For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

F51982_110427's avatar
F51982_110427
Icon for Nimbostratus rankNimbostratus
Feb 09, 2017

APM Values

Is there any documentation on the different values and or good examples of what happens when the data is passed through utilizing the values.

IE: expr return string

session.logon.last.username
session.logon.first.username

what would these values return - 

IE:
session.logon.last.username  = expr { [mcget {session.ad.last.attr.sAMAccountName}]}
vs
session.logon.last.username  = return { [mcget {session.ad.last.attr.sAMAccountName}]}
vs
session.logon.last.username  = expr{ [string to lower [mcget {session.ad.last.attr.sAMAccountName}]]}
application delivery
BIG-IP Access Policy Manager (APM)

2 Replies

  • Andrew_Husking's avatar
    Andrew_Husking
    Icon for Cirrus rankCirrus
    Feb 09, 2017

    I certainly haven't seen much.

     

    The first, would return the sAMAccountName AD attribute (if you had an AD query object in the VPE that returned sAMAccountName).

     

    The second,I haven't tried using return, only ever expr, but i would assume the same as the above.

     

    The third, would be the same as the first, just all lowercase.

     

    HTH

     

  • Kai_Wilke's avatar
    Kai_Wilke
    Icon for MVP rankMVP
    Feb 10, 2017

    Hi F51982,

    assuming that 

    session.ad.last.attr.sAMAccountName
    is set to 
    DOMAIN\bob
    the following result can be expected.

    mcget {session.ad.last.attr.sAMAccountName} = DOMAIN\bob
string tolower [mcget {session.ad.last.attr.sAMAccountName}] = domain\bob

expr { [mcget {session.ad.last.attr.sAMAccountName}] } = DOMAIN\bob
expr { [string tolower [mcget {session.ad.last.attr.sAMAccountName}]] } = domain\bob

return [mcget {session.ad.last.attr.sAMAccountName}] = DOMAIN\bob
return [string tolower [mcget {session.ad.last.attr.sAMAccountName}]] = domain\bob

    The difference of using a native 

    command
    , 
    expr { [command] }
    or 
    return [command]
    is non-existent if you just fetch an existing variable while passing it to a new variable.

    Only the advanced variable assign actions are making the difference between those commands.

    Example1: 

    expr { ( [mcget {session.ad.last.attr.sAMAccountName}] contains "domain\bob" ) or ( [mcget {session.ad.last.attr.sAMAccountName}] contains "domain\tom" ) }

    Result: The above example will return the value 

    1
    if bob or tom is loggin in and 
    0
    for everyone else.

    Example2:

    if { ( [mcget {session.ad.last.attr.sAMAccountName}] contains "domain\bob" ) or ( [mcget {session.ad.last.attr.sAMAccountName}] contains "domain\tom" ) } then {
    return a ;
} else {
    return b ;
} ;

    Result: The above example will return the value 

    a
    if bob or tom is loggin in and 
    b
    for everyone else.

    Example3:

    set user [mcget {session.ad.last.attr.sAMAccountName}] ;
if { $user starts_with "DOMAIN\\" } then {
    return "DOMAIN2\\[lindex [split $user "\\"] 1]" ;
} else {
    return $user ;
} ;

    Result: The above example will return the 

    sAMAccountName
    while rewriting 
    DOMAIN\
    to 
    DOMAIN2\
    .

    Cheers, Kai