Forum Discussion
AD Authentication using multiple user attributes
- Jun 01, 2021
Hi,
For users authenticating with email address: here's the flow order after the logon page:
1. AD query with searchfilter: (mail=%{session.logon.last.username}). For "Required Attributes" keep only samaccountname
2. Variable Assign with two entries:
session.logon.last.logonname = session.ad.last.attr.sAMAccountName (aka AD attribute name sAMAccountName)
session.logon.last.username = session.ad.last.attr.sAMAccountName (aka AD attribute name sAMAccountName)
3. AD auth
4... remaining of your policy
In order to accommodate other users with the same policy you need to implement some check of the username and see if it contains @ for example and direct to the next agent accordingly.
Also note that in order for the ad query to work correctly you need to specify and admin account on your AD AAA object configuration.
--
Amine Kadimi
Hi,
For users authenticating with email address: here's the flow order after the logon page:
1. AD query with searchfilter: (mail=%{session.logon.last.username}). For "Required Attributes" keep only samaccountname
2. Variable Assign with two entries:
session.logon.last.logonname = session.ad.last.attr.sAMAccountName (aka AD attribute name sAMAccountName)
session.logon.last.username = session.ad.last.attr.sAMAccountName (aka AD attribute name sAMAccountName)
3. AD auth
4... remaining of your policy
In order to accommodate other users with the same policy you need to implement some check of the username and see if it contains @ for example and direct to the next agent accordingly.
Also note that in order for the ad query to work correctly you need to specify and admin account on your AD AAA object configuration.
--
Amine Kadimi
Hello.
it took me a while but i went through your suggestion and indeed it works! Variable assign block was a key! Thanks!
Recent Discussions
Related Content
* Getting Started on DevCentral
* Community Guidelines
* Community Terms of Use / EULA
* Community Ranking Explained
* Community Resources
* Contact the DevCentral Team
* Update MFA on account.f5.com