API/programmable interface to rotate specific system users passwords

[witold.jagielski]

Hi all,

I'm looking for an official Cisco answer on following question:

It there any programmable interface/API which gives option to rotate password for following CUCM users:

osadmin

ccmadmin

user used for LDAP sync

user used for DRF backup

Thanks!

[BjoernMartin]

Hi.

The Account OS Admin for DRF Backup and OSPlatform things cannot be changed via API.
The only way would be through this procedure (pwrecovery).
https://www.cisco.com/c/en/us/support/docs/unified-communications/unified-communications-manager-callmanager/213527-changing-cucm-os-admin-and-security-pass.pdf

To change AppAdmin like ccmadmin you can do API Call updateAppUser to reset/update password.

And users who are synchronized via the ldap server like (Active directory) and cucm has LDAP authentication enabled,
the password can only be changed in the ldap server (Active Directory for example).
Microsoft has an API to do that.
https://docs.microsoft.com/de-de/graph/api/passwordauthenticationmethod-resetpassword?view=graph-rest-beta&tabs=http

best regards

[dstaudt]

• The LDAP client credentials (for connecting to the LDAP server) should be manageable via AXL <updateLdapAuthentication> (for the user-sync/authentication backhaul connection) or <updateLdapSearch> (for the on-device LDAP directory/lookup connection)
• It is possible to drive CUCM CLI operations (e.g. to change the OS admin credentials per the above link) via application, e.g. with Python via Paramiko, though this is more like web scraping than a formal API and can get tricky/impossible for complex commands (note this is not an officially 'supported' API/automation interface).  But, for these simple password management commands it should likely be pretty easy.  There's a comment with a Paramiko code example here which may be helpful.