security-admin/scripts/deleteUserGroupUtil.py - ranger - Git at Google

 #
 # Licensed under the Apache License, Version 2.0 (the "License");
 # you may not use this file except in compliance with the License.
 # You may obtain a copy of the License at
 #
 #   http://www.apache.org/licenses/LICENSE-2.0
 #
 #  Unless required by applicable law or agreed to in writing, software
 #  distributed under the License is distributed on an "AS IS" BASIS,
 #  WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
 #  See the License for the specific language governing permissions and
 #  limitations under the License. See accompanying LICENSE file.
 #

 import argparse
 import os,sys
 import pycurl
 import getpass
 import logging
 from StringIO import StringIO as BytesIO
 def log(msg,type):
 	if type == 'info':
 		logging.info(" %s",msg)
 	if type == 'debug':
 		logging.debug(" %s",msg)
 	if type == 'warning':
 		logging.warning(" %s",msg)
 	if type == 'exception':
 		logging.exception(" %s",msg)
 	if type == 'error':
 		logging.error(" %s",msg)

 def isPairedSwitch(value):
 	isSwitch=False
 	switch_arr =["-groups", "-users","-admin","-url","-sslCertPath"]
 	if value in switch_arr:
 		isSwitch=True
 	return isSwitch

 def printUsage():
 	log("[I] Note : This utility can be used to delete users or groups, To delete groups refer below given first command and to delete users refer second command.","info")
 	log("[I] Usage(Group delete): deleteUserGroupUtil.py -groups <group file path> -admin <ranger admin user> -url <rangerhosturl> [-force] [-sslCertPath <cert path>] [-debug]","info")
 	log("[I] Usage(User delete): deleteUserGroupUtil.py -users <user file path> -admin <ranger admin user> -url <rangerhosturl> [-force] [-sslCertPath <cert path>] [-debug]","info")
 	log("[I] -groups: Delete groups specified in the given file","info")
 	log("[I] -users: Delete users specified in the given file","info")
 	log("[I] -admin: Ranger Admin user ID","info")
 	log("[I] -force: Force delete users/groups, even if they are referenced in policies","info")
 	log("[I] -url: Ranger Admin URL","info")
 	log("[I] -sslCertPath: Filepath to ssl certificate to use when Ranger Admin uses HTTPS","info")
 	log("[I] -debug: Enables debugging","info")
 	sys.exit(1)

 def processRequest(url,usernamepassword,data,method,isHttps,certfile,isDebug):
 	buffer = BytesIO()
 	header = BytesIO()
 	c = pycurl.Curl()
 	c.setopt(c.URL, url)
 	c.setopt(pycurl.HTTPHEADER, ['Content-Type: application/json','Accept: application/json'])
 	c.setopt(pycurl.USERPWD, usernamepassword)
 	c.setopt(pycurl.VERBOSE, 0)
 	if isHttps==True:
 		c.setopt(pycurl.SSL_VERIFYPEER,1)
 		c.setopt(pycurl.SSL_VERIFYHOST,2)
 		c.setopt(pycurl.CAINFO, certfile)

 	c.setopt(c.WRITEFUNCTION ,buffer.write)
 	c.setopt(c.HEADERFUNCTION,header.write)
 	# setting proper method and parameters
 	if method == 'get' :
 		c.setopt(pycurl.HTTPGET, 1)
 	elif method == 'delete' :
 		c.setopt(pycurl.CUSTOMREQUEST, "DELETE")
 		c.setopt(c.POSTFIELDS, str(data))
 	else :
 		log("[E] Unknown Http Request method found, only get or delete method are allowed!","error")

 	c.perform()
 	# getting response
 	response = buffer.getvalue()
 	headerResponse = header.getvalue()
 	response_code=0
 	response_code=str(c.getinfo(pycurl.RESPONSE_CODE))
 	response_code=int(response_code)
 	buffer.close()
 	header.close()
 	c.close()
 	if isDebug ==True or (response_code!=200 and response_code!=204):
 		print 'Request URL = ' + str(url)
 		print 'Response    = ' + str(headerResponse)
 	return response_code
 def validateArgs(argv):
 	if(len(argv)<7):
 		log("[E] insufficient number of arguments. Found " + len(argv) + "; expected at least 7","error")
 		printUsage()
 	if not "-users" in argv and not "-groups" in argv:
 		log("[E] -users or -groups switch was missing!","error")
 		printUsage()
 	if not "-admin" in argv:
 		log("[E] -admin switch was missing!","error")
 		printUsage()
 	if not "-url" in argv:
 		log("[E] -url switch was missing!","error")
 		printUsage()
 	if "-url" in argv:
 		try:
 			host=str(argv[argv.index("-url")+1])
 			host=host.strip()
 			if host =="" or host is None or isPairedSwitch(host):
 				log("[E] invalid Ranger Admin host URL","error")
 				printUsage()
 			if host.lower().startswith("https"):
 				if not "-sslCertPath" in argv:
 					log("[E] -sslCertPath switch was missing!","error")
 					printUsage()
 		except IndexError:
 			log("[E] missing/invalid Ranger Admin host URL","error")
 			printUsage()

