Security

Set default app for LDAP users

plaxos
Explorer

How can users who are LDAP authenticated and authorized (i.e. LDAP group mapped to a role) be given a default app?

It is not possible to associate a default app with a role in authorize.conf. A default app can be set in user-prefs.conf as default_namespace, but this appears to be a per user based preference that is stored in the etc/user/xxx directories (which anyway do not exist for LDAP users until they logon for the first time).

I have tried configuring it at the app level using an apps/myapp/local/user-prefs.conf but this does not seem to have any effect.

BTW ... this is all done for a Search Head Cluster so has to be done with conf files and a deployer.

Tags (2)
0 Karma
1 Solution

somesoni2
Revered Legend

You can store the the role level default app in etc/apps/local/user-prefs.conf as

[role_user]
default_namespace = YourApp

View solution in original post

somesoni2
Revered Legend

You can store the the role level default app in etc/apps/local/user-prefs.conf as

[role_user]
default_namespace = YourApp

plaxos
Explorer

You are right. Thanks for the pointer.
Now I have to decide whether to distribute this via deployer, and overwrite the system defaults (bad practice), or manually make the change on each SHC member.

0 Karma
Get Updates on the Splunk Community!

Leveraging Automated Threat Analysis Across the Splunk Ecosystem

Enhance Security Operations with Automated Threat Analysis in the Splunk EcosystemAre you leveraging ...

Splunk Developers: Go Beyond the Dashboard with These .Conf25 Sessions

  Whether you’re building custom apps, diving into SPL2, or integrating AI and machine learning into your ...

Index This | How do you write 23 only using the number 2?

July 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...