User removal via API not working

Hi Ondřej Valentík : Thanks for the detailed informative post, let me try it in my LAB setup and confirm on same to delete/remove the user via API.

Delete User
Request URL. {api-domain}/crm/{version}/users/{user_id}
Header. Authorization: Zoho-oauthtoken d92d4xxxxxxxxxxxxx15f52.
Scope. scope=ZohoCRM.users.{operation_type}
Possible operation types. ALL - Full access to users. DELETE - Delete user data.

This May Help,
Peter

Hi, Ondřej Valentík I have tried the below API for user delete/remove in local LAB and it worked for me.

reqxml=<Request><Login><Username>admin</Username><Password>XXXXXXX</Password></Login><Remove><User><Username>test1</Username><Name>test1</Name></User></Remove></Request>

Output:

<Response APIVersion="1800.2" IPS_CAT_VER="1">
<Login>
<status>Authentication Successful</status>
</Login>
<User transactionid="">
<Status code="200">Configuration applied successfully.</Status>
</User>
</Response>

Hi Vishal,

thank you very much. When add <Name> tag into the request, I can delete the user now.

Even if it doesn't make sense, because Name is not unique parameter, your colleagues from API team should at least mention it in documentation. At this time only Username is there (https://docs.sophos.com/nsg/sophos-firewall/19.0/API/CONFIGURE/Authentication/Users/operations/Delete User.html).

Unfortunately, another problem appeared now. I'm able to remove local users, but not AD users. The operation quits successfully (with status code 200 - Configuration applied successfully.), but user remains in firewall. I have found that another user has had the same issue, but there was no solution and thread was already closed (https://community.sophos.com/sophos-xg-firewall/f/discussions/132461/api-to-delete-user).

Can you please help me with this problem too?

Many thanks,

Ondrej

Hi Ondřej Valentík Let me arrange the setup with AD and try on the same again and will provide the update from my test.

Hi Vishal,

have you been able to re-produce the issue with AD?

Thank you,

Ondrej

Hi Ondřej Valentík Unfortunately I didn't get a chance yet to reproduce it, I would suggest opening a support case on the same to have further progress if you are facing an issue with deleting an AD user with API and share the case ID with us.

Hi Ondřej Valentík Just now I have tried with AD user in my local LAB setup and user delete via API works fine for me.

Please find the below snapshot and logs for reference.





CSC Debug logs for reference:

INFO Sep 20 13:14:26Z [delete_user:10557]: opcode 'delete_user': time taken: 0.121519984 seconds
DEBUG Sep 20 13:14:26Z [worker:10557]: {"response":{"method":"opcode","name":"delete_user","version":"1.14","type":"text","length":93,"data":{ "deleteObjects": [ "vishal.r@sophos.creed" ], "status": "200", "statusmessage": "success" },"statusCode":200,"statusStrlen":2,"statusString":"OK"}}
DEBUG Sep 20 13:14:26Z [worker:10557]: # OPCODE Exited: 'delete_user' with Status: '200'

API stauts in Browser:

<Response APIVersion="1805.2" IPS_CAT_VER="0">
<Login>
<status>Authentication Successful</status>
</Login>
<User transactionid="">
<Status code="200">Configuration applied successfully.</Status>
</User>
</Response>

So for your scenario still I would suggest opening a support case if there are any challenges to deleting AD users via API to have next investigation.

Hi Vishal,

thank you. I will open the support case. 

I get the same result like you, but when check the user again it still remains on the firewall.

Can you please confirm that it is really not present on the firewall anymore.

Ondrej

Hi  Ondřej Valentík, yes in the LAB device user was removed from the user tab in the UI section, I performed this operation for 2 different users and the result is fine both the time and AD users are not present there in the user section.