Forum Discussion

Mark_van_D's avatar
Mark_van_D
Icon for Cirrostratus rankCirrostratus
Sep 02, 2019

APM session attribute exists

Hi there,

I am trying to find an elegant way for an Access Policy to go down a different branch depending on whether multiple AD attributes exists or not, but am not having much luck at present.

Mobile and Pager Branch

set ad_attribute1_exists [info exists [mcget {session.ad.last.attr.mobile}]];
set ad_attribute2_exists [info exists [mcget {session.ad.last.attr.pager}]];
expr { $ad_attribute1_exists == 1 && $ad_attribute2_exists == 1}

Mobile Only Branch

set ad_attribute1_exists [info exists [mcget {session.ad.last.attr.mobile}]];
set ad_attribute2_exists [info exists [mcget {session.ad.last.attr.pager}]];
expr { $ad_attribute1_exists == 1 && $ad_attribute2_exists == 0}

The mobile attribute is configured in the user object but the pager attribute is not configured in AD.

However both ad_attribute1_exists and ad_attribute2_exists return 0 and following the fallback branch.

What am I missing?

application delivery
BIG-IP Access Policy Manager (APM)
  • Andy_McGrath's avatar
    Andy_McGrath
    Sep 02, 2019

    You are using 'info exists' and 'mcget' incorrectly.

    'mcget' will return the value of the APM session variable, so if the session variable for 'session.ad.last.attr.mobile' is 555-1234 you are passing this to 'info exists'. i.e. you are executing 'info exits 555-1234' but guessing no variable exists named 555-1234 (or what ever the value is)

    I think if you call 'mcget' on a session variable that doesn't exist I think you get "" returned, so the following should do what you want (not tested as no quick access to APM currently):

    if {[mcget {session.ad.last.attr.mobile}] == ""} {
    set ad_attribute1_exists 0
} else {
    set ad_attribute1_exists 1
}
if {[mcget {session.ad.last.attr.pager}] == ""} {
    set ad_attribute2_exists 0
} else {
    set ad_attribute2_exists 1
}
expr { $ad_attribute1_exists == 1 && $ad_attribute2_exists == 1}

    Or as a one liner:

    expr { [mcget {session.ad.last.attr.mobile}] != "" && [mcget {session.ad.last.attr.pager}] != ""}
  • Andy_McGrath's avatar
    Andy_McGrath
    Icon for Cumulonimbus rankCumulonimbus
    Sep 02, 2019

    You are using 'info exists' and 'mcget' incorrectly.

    'mcget' will return the value of the APM session variable, so if the session variable for 'session.ad.last.attr.mobile' is 555-1234 you are passing this to 'info exists'. i.e. you are executing 'info exits 555-1234' but guessing no variable exists named 555-1234 (or what ever the value is)

    I think if you call 'mcget' on a session variable that doesn't exist I think you get "" returned, so the following should do what you want (not tested as no quick access to APM currently):

    if {[mcget {session.ad.last.attr.mobile}] == ""} {
    set ad_attribute1_exists 0
} else {
    set ad_attribute1_exists 1
}
if {[mcget {session.ad.last.attr.pager}] == ""} {
    set ad_attribute2_exists 0
} else {
    set ad_attribute2_exists 1
}
expr { $ad_attribute1_exists == 1 && $ad_attribute2_exists == 1}

    Or as a one liner:

    expr { [mcget {session.ad.last.attr.mobile}] != "" && [mcget {session.ad.last.attr.pager}] != ""}