Forum Discussion
jaolokonto
Altostratus
AltostratusAD Authentication using multiple user attributes
Hello, maybe someone had this problem before and could advice me with solution. We have APM running with SAML for some users and logon page with ad auth for rest of the users. Right now o...
Hi,
For users authenticating with email address: here's the flow order after the logon page:
1. AD query with searchfilter: (mail=%{session.logon.last.username}). For "Required Attributes" keep only samaccountname
2. Variable Assign with two entries:
session.logon.last.logonname = session.ad.last.attr.sAMAccountName (aka AD attribute name sAMAccountName)
session.logon.last.username = session.ad.last.attr.sAMAccountName (aka AD attribute name sAMAccountName)
3. AD auth
4... remaining of your policy
In order to accommodate other users with the same policy you need to implement some check of the username and see if it contains @ for example and direct to the next agent accordingly.
Also note that in order for the ad query to work correctly you need to specify and admin account on your AD AAA object configuration.
--
Amine Kadimi
Amine_Kadimi
MVP
MVPHi,
For users authenticating with email address: here's the flow order after the logon page:
1. AD query with searchfilter: (mail=%{session.logon.last.username}). For "Required Attributes" keep only samaccountname
2. Variable Assign with two entries:
session.logon.last.logonname = session.ad.last.attr.sAMAccountName (aka AD attribute name sAMAccountName)
session.logon.last.username = session.ad.last.attr.sAMAccountName (aka AD attribute name sAMAccountName)
3. AD auth
4... remaining of your policy
In order to accommodate other users with the same policy you need to implement some check of the username and see if it contains @ for example and direct to the next agent accordingly.
Also note that in order for the ad query to work correctly you need to specify and admin account on your AD AAA object configuration.
--
Amine Kadimi
jaolokontoHello.
it took me a while but i went through your suggestion and indeed it works! Variable assign block was a key! Thanks!