 def main(argv):
 	FORMAT = '%(asctime)-15s %(message)s'
 	logging.basicConfig(format=FORMAT, level=logging.DEBUG)
 	inputPath=""
 	certfile=""
 	tail=""
 	password=""
 	isHttps=False
 	isUser=False
 	isGroup=False
 	isDebug=False
 	if "-usage" in argv or "-help" in argv:
 		printUsage()
 	validateArgs(argv)
 	for i in range(1, len(argv)) :
 		if str(argv[i])== "-groups" :
 			restpath= "/groups/groupName/"
 			try:
 				inputPath=str(argv[i+1])
 				inputPath=inputPath.strip()
 				if inputPath =="" or not os.path.exists(inputPath) or not os.path.isfile(inputPath) or not os.access(inputPath, os.R_OK) or isPairedSwitch(inputPath):
 					log("[E] File '"+inputPath+"' does not exist or could not be read","error")
 					sys.exit(1)
 				else:
 					isGroup=True
 				if os.stat(inputPath).st_size == 0:
 					log("[E] File '"+inputPath+"' is empty!","error")
 					sys.exit(1)
 			except IndexError:
 				log("[E] missing filename after '-groups' argument","error")
 				sys.exit(1)
 			continue
 		elif str(argv[i])== "-users" :
 			restpath= "/users/userName/"
 			try:
 				inputPath=str(argv[i+1])
 				inputPath=inputPath.strip()
 				if inputPath =="" or not os.path.exists(inputPath) or not os.path.isfile(inputPath) or not os.access(inputPath, os.R_OK) or isPairedSwitch(inputPath):
 					log("[E] File '"+inputPath+"' does not exist or could not be read","error")
 					sys.exit(1)
 				else:
 					isUser=True
 				if os.stat(inputPath).st_size == 0:
 					log("[E] File '"+inputPath+"' is empty!","error")
 					sys.exit(1)
 			except IndexError:
 				log("[E] missing filename after '-users' argument","error")
 				sys.exit(1)
 			continue

 		if str(argv[i])=="-admin" :
 			try:
 				user=str(argv[i+1])
 				if user =="" or user is None or isPairedSwitch(user):
 					log("[E] missing/invalid Ranger Admin login ID for argument '-admin'","error")
 					sys.exit(1)
 				continue
 			except IndexError:
 				log("[E] missing/invalid Ranger Admin login ID for argument '-admin'","error")
 				sys.exit(1)
 		if str(argv[i])=="-url" :
 			try:
 				host=str(argv[i+1])
 				host=host.strip()
 				if host =="" or host is None or isPairedSwitch(host):
 					log("[E] invalid Ranger Admin host URL","error")
 					sys.exit(1)
 				if host.lower().startswith("https"):
 					isHttps=True
 				continue
 			except IndexError:
 				log("[E] missing/invalid Ranger Admin host URL","error")
 				sys.exit(1)
 		if str(argv[i])=="-force" :
 			tail="?forceDelete=true"
 			continue
 		if str(argv[i])=="-debug" :
 			isDebug=True
 			continue
 		if isHttps == True and str(argv[i])== "-sslCertPath" :
 			try:
 				certfile=str(argv[i+1])
 				certfile=certfile.strip()
 				if certfile =="" or not os.path.exists(certfile) or not os.path.isfile(certfile) or not os.access(certfile, os.R_OK) or isPairedSwitch(certfile):
 					log("[E] Certificate File '"+certfile+"' does not exist or could not be read","error")
 					sys.exit(1)
 			except IndexError:
 				log("[E] missing/invalid SSL certificate path for argument '-sslCertPath'","error")
 				sys.exit(1)
 			continue
 	if isUser==True and isGroup==True:
 		log("[E] -users and -groups both option were provided, only one is allowed.","error")
 		printUsage()
 	if password =="" :
 		password=getpass.getpass("Enter Ranger Admin password : ")

