Forum Discussion

Shane_Hickey_19's avatar
Icon for Nimbostratus rankNimbostratus
Apr 07, 2016

Custom session variable for filtered memberOf AD attribute

Can someone give me a pointer as to the best way to create a custom session variable that returns all AD groups that start with a certain string? I'm not sure if the best way to do it is with an LDAP query or with a TCL expression. We have some particular groups that all start with F5- and I'd like to only return those groups as a session variable.


6 Replies

  • Newbie here, so please excuse me for not understanding.


    thanks all for this post and answers! Took me a while to find this and it works great for me if I have multiple groups containing "XYZ". However, If I have only one group it appends the pipe in front and back of the single value. Was hoping to just return the single value.


    Any help would be great!


    Thank you


  • Sorry, I should have provided more information. We are actually passing these session variables as SAML attributes to another product (zscaler). And, it turns out that you can't have more than 8 groups on that device, so we need a way to filter them down to just the groups that are meaningful to the zscaler configuration.
  • You can use a Variable Assign box with an expression like this:

    set list "|";
    foreach element [split [mcget {}] "|"] {
    if { $element contains "Adm"}{
    append list "$element | ";
    return $list;

    I assigned it to a variable session.custom.myvar. You will need to modify your session variable accordingly but it should work.

  • Why would this be necessary? APM will cache all AD groups in the domain regardless of this filter.
    • brad_11480's avatar
      Icon for Nimbostratus rankNimbostratus

      Yes, perfect...


      set list "|"; foreach element [split [mcget {}] "|"] { if { $element contains "XYZ"}{ append list "$element|"; } } return $list;


      Returns all groups that contain the string "XYZ" in an abbreviated list.