F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

Rise_77519's avatar
Rise_77519
Icon for Nimbostratus rankNimbostratus
Nov 01, 2013

apm question

Hi, is it possible to assign resource to users based radius attribute like nested group in active directory. for exm. i have two user group that are technical and sales in radius. if a user from tech...
design
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Nov 04, 2013

Are you sure that the ..attr.groupid is correct value to extract radius group id?

 

Absolutely not. At the time of writing the last post I used this as an example for syntax only. I've had a little more time to dig into it though, and I'd direct you to this document:

 

 

that states "session.RADIUS.last.attr.$attr_name" is the set of variables that you'd expect to see if RADIUS completed successfully. The "$attr_name" part is dynamic, so I'd suggest you either:

 

  1. Perform a successful RADIUS auth first without doing any evaluation on its return values so that you can run an access policy report and see what is actually being returned. The report should show you what values are extracted into separate session variables and what those variables are named.

     

  2. Run a network capture and see what the RADIUS server is sending back in its response packets (WireShark is probably best for this given its ability to filter and display the protocol data). I would do this as a troubleshooting step if the above doesn't produce any session variables.