Forum Discussion

Alain_B_150222's avatar
Alain_B_150222
Icon for Nimbostratus rankNimbostratus
May 23, 2017

Branch evaluation fails with Rule evaluation error: invalid command name "session.logon.last.username"

Hopefully somebody is able to enlighten me, I have the code below in a branch rule expression of an AD Query element. I get an 'Rule evaluation failed with error: invalid command name "session.logon.last.username"' error. The purpose is to translate an email entered to the matching AD logon username from AD. The AD query succeeds (mail=%{session.logon.last.username}).

 

It looks like the variable assign element is not able to change the session.logon.last.username variable.

 

if { [mcget {session.ad.last.queryresult}] == 1 } {
    session.logon.last.username = mcget {session.ad.last.attr.sAMAccountName};
    return 1;
};
return 0;

Thanks for sharing your thoughts / ideas.

 

access policy
BIG-IP Access Policy Manager (APM)
security
tcl

2 Replies

Sort By
  • Jad_Tabbara__J1's avatar
    Jad_Tabbara__J1
    Icon for Cirrostratus rankCirrostratus
    May 23, 2017

    Hi Alain,

     

    You can do it differently.

     

    I think you should first make the "AD Query" and specify in the "Required Attributes" that you want to retrieve from the AD the "sAMAccountName" for example.

     

    After that in your branch rule "Passed" you add a "Variable Assign" block with the following entry "session.logon.last.username = AD attribute name sAMAccountName"

     

    Please let me know if you want me to clarify more.

     

    Regards

     

  • Anesh's avatar
    Anesh
    Icon for Cirrostratus rankCirrostratus
    May 23, 2017

    Try the below in if block:

    session.logon.last.username  = return { [mcget {session.ad.last.attr.sAMAccountName}]}