Change the default app for users with a given role

[FritzWittwer_ol]

We'd like to change the default app for a group of users with a given role as we replace an app and will phase out and delete the old app in the future. I tried to figure out how the default app is determined and assume:

• The first time the user logs in, his/her default app is determined and stored in the users own user-prefs, SPLUNK_HOME/etc/users//user-prefs/local/user-prefs.conf.
  • A LDAP user has an empty default app (something else may be defined in SPLUNK_HOME/etc/apps/local/user-prefs.conf , but only one for all users), so a default app from the assigned roles is taken.
  • A local user gets the launcher as default app upon first login.
  • If more than one assigned role defines a default app, to outcome seems to be undefined.
• If the user has no permission on the app defined in the user.prefs, a page with the list of all available apps to which the user has access will be displayed.
• A user may change the own default app in the preferences any time.

Are this assumptions correct, I did not find anything in the documentation.
So changing the default app for the role will probably only affect new users. If we will remove the old App in the future, these user will get the list of all app to which they have access. this is something we try to avoid for various reasons.

[sudosplunk]

Hello, my two cents:

The first time the user logs in, his/her default app is determined and stored in the users own user-prefs, SPLUNK_HOME/etc/users//user-prefs/local/user-prefs.conf.

Yes. That is correct per user-prefs.conf.

A LDAP user has an empty default app (something else may be defined in SPLUNK_HOME/etc/apps/local/user-prefs.conf , but only one for all users), so a default app from the assigned roles is taken.

This may be right, I am partially confident on this. Yet to test.

A local user gets the launcher as default app upon first login.

That is right. Per user-prefs.conf, Splunk defaults the app name to 'launcher' via the default authorize.conf.

If more than one assigned role defines a default app, to outcome seems to be undefined.

This is explained below by @kmorris_splunk

If the user has no permission on the app defined in the user.prefs, a page with the list of all available apps to which the user has access will be displayed.

That is correct. You can find some info here.

A user may change the own default app in the preferences any time.

Yes.

Additionally, this link has some good information about configuring default app by role. HTH!

[kmorris_splunk]

If a user has multiple roles that have default app set, it is alphabetical. For example, if i have a_role and b_role, the user will inherit the default app from a_role. If a user sets a default app at the user level, this will override any role based default app for that particular user.