Remove AD/LDAP accounts from Ambari using REST API

[#1]

IMPORTANT:

DO NOT FORGET to backup your Ambari database before executing DELETE API calls. This is tested on Ambari version 2.6.x & 2.7.1. Kindly use these steps on your Test cluster first OR Contact Cloudera Support for more details.

Step 1: Take a backup of your Ambari database

# mkdir /var/tmp/postgres_backup 
# pg_dump -U ambari ambari > /var/tmp/postgres_backup/$(date +"%Y%m%d%H%M%S")_ambari-bkp.sql

Step 2: Install jq package (If not available)

# rpm -qa | grep jq
# yum whatprovides jq
# yum install jq -y

Step 3: Get All (AD/LDAP) Users & Groups

# curl --insecure -u admin:admin -H 'X-Requested-By: ambari' -X GET http://$(hostname -f):8080/api/v1/users?Users/ldap_user=true    | jq -r '.items[].Users.user_name' > ambari-ldap-users.txt

# curl --insecure -u admin:admin -H 'X-Requested-By: ambari' -X GET http://$(hostname -f):8080/api/v1/groups?Groups/ldap_group=true  | jq -r '.items[].Groups.group_name' > ambari-ldap-groups.txt

Step 4: Verify Users & Groups that needs to be deleted. If you want to keep some users/groups from the list, you can remove those entries from respective txt files.

# cat ambari-ldap-users.txt

# cat ambari-ldap-groups.txt

Step 5: Remove all AD Users

# for my_ldap_user in $(cat ambari-ldap-users.txt)
do
curl --insecure -u admin:admin -H 'X-Requested-By: ambari' -X DELETE 'http://'$(hostname -f)':8080/api/v1/users/'$my_ldap_user
echo 'deleting : ' $my_ldap_user
done

Step 6: Remove all AD Groups

# for my_ldap_group in $(cat ambari-ldap-groups.txt)
do
curl --insecure -u admin:admin -H 'X-Requested-By: ambari' -X DELETE 'http://'$(hostname -f)':8080/api/v1/groups/'$my_ldap_group
echo 'deleting : ' $my_ldap_group
done

[#2]

This is so informative :).

Helps alot as there is no bulk delete operation via UI

[#3]

Thanks Akhil S Naik 🙂