F5 APM retrieve AD groups and resend using HTTP POST parameter

This results from a peculiarity of Tcl. The language doesn't really have built-ins and it doesn't really have blocks. Rather, it has commands and non-interpolated quoted strings. As such,

if

is a command (just like

split

or

HTTP::headers

). It is followed by a quoted block (the {}s, in Tcl, are really non-interpolating quoting operators, and not really block delimiters as they are in most languages). The quoted block may then be optionally followed by zero or more

elseif

literals (each followed by a quoted block) and zero or one

else

literals (followed by a quoted block). When a condition is met, the contents of the corresponding quoted block are evaluated.

Said another way, in Tcl, an

if

/

elseif

/

else

set is really a single statement. The statement command is

if

. The

elseif

and

else

are just parameters to this command. And because the newlines in the blocks are ignored by the parser (because they are inside of the non-interpolating {} quoting operators), the entire statement is effectively on one line.

As a side-effect of this, in Tcl you MUST cuddle an

if

/

elseif

/

else

block, as in:

if { ... } {
   ...
} else {
   ...
}

This is not allowed:

if { ... } {
   ...
}
else {
   ...
}

However, this trips up most programmers, so iRules (a Tcl dialect) allows non-cuddled

if

blocks. But if you add a comment between the control elements, this effectively inserts a newline. So, with the comments you have above, the parser "sees" this:

if { ... } 
elseif { ... } 
else { ... }

which it thinks is really three different commands:

if

,

elseif

and

else

. Only

if

is a command; the others are not (again, they are just parameters of the

if

command).

Okay, so that's really just a long-winded way of saying: you must move those comments inside the squirly braces ({}). 🙂