug(() -> LogUtil.message("Found user object {}, treating identifier '{}' in arg group '{}' as a {}",
                userOrGroup,
                subjectId,
                argGroupName,
                "subjectId"));

        if (UserType.USER.equals(expectedUserType) && userOrGroup.isGroup()) {
            throw new RuntimeException(LogUtil.message("Expecting identifier '{}' in arg group '{}' to be a User: {}",
                    subjectId, argGroupName, userOrGroup));
        } else if (UserType.GROUP.equals(expectedUserType) && !userOrGroup.isGroup()) {
            throw new RuntimeException(LogUtil.message("Expecting identifier '{}' in arg group '{}' to be a Group: {}",
                    subjectId, argGroupName, userOrGroup));
        }

        return userOrGroup.asRef();
    }
Creates an account in the internal identity provider
<p>
e.g manage_users ../local.yml
--createUser admin
--createGroup Administrators
--addToGroup admin Administrators
--grantPermission Administrators Administrator
stroom-app/src/main/java/stroom/app/commands/ManageUsersCommand.java