Add management of accounts via REST API

Hello all, 

This "pull requests" is realized in order to add the management of accounts with the REST API.

In order to help the management of accounts via the REST API, I attach to this "Pull requests" a small dirty python script to create accounts from a CSV file (add-account-in-MISP.py) and a CSV test file (test-account.csv). This python script use the PyMISP library.

To use this dirty script "add-account-in-MISP.py" you have to configure the "url" and "misp_api_key" variables in the Python script and execute the command:python2 add-account-in-MISP.py -f test-account.csv -id 1 (the "-id" option is the last ID used by MISP (Biggest "ID" displayed in "List Users" page)).

devnull-

-----------------------------------------------------------------------------------------------------------------------------------------------------
```
cat add-account-in-MISP.py

#!/usr/bin/env python2

from pymisp import PyMISP

import logging

#######################################
#    CONFIGURATION                    #
#######################################
url='https://192.168.0.1'
misp_api_key='XXXXXXXXX'
#######################################
#    CSV Format                       #
#######################################
# EMAIL, ORG, ROLE_ID, PASSWORD
# 0    , 1  , 2      , 3
# By default ROLE_ID
# 1: admin
# 2: Org Admin 
# 3: User
# 4: Sync user 
# 5: Automation user 
# 6: Read Only

# [Optional] The certificate file can be
# added after the password field (4th field)

# [Optional] The GPGkey file can be added
# after the certificate field (5th field)
#######################################



log = logging.getLogger("Mass accounts in MISP")

def add_xml(xml, tag, value):
    try:
        return xml + '<' + str(tag) + '>' + str(value) + '</' + str(tag) + '>'
    except UnicodeEncodeError:
        return xml + '<' + str(tag) + '>' + value.encode('utf-8') + '</' + str(tag) + '>'

def main():
    #logging.basicConfig(format="%(levelname)-5s: %(message)s", level=30)
    import argparse
    import os
    import re
    import yaml
    from datetime import datetime
    parser = argparse.ArgumentParser(description="Mass accounts in MISP :-)")
    parser.add_argument("--verbose", "-v", action="count", default=2, help="Increase verbosity")
    parser.add_argument("--file", "-f", dest='file_csv', type=str, action="store", help=u"CSV file containing the account data", required=True)
    parser.add_argument("--start_id", "-id", dest='start_id', type=int, action="store", help='Last ID used by MISP (Biggest "ID" displayed in "List Users" page)', required=True)
    parser.add_argument("--certif_public", dest='certif', action="store_true", default=False, help="If the 4th field of the CVS file contains the filename of the certif file")
    parser.add_argument("--gpg", dest='gpg', action="store_true", default=False, help="If the 5th field of the CVS file contains the filename of the GPGkey file")

    options = parser.parse_args()
    verbosity = max(1,50-10*(options.verbose))
    logging.basicConfig(format="%(levelname)-5s: %(message)s", level=verbosity)
    start_id = options.start_id + 1
    end_id = start_id
    base_nids = 0

    # Connection
    pymisp = PyMISP(url, misp_api_key, False, 'xml')
    session = pymisp._PyMISP__prepare_session()

    stream = open(options.file_csv)
    for i in stream:
        #print "i",i
        # EMAIL, ORG, ROLE_ID, PASSWORD
        # 0    , 1  , 2      , 3
        # By default ROLE_ID
        # 1: admin
        # 2: Org Admin 
        # 3: User
        # 4: Sync user 
        # 5: Automation user 
        # 6: Read Only
        junk = i.split(",")
        xml = '<?xml version="1.0" encoding="UTF-8"?>\n<response>\n<User>\n'
        # password
        xml = add_xml(xml, 'password', junk[3].rstrip())
        # confirm_password
        xml = add_xml(xml, 'confirm_password', junk[3].rstrip())
        # org
        xml = add_xml(xml, 'org', junk[1])
        # email
        xml = add_xml(xml, 'email', junk[0])
        # role_id
        xml = add_xml(xml, 'role_id', junk[2])
        # nids_sid
        base_nids += 100000
        xml = add_xml(xml, 'nids_sid', str(base_nids))
        # gpgkey
        if (options.gpg):
            stream2 = open(junk[5].rstrip());
            gpgkey = ''
            for i in stream2:
                gpgkey += i
            xml = add_xml(xml, 'gpgkey', gpgkey)
        else:
            xml = xml + '<gpgkey/>'
        # certif_public
        if (options.certif):
            stream2 = open(junk[4].rstrip());
            certif_public = ''
            for i in stream2:
                certif_public += i
            xml = add_xml(xml, 'certif_public', certif_public)
        else:
            xml = xml + '<certif_public/>'
        # autoalert
        xml = add_xml(xml, 'autoalert', '1')
        # contactalert
        xml = add_xml(xml, 'contactalert', '1')
        # authkey
        # Dirty authkey!!!!!
        #base_authkey = 'ftPLDdADbL4nRJ0BU4pROTjCOaIopboFEerir1Vx'
        base_authkey = 'ftPLDdADbL4nRJ0BU4pROTjCOaIopboF'
        import random
        random_junk = random.randrange(10000000,99999999,3)
        authkey = base_authkey + str(random_junk)
        xml = add_xml(xml, 'authkey', authkey)
        # End XML
        xml = xml + '</User>\n</response>\n'

        # Create account
        if url[-1] == '/':
            url_add = url + 'admin/users/add'
        else:
            url_add = url + '/admin/users/add'
        #print "url_add",url_add
        res = session.post(url_add, data=xml).text
        end_id += 1
    # For security reasons and fix the DIRTY AUTHKEY
    # Reset all key of the new accounts
    print "For security reasons and fix the DIRTY AUTHKEY"
    print "Reset all key of the new accounts"
    if url[-1] == '/':
        url_reset = url + 'users/resetauthkey/'
    else:
        url_reset = url + '/users/resetauthkey/'
    for i in range(start_id,end_id):
        print "Resetauthkey ID:%s" % i
        session.get(url_reset + str(i)).text
if __name__ == '__main__':
    main()
```
-----------------------------------------------------------------------------------------------------------------------------------------------------
-----------------------------------------------------------------------------------------------------------------------------------------------------
```
cat test-account.csv
t1@toto.com,1,1,Password!
t2@toto.com,2,2,Password!
t3@toto.com,3,3,Password!
```
-----------------------------------------------------------------------------------------------------------------------------------------------------