Mar 27, 2026 - For details about updated CVE-2025-53521 (BIG-IP APM vulnerability), refer to K000156741.

Forum Discussion

coreyva's avatar
coreyva
Icon for Nimbostratus rankNimbostratus
8 years ago

AD query SearchFilter multiple searches

I'm working on an APM profile and within an AD query SearchFilter I'd like to check a session variable against multiple fields. So something like this userPrincipalName=%{session.logon.last.usern...
BIG-IP Access Policy Manager (APM)
cloud
security
stan_piron's avatar
stan_piron
Icon for Cumulonimbus rankCumulonimbus
8 years ago

Hi, ad query filter format is standard ldap filter

|(condition1)(condition2)(condition3)

The operator is at the beginning

 |(userPrincipalName=%{session.logon.last.username})(mail=%{session.logon.last.username})
  • svs's avatar
    svs
    Icon for Cirrostratus rankCirrostratus
    4 years ago

    Hi Stanislas,

    this is syntactically incorrect. The whole statement needs to embraced with brackets:

    (|(userPrincipalName=%{session.logon.last.username})(mail=%{session.logon.last.username}))

    And as many users may look for something, where either an email address or the sAMAccountName could be used:

    (|(userPrincipalName=%{session.logon.last.username})(mail=%{session.logon.last.username})(sAMAccountName=%{session.logon.last.username}))

    Hope that helps anyone, who is looking for especially this very bad documented search filter field in AD Query agent of the access policy.

    This was successfully tested today on 16.1.2.