F5 Authentication with web application using CAC

We use a similar method, in the string to query you should have something like following:

an EXTRACTEDIPI iRULE

an Access Policy to call the event

and within the access policy a custom search string .. (orclsecondaryuid=%{session.custom.edipi})

The iRULE will looking something like this ..

    set EDIPI [string range [findstr [ACCESS::session data get session.ssl.cert.subject] "CN=" 3 ","] [expr [string last "." [findstr [ACCESS::session data get session.ssl.cert.subject] "CN=" 3 ","]] + 1] end]
    if { [string tolower $EDIPI] equals "blahblah" }  {
      set EDIPI [findstr [ACCESS::session data get session.ssl.cert.subject] "CN=" 3 "."]

      The CN = 3 is the important part, this is how many spaces from the period "." it will search for the requested information. You would set this to the email portion