Security

Set default app for LDAP users

plaxos
Explorer

How can users who are LDAP authenticated and authorized (i.e. LDAP group mapped to a role) be given a default app?

It is not possible to associate a default app with a role in authorize.conf. A default app can be set in user-prefs.conf as default_namespace, but this appears to be a per user based preference that is stored in the etc/user/xxx directories (which anyway do not exist for LDAP users until they logon for the first time).

I have tried configuring it at the app level using an apps/myapp/local/user-prefs.conf but this does not seem to have any effect.

BTW ... this is all done for a Search Head Cluster so has to be done with conf files and a deployer.

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

You can store the the role level default app in etc/apps/local/user-prefs.conf as

[role_user]
default_namespace = YourApp

View solution in original post

somesoni2
Revered Legend

You can store the the role level default app in etc/apps/local/user-prefs.conf as

[role_user]
default_namespace = YourApp

plaxos
Explorer

You are right. Thanks for the pointer.
Now I have to decide whether to distribute this via deployer, and overwrite the system defaults (bad practice), or manually make the change on each SHC member.

0 Karma
Get Updates on the Splunk Community!

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...