Forum Discussion
PK_Bhatia
Nimbostratus
NimbostratusClient ip address logging on failed ldap authentication
I need to write an iRule which tracks the authentication failures from Active directory. I was trying to use AUTH_FAILURE event but it gives me error "requires an associated AUTH profile on the virtu...
Kevin_Stewart
Employee
EmployeeI would concur on the point that anything you do in iRules is going to be more than you expected. LDAP is a binary protocol, so to be able to see inside an LDAP packet that you're proxying, you have to do some binary manipulation - not fun. Also take a look at this "LDAP proxy" iRule. At the very least it'll give you a sense of the complexity.
https://devcentral.f5.com/wiki/iRules.LDAPProxy.ashx
Of course, depending on your environment, you could potentially offload that LDAP auth to the F5 via the APM module, which would give you much greater visibility into the LDAP process itself.
