Forum Discussion

John_T__Morgan_'s avatar
John_T__Morgan_
Icon for Nimbostratus rankNimbostratus
May 07, 2015

Advanced AD Query

Hi,

 

I am attempting to do an AD Query on an attribute of a user logging in through APM.

 

I need to determine if the attribute in question contains a value or not.

 

If the attribute contains a value, then the user will get directed one way. If the attribute is empty or null, then I want to send the user down another path.

 

I can not find any syntax on how to query an attribute in APM.

 

I think I should be able to enter an expression on the advanced tab of an ad query to determine if there is a null value or not.

 

Is this possible?

 

Thanks,

 

-John

 

BIG-IP Access Policy Manager (APM)
design
security

3 Replies

  • Chris_17748's avatar
    Chris_17748
    Icon for Nimbostratus rankNimbostratus
    May 07, 2015

    John - If I understand correctly you looking to use the advanced tab of branch rule to determine how to route a user. This is an example of a check for the existence of a value from a LDAP query. You would need to use a AD session variable instead of the ldap session variable but the basic structure of the check to see if a value exists is like this:

     

    expr { [mcget {session.ldap.last.attr.unixHomeDirectory}] != "" }

     

    I've never tried or thought of using the check on a branch rule of the query item itself, but I would think it would work (and I might start using it if it does). I tend to do the branch selection with an item following the query itself mostly to keep operations broken out so I remember what everything does.

     

    • John_T__Morgan_'s avatar
      John_T__Morgan_
      Icon for Nimbostratus rankNimbostratus
      May 08, 2015
      Thanks for the reply. Waht I am actually looking for is whether or not there is a value in the attribute "extensionAttribute15". I am using this: expr { [mcget {session.ad.last.attr.extensionAttribute15}] != "" } But I get the following error "Rule evaluation failed with error: syntax error in expression " [mcget {session.ad.last.attr.extensionAttribute15}] = "" ": extra tokens at end of expression" So, I'm not sure if I actually have an extra token or if I just have a syntax error in the formation of the variable name. -John But i get an error
    • Chris_17748's avatar
      Chris_17748
      Icon for Nimbostratus rankNimbostratus
      May 08, 2015
      Are you getting the error when you try to save the the expression or when it evaluates? I'm wondering if the data stored in that attribute is a data type that has to be handled differently.