Forum Discussion

Benoit_376644's avatar
Benoit_376644
Icon for Nimbostratus rankNimbostratus
Nov 13, 2018

AD query not working

Hi everyone,

 

for some reason, my AD query is not working. When I check if the user is a member of a specific group, I get an access deny, altought the user is in the right group. My query is like this:

 

Expression: User is a member of CN=BigIP_EXTUSER_MULTI,OU=EXTUSER,OU=MS Users,DC=xx,DC=xxxx,DC=xxx.

 

Straight and forward but somehow, getting an access deny

 

In y query, the option Fetch Primary is enabled and the other options are disabled.

 

Any ideas on why it ain't working?

 

Tks

 

application delivery
BIG-IP Access Policy Manager (APM)
  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Nov 14, 2018

    Hi,

     

    Is the user member of this group or is he member of a nested group?

     

    for troubleshooting, can you edit VPE with following box:

     

    • add a message box after AD query fallback branch (branch where the user doesn't match group mapping)

    when the user is authenticated but doesn't match group mapping, the browser may display the added message box. don't click on continue for now... this stop policy evaluation for next step...

     

    then in "manage session" page (access overview / active session in version 13 and 14), find your session and click on "view variables"

     

    then search memberOf variable... find if the expected group is in this attribute.