topic Re: API/programmable interface to rotate specific system users passwor in Management

API/programmable interface to rotate specific system users passwords

witold.jagielski — Thu, 21 Oct 2021 10:59:46 GMT

Hi all,

I'm looking for an official Cisco answer on following question:

It there any programmable interface/API which gives option to rotate password for following CUCM users:

osadmin

ccmadmin

user used for LDAP sync

user used for DRF backup

Thanks!

BjoernMartin — Thu, 21 Oct 2021 11:55:07 GMT

Hi.

To change AppAdmin like ccmadmin you can do API Call updateAppUser to reset/update password.

And users who are synchronized via the ldap server like (Active directory) and cucm has LDAP authentication enabled,
the password can only be changed in the ldap server (Active Directory for example).
Microsoft has an API to do that.
https://docs.microsoft.com/de-de/graph/api/passwordauthenticationmethod-resetpassword?view=graph-rest-beta&tabs=http

best regards

dstaudt — Thu, 21 Oct 2021 20:20:00 GMT

The LDAP client credentials (for connecting to the LDAP server) should be manageable via AXL <updateLdapAuthentication> (for the user-sync/authentication backhaul connection) or <updateLdapSearch> (for the on-device LDAP directory/lookup connection)
It is possible to drive CUCM CLI operations (e.g. to change the OS admin credentials per the above link) via application, e.g. with Python via Paramiko, though this is more like web scraping than a formal API and can get tricky/impossible for complex commands (note this is not an officially 'supported' API/automation interface). But, for these simple password management commands it should likely be pretty easy. There's a comment with a Paramiko code example here which may be helpful.