Forum Discussion
TBG_112407
Nimbostratus
NimbostratusCheck on AD group to give access
Hello,
I'm trying to make a Protected Configuration that checks if a user is a member of a certain Active Direcory Group, If they are member of that group it should show the resource.
Already tried to make a couple custom checks Based on the link below, but none of them seem to work.
http://devcentral.f5.com/wiki/default.aspx/FirePass/DynamicGroupSessionVariables.html
Made the custom check like this:
session.ldap.groupmapping.memberOf="Terminal Server Users"
I'm a member of that group in my active directory.
Is the above command correct or should i try a different one?
Thank you in advance.
Jeroen
--------------------------------------------------------------------------------------
Update:
Already found out i should be using session.ad.auth.memberof instead.
I enabled the advanced logging for session variables and it tells me this:
Session Variable %session.ad.auth.memberof%= ' CN=Terminal Server Users,OU=_Test,DC=DCC,DC=lan '
Made a custom check with :
session.ad.auth.memberof = "Terminal Server Users"
or
session.ad.auth.memberof = "CN=Terminal Server Users,OU=_Test,DC=DCC,DC=lan"
Both wont work.
Fuzz_31058I don't think this will ever work as a "Pre-logon" check. The Firepass does not know who the user is until after they have passed the check. I could be miss understanding what you are trying to accomplish. It might be possible to do this with 6.0.1 though. What version are you currently running and can you give a better use case.
TBG_112407It is not a pre-logon check, it is a custom protected resource.
What i am trying to do is the folowing:
I got a certain resource i want to limit to users who are only member of a certain domain group.
So i have made a Protected configuration, with a custom check.
session.ad.auth.memberof = "Terminal Server Users" (this should check if a user is member of that group)
But it turns out the firepass only gives the first group it finds (alphabet order) and not all groups the user is member off.
And therefor im afraid its not possible- Fuzz_31058Is it only a single resource? You could do this with the Dynamic Resource Group Mapping. Have you tried that it allows you to pick any AD group and assign it to a resource group. This could be done for multiple resource groups and AD groups. I think this will accomplish what you are looking for. Make sure you select the checkbox for dynamic resource group assignment on the master group.
HTH
Fuzz