Active directory retrieve memberof group CN

Will you just send one group in the claim? Do you need all groups returned by AD to be stripped down and sent in a certain format?

The memberOf attribute is a multi-value field. You can have an iRule event that will grab the session variable, do the string manipulation you need, then set a new session variable that you can use later. You could also possibly do an ad query and have branch rules per group (if you are doing a one to one mapping) and then do a variable assign to a custom variable that you use later.

Seth