F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

Haara_212103's avatar
Haara_212103
Icon for Nimbostratus rankNimbostratus
Apr 13, 2016

Filter DC:s for use with APM authentication

Hello, we have an issue with ldap authentication in a multi domain forest and several Domain Controllers in restricted VLANs where the APM don't have access. Is there any way to filter which DCs that...
BIG-IP Access Policy Manager (APM)
security
Stanislas_Piro2's avatar
Stanislas_Piro2
Icon for Cumulonimbus rankCumulonimbus
Apr 25, 2016

Hi,

You can request global catalog to know which Domain request.

  • create a AAA LDAP server with Global catalog servers (port 3268)
  • create a LDAP query between Logon page and AD Auth

In LDAP query branches, use following expression to split tree for different domains:

expr {[string tolower [mcget {session.ldap.last.attr.dn}]] ends_with "DC=company, DC=local"

or 

expr {[string tolower [mcget {session.ldap.last.attr.dn}]] contains "DC=company" }