 	usernamepassword=user+":"+password
 	url=host+'/service/xusers/secure/users/roles/userName/'+user
 	response_code=0
 	try:
 		response_code=processRequest(url,usernamepassword,None,'get',isHttps,certfile,False)
 	except pycurl.error, e:
 		print e
 		sys.exit(1)
 	if response_code == 302 or response_code==401 or response_code==403:
 		log("[E] Authentication Error:Please try with valid credentials!","error")
 		sys.exit(1)
 	if response_code != 200:
 		log("[E] Failed to contact Ranger Admin with given parameters. Please review the parameters","error")
 		printUsage()
 		sys.exit(1)
 	f=open(inputPath,'r')
 	processedRows=0
 	for line in f:
 		line=line.strip()
 		if line == "" or line is None:
 			continue
 		if isUser==True and line==user:
 			log("[I] Skipping deletion of user : "+line+", Self account deletion is restricted!","info")
 			continue
 		url=host+'/service/xusers'+restpath+line+tail
 		method='delete'
 		data=None
 		response_code=processRequest(url,usernamepassword,data,method,isHttps,certfile,isDebug)
 		if response_code==302 or response_code==401:
 			if isUser==True:
 				log("[E] failed while deleting user '" + line + "'. Please verify the parameters","error")
 			elif isGroup==True:
 				log("[E] failed while deleting group '" + line + "'. Please verify the parameters","error")
 			buffer.close()
 			header.close()
 			break
 		elif response_code==204:
 			if isUser==True:
 				log("[I] Deleted user : "+line,"info")
 			elif isGroup==True:
 				log("[I] Deleted group : "+line,"info")
 			processedRows=processedRows+1
 		elif response_code==404:
 			if isUser==True:
 				log("[E] failed while deleting user '" + line + "'. Please verify the parameters","error")
 			elif isGroup==True:
 				log("[E] failed while deleting group '" + line + "'. Please verify the parameters","error")
 		elif response_code==400:
 			if isUser==True:
 				log("[I] User not found : "+line,"info")
 			elif isGroup==True:
 				log("[I] Group not found : "+line,"info")

 	f.close()
 	if processedRows==0:
 		if isUser==True:
 			log("[I] No valid user found to delete!","info")
 		elif isGroup==True:
 			log("[I] No valid group found to delete!","info")
 	else:
 		if isUser==True:
 			log("[I] Number of user deleted : "+str(processedRows),"info")
 		elif isGroup==True:
 			log("[I] Number of group deleted : "+str(processedRows),"info")
 main(sys.argv)
	#
	# Licensed under the Apache License, Version 2.0 (the "License");
	# you may not use this file except in compliance with the License.
	# You may obtain a copy of the License at
	#
	# http://www.apache.org/licenses/LICENSE-2.0
	#
	# Unless required by applicable law or agreed to in writing, software
	# distributed under the License is distributed on an "AS IS" BASIS,
	# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
	# See the License for the specific language governing permissions and
	# limitations under the License. See accompanying LICENSE file.
	#

	import argparse
	import os,sys
	import pycurl
	import getpass
	import logging
	from StringIO import StringIO as BytesIO
	def log(msg,type):
	if type == 'info':
	logging.info(" %s",msg)
	if type == 'debug':
	logging.debug(" %s",msg)
	if type == 'warning':
	logging.warning(" %s",msg)
	if type == 'exception':
	logging.exception(" %s",msg)
	if type == 'error':
	logging.error(" %s",msg)

	def isPairedSwitch(value):
	isSwitch=False
	switch_arr =["-groups", "-users","-admin","-url","-sslCertPath"]
	if value in switch_arr:
	isSwitch=True
	return isSwitch

	def printUsage():
	log("[I] Note : This utility can be used to delete users or groups, To delete groups refer below given first command and to delete users refer second command.","info")
	log("[I] Usage(Group delete): deleteUserGroupUtil.py -groups <group file path> -admin <ranger admin user> -url <rangerhosturl> [-force] [-sslCertPath <cert path>] [-debug]","info")
	log("[I] Usage(User delete): deleteUserGroupUtil.py -users <user file path> -admin <ranger admin user> -url <rangerhosturl> [-force] [-sslCertPath <cert path>] [-debug]","info")
	log("[I] -groups: Delete groups specified in the given file","info")
	log("[I] -users: Delete users specified in the given file","info")
	log("[I] -admin: Ranger Admin user ID","info")
	log("[I] -force: Force delete users/groups, even if they are referenced in policies","info")
	log("[I] -url: Ranger Admin URL","info")
	log("[I] -sslCertPath: Filepath to ssl certificate to use when Ranger Admin uses HTTPS","info")
	log("[I] -debug: Enables debugging","info")
	sys.exit(1)

