Security

Set default app for LDAP users

plaxos
Explorer

How can users who are LDAP authenticated and authorized (i.e. LDAP group mapped to a role) be given a default app?

It is not possible to associate a default app with a role in authorize.conf. A default app can be set in user-prefs.conf as default_namespace, but this appears to be a per user based preference that is stored in the etc/user/xxx directories (which anyway do not exist for LDAP users until they logon for the first time).

I have tried configuring it at the app level using an apps/myapp/local/user-prefs.conf but this does not seem to have any effect.

BTW ... this is all done for a Search Head Cluster so has to be done with conf files and a deployer.

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

You can store the the role level default app in etc/apps/local/user-prefs.conf as

[role_user]
default_namespace = YourApp

View solution in original post

somesoni2
Revered Legend

You can store the the role level default app in etc/apps/local/user-prefs.conf as

[role_user]
default_namespace = YourApp

plaxos
Explorer

You are right. Thanks for the pointer.
Now I have to decide whether to distribute this via deployer, and overwrite the system defaults (bad practice), or manually make the change on each SHC member.

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

Quantify Your Splunk Investment Impact: Introducing Savings Metrics to Value Insights

Building on the foundation established in our initial Value Insights releases, we are introducing the Savings ...

Event Series: Telemetry Pipeline Management

Balancing Scale and Spend: Gaining Control Over High-Volume Metrics in Splunk Observability Cloud As ...

Kick the Tires Before You Commit: A Hands-On Tour of the Splunk Observability Cloud ...

Evaluating an enterprise observability platform usually goes like this: fill out a form, get a free trial with ...