Forum Discussion

jaolokonto's avatar
jaolokonto
Icon for Altostratus rankAltostratus
Jun 01, 2021

AD Authentication using multiple user attributes

Hello,   maybe someone had this problem before and could advice me with solution.   We have APM running with SAML for some users and logon page with ad auth for rest of the users. Right now o...
  • Amine_Kadimi's avatar
    Jun 01, 2021

    Hi,

     

    For users authenticating with email address: here's the flow order after the logon page:

     

    1. AD query with searchfilter: (mail=%{session.logon.last.username}). For "Required Attributes" keep only samaccountname

    2. Variable Assign with two entries:

    session.logon.last.logonname = session.ad.last.attr.sAMAccountName (aka AD attribute name sAMAccountName)

    session.logon.last.username = session.ad.last.attr.sAMAccountName (aka AD attribute name sAMAccountName)

    3. AD auth

    4... remaining of your policy

     

    In order to accommodate other users with the same policy you need to implement some check of the username and see if it contains @ for example and direct to the next agent accordingly.

     

    Also note that in order for the ad query to work correctly you need to specify and admin account on your AD AAA object configuration.

     

    --

    Amine Kadimi