APM Local DB multiple groups

F5_Design_Engineer

MVP

Jul 04, 2024

try adding AD query after the logon Page and then assigning the resources on the user level.

try using the expression in the Advance resource Assignment and then assigned the user with individual resources.

expr { [mcget {session.logon.last.username}] == "test_user" }

Branching in an access policy based on local user database groups

You can store user group membership strings in a local user database instance. You can add one or more strings for a user to the database. The strings can reflect any grouping strategy that you want to apply. You can make user group-based branching decisions in an access policy by reading the group information for the user from the database, and creating rules for branching based on it.

Before you can perform this task, you need users and user group membership strings configured in a local user database instance. You also need an access profile.

Task summary

Creating an access policy to branch based on local DB group membership

You can use an access policy to retrieve user group membership from a local user database instance and configure branch rules to provide different actions for users in different groups.

On the Main tab, click Access Policy > Access Profiles. The Access Profiles List screen opens.
In the Access Policy column, click the Edit link for the access profile you want to configure. The visual policy editor opens the access policy in a separate screen.
On an access policy branch, click the (+) icon to add an item to the access policy. Repeat this action from the visual policy editor whenever you want to add an item to the access policy. A popup screen displays actions on tabs, such as General Purpose and Authentication, and provides a search field.
Type local in the search field. Search is not case-sensitive. A list of matching actions is displayed.
Select Local Database and click Add Item. A properties screen displays.
From the LocalDB Instance list, select a local user database.
In the User Name field, retain the default session variable or type another variable name or a user name.
From the Allow User Creation list, retain the default value (No).
Click Add new entry. A new line is added to the list of entries.
Configure the entry to read the groups from the database and store them in a variable:
1. From the Action list, select Read.
2. In the Source column from the DB Property list, select groups.
3. In the Destination column Session Variable field, retain the default value, session.localdb.groups or type the name of a variable.
4. In the Source column from the DB Property list, select groups. You have configured an action that reads the user's groups into a variable.
Click the Branch Rules tab to edit a branch rule.
Click the Add Branch Rule button. New Name and Expression settings display.
In the Name field, replace the default name by typing a new name over it. The default name is Branch Rule n where n is a number. The name appears on the branch in the access policy and so should be descriptive.
Click the change link in the Expression area. A popup screen opens.
Click the Advanced tab. Use this tab to enter Tcl expressions. A text input field displays.
Type an expression into the text input field. If you expect groups to include only one entry, you can type an expression similar to this one.expr { [mcget {session.localdb.groups}] eq "eng" }If you expect groups to include multiple entries, you can type an expression similar to this oneexpr { [mcget {session.localdb.groups}] contains "sales" }
Click Finished. The popup screen closes.
Add more branch rules to provide branches for different user groups.
Click Save. The properties screen closes and the visual policy editor displays.
Optional: Add any other branches and actions that you need to complete the access policy.