getting errors while using "on demand certificate authentication with ad query"

Can you please provide the error you are receiving? You can have a different AD for the certificate and for the query, you just need to make sure that you have the query setup properly. My guess is you will need to modify the "SearchFilter" in the AD Query to use the correct session variable that has the username provided by the certificate.

-Seth

I will respond to the comment in an answer so I can get proper formatting to see the config. After connecting to my APM with an On-Demand Certificate I looked at a sessiondump for the session and noticed that session.ssl.cert.subject was the variable that has the user details (CN=Administrator,CN=Users,DC=fr,DC=del,DC=corp) listed.

I then looked in LDAP browