Forum Discussion
jaolokonto
Altostratus
AltostratusAD Authentication using multiple user attributes
Hello,
maybe someone had this problem before and could advice me with solution.
We have APM running with SAML for some users and logon page with ad auth for rest of the users. Right now one of our customers made a trust relationship with our AD and they are supposed to authenticate to our app using their credentials.
This works fine for most of the users however there is group of them that wants to use email for this. I can't figure out the way to verify email, match it with certain samaccountname and then authenticate user based on this samaaccountname like the rest of users.
I tried with AD query configuration, tried with LDAP auth instead of AD auth because you can add filter there. It ends up being broken for users either with email as username or regular one. I thought about using irule for this to verify variable value and if it contains "@" to do something but i dont see possibility to switch authentication based on irule output.
Any ideas?
Hi,
For users authenticating with email address: here's the flow order after the logon page:
1. AD query with searchfilter: (mail=%{session.logon.last.username}). For "Required Attributes" keep only samaccountname
2. Variable Assign with two entries:
session.logon.last.logonname = session.ad.last.attr.sAMAccountName (aka AD attribute name sAMAccountName)
session.logon.last.username = session.ad.last.attr.sAMAccountName (aka AD attribute name sAMAccountName)
3. AD auth
4... remaining of your policy
In order to accommodate other users with the same policy you need to implement some check of the username and see if it contains @ for example and direct to the next agent accordingly.
Also note that in order for the ad query to work correctly you need to specify and admin account on your AD AAA object configuration.
--
Amine Kadimi
Amine_KadimiMVP
Hi,
For users authenticating with email address: here's the flow order after the logon page:
1. AD query with searchfilter: (mail=%{session.logon.last.username}). For "Required Attributes" keep only samaccountname
2. Variable Assign with two entries:
session.logon.last.logonname = session.ad.last.attr.sAMAccountName (aka AD attribute name sAMAccountName)
session.logon.last.username = session.ad.last.attr.sAMAccountName (aka AD attribute name sAMAccountName)
3. AD auth
4... remaining of your policy
In order to accommodate other users with the same policy you need to implement some check of the username and see if it contains @ for example and direct to the next agent accordingly.
Also note that in order for the ad query to work correctly you need to specify and admin account on your AD AAA object configuration.
--
Amine Kadimi
jaolokontoHello.
it took me a while but i went through your suggestion and indeed it works! Variable assign block was a key! Thanks!