Delete Existing Users From Ranger

When you need to remove a batch of users from Apache Ranger, the REST API is far faster than clicking through the UI one by one. The approach below grabs the current user list, extracts the names, and issues a forced delete for each one using a single authenticated session.

Prerequisites

• Ranger is running and accessible over HTTPS (or HTTP if you have disabled TLS for testing).
• You have an admin account with permission to manage users.
• curl and jq are installed on the machine where you run the commands.

Step 1: Fetch the User List and Save the Cookie

Use curl to pull the full user list from the Ranger service. The -c flag writes the session cookie to a file so you can reuse it in the next request without re-authenticating.

curl -c ranger-cookie.txt \
  -k \
  -H 'Accept: application/json' \
  -H 'Content-type: application/json' \
  -u admin:'hadoop12345!' \
  'https://c416-node2.coelab.example.com:6182/service/xusers/users?pageSize=1000&startIndex=0' \
  > users.json

Step 2: Extract the User Names

Parse the JSON response with jq to get a clean list of user names, one per line.

jq '.xUsers[].name' users.json | tr -d '"' > users.out

Step 3: Delete Each User

Loop through the list and issue a DELETE request for every user. The forceDelete=true parameter removes the user even if they are still associated with a group or policy.

for i in $(cat users.out); do
  curl -b ranger-cookie.txt \
    -k \
    -H 'Accept: application/json' \
    -H 'Content-type: application/json' \
    -X DELETE \
    "https://c416-node2.coelab.example.com:6182/service/xusers/users/userName/${i}?forceDelete=true"
done

Verifying the Deletion

After the loop completes, re-run the user-list request from Step 1 and confirm the removed names no longer appear in the response. You can also check the Ranger UI under Users to make sure the list reflects the changes.

Troubleshooting

• 401 Unauthorized: The cookie may have expired. Re-run Step 1 to refresh it.
• 404 Not Found: Double-check the user name spelling and the API path. Ranger is case-sensitive.
• Connection errors: If you are behind a load balancer or proxy, verify that the hostname and port in the URL match your Ranger deployment.

This same pattern works for other Ranger REST endpoints, so you can adapt it for groups, policies, or service definitions as needed.

• Technology
• How-To
• Bigdata

• SysAdmin
• Troubleshooting