	def processRequest(url,usernamepassword,data,method,isHttps,certfile,isDebug):
	buffer = BytesIO()
	header = BytesIO()
	c = pycurl.Curl()
	c.setopt(c.URL, url)
	c.setopt(pycurl.HTTPHEADER, ['Content-Type: application/json','Accept: application/json'])
	c.setopt(pycurl.USERPWD, usernamepassword)
	c.setopt(pycurl.VERBOSE, 0)
	if isHttps==True:
	c.setopt(pycurl.SSL_VERIFYPEER,1)
	c.setopt(pycurl.SSL_VERIFYHOST,2)
	c.setopt(pycurl.CAINFO, certfile)

	c.setopt(c.WRITEFUNCTION ,buffer.write)
	c.setopt(c.HEADERFUNCTION,header.write)
	# setting proper method and parameters
	if method == 'get' :
	c.setopt(pycurl.HTTPGET, 1)
	elif method == 'delete' :
	c.setopt(pycurl.CUSTOMREQUEST, "DELETE")
	c.setopt(c.POSTFIELDS, str(data))
	else :
	log("[E] Unknown Http Request method found, only get or delete method are allowed!","error")

	c.perform()
	# getting response
	response = buffer.getvalue()
	headerResponse = header.getvalue()
	response_code=0
	response_code=str(c.getinfo(pycurl.RESPONSE_CODE))
	response_code=int(response_code)
	buffer.close()
	header.close()
	c.close()
	if isDebug ==True or (response_code!=200 and response_code!=204):
	print 'Request URL = ' + str(url)
	print 'Response = ' + str(headerResponse)
	return response_code
	def validateArgs(argv):
	if(len(argv)<7):
	log("[E] insufficient number of arguments. Found " + len(argv) + "; expected at least 7","error")
	printUsage()
	if not "-users" in argv and not "-groups" in argv:
	log("[E] -users or -groups switch was missing!","error")
	printUsage()
	if not "-admin" in argv:
	log("[E] -admin switch was missing!","error")
	printUsage()
	if not "-url" in argv:
	log("[E] -url switch was missing!","error")
	printUsage()
	if "-url" in argv:
	try:
	host=str(argv[argv.index("-url")+1])
	host=host.strip()
	if host =="" or host is None or isPairedSwitch(host):
	log("[E] invalid Ranger Admin host URL","error")
	printUsage()
	if host.lower().startswith("https"):
	if not "-sslCertPath" in argv:
	log("[E] -sslCertPath switch was missing!","error")
	printUsage()
	except IndexError:
	log("[E] missing/invalid Ranger Admin host URL","error")
	printUsage()

	def main(argv):
	FORMAT = '%(asctime)-15s %(message)s'
	logging.basicConfig(format=FORMAT, level=logging.DEBUG)
	inputPath=""
	certfile=""
	tail=""
	password=""
	isHttps=False
	isUser=False
	isGroup=False
	isDebug=False
	if "-usage" in argv or "-help" in argv:
	printUsage()
	validateArgs(argv)
	for i in range(1, len(argv)) :
	if str(argv[i])== "-groups" :
	restpath= "/groups/groupName/"
	try:
	inputPath=str(argv[i+1])
	inputPath=inputPath.strip()
	if inputPath =="" or not os.path.exists(inputPath) or not os.path.isfile(inputPath) or not os.access(inputPath, os.R_OK) or isPairedSwitch(inputPath):
	log("[E] File '"+inputPath+"' does not exist or could not be read","error")
	sys.exit(1)
	else:
	isGroup=True
	if os.stat(inputPath).st_size == 0:
	log("[E] File '"+inputPath+"' is empty!","error")
	sys.exit(1)
	except IndexError:
	log("[E] missing filename after '-groups' argument","error")
	sys.exit(1)
	continue
	elif str(argv[i])== "-users" :
	restpath= "/users/userName/"
	try:
	inputPath=str(argv[i+1])
	inputPath=inputPath.strip()
	if inputPath =="" or not os.path.exists(inputPath) or not os.path.isfile(inputPath) or not os.access(inputPath, os.R_OK) or isPairedSwitch(inputPath):
	log("[E] File '"+inputPath+"' does not exist or could not be read","error")
	sys.exit(1)
	else:
	isUser=True
	if os.stat(inputPath).st_size == 0:
	log("[E] File '"+inputPath+"' is empty!","error")
	sys.exit(1)
	except IndexError:
	log("[E] missing filename after '-users' argument","error")
	sys.exit(1)
	continue

	if str(argv[i])=="-admin" :
	try:
	user=str(argv[i+1])
	if user =="" or user is None or isPairedSwitch(user):
	log("[E] missing/invalid Ranger Admin login ID for argument '-admin'","error")
	sys.exit(1)
	continue
	except IndexError:
	log("[E] missing/invalid Ranger Admin login ID for argument '-admin'","error")
	sys.exit(1)
	if str(argv[i])=="-url" :
	try:
	host=str(argv[i+1])
	host=host.strip()
	if host =="" or host is None or isPairedSwitch(host):
	log("[E] invalid Ranger Admin host URL","error")
	sys.exit(1)
	if host.lower().startswith("https"):
	isHttps=True
	continue
	except IndexError:
	log("[E] missing/invalid Ranger Admin host URL","error")
	sys.exit(1)
	if str(argv[i])=="-force" :
	tail="?forceDelete=true"
	continue
	if str(argv[i])=="-debug" :
	isDebug=True
	continue
	if isHttps == True and str(argv[i])== "-sslCertPath" :
	try:
	certfile=str(argv[i+1])
	certfile=certfile.strip()
	if certfile =="" or not os.path.exists(certfile) or not os.path.isfile(certfile) or not os.access(certfile, os.R_OK) or isPairedSwitch(certfile):
	log("[E] Certificate File '"+certfile+"' does not exist or could not be read","error")
	sys.exit(1)
	except IndexError:
	log("[E] missing/invalid SSL certificate path for argument '-sslCertPath'","error")
	sys.exit(1)
	continue
	if isUser==True and isGroup==True:
	log("[E] -users and -groups both option were provided, only one is allowed.","error")
	printUsage()
	if password =="" :
	password=getpass.getpass("Enter Ranger Admin password : ")

	usernamepassword=user+":"+password
	url=host+'/service/xusers/secure/users/roles/userName/'+user
	response_code=0
	try:
	response_code=processRequest(url,usernamepassword,None,'get',isHttps,certfile,False)
	except pycurl.error, e:
	print e
	sys.exit(1)
	if response_code == 302 or response_code==401 or response_code==403:
	log("[E] Authentication Error:Please try with valid credentials!","error")
	sys.exit(1)
	if response_code != 200:
	log("[E] Failed to contact Ranger Admin with given parameters. Please review the parameters","error")
	printUsage()
	sys.exit(1)
	f=open(inputPath,'r')
	processedRows=0
	for line in f:
	line=line.strip()
	if line == "" or line is None:
	continue
	if isUser==True and line==user:
	log("[I] Skipping deletion of user : "+line+", Self account deletion is restricted!","info")
	continue
	url=host+'/service/xusers'+restpath+line+tail
	method='delete'
	data=None
	response_code=processRequest(url,usernamepassword,data,method,isHttps,certfile,isDebug)
	if response_code==302 or response_code==401:
	if isUser==True:
	log("[E] failed while deleting user '" + line + "'. Please verify the parameters","error")
	elif isGroup==True:
	log("[E] failed while deleting group '" + line + "'. Please verify the parameters","error")
	buffer.close()
	header.close()
	break
	elif response_code==204:
	if isUser==True:
	log("[I] Deleted user : "+line,"info")
	elif isGroup==True:
	log("[I] Deleted group : "+line,"info")
	processedRows=processedRows+1
	elif response_code==404:
	if isUser==True:
	log("[E] failed while deleting user '" + line + "'. Please verify the parameters","error")
	elif isGroup==True:
	log("[E] failed while deleting group '" + line + "'. Please verify the parameters","error")
	elif response_code==400:
	if isUser==True:
	log("[I] User not found : "+line,"info")
	elif isGroup==True:
	log("[I] Group not found : "+line,"info")

	f.close()
	if processedRows==0:
	if isUser==True:
	log("[I] No valid user found to delete!","info")
	elif isGroup==True:
	log("[I] No valid group found to delete!","info")
	else:
	if isUser==True:
	log("[I] Number of user deleted : "+str(processedRows),"info")
	elif isGroup==True:
	log("[I] Number of group deleted : "+str(processedRows),"info")
	main(sys.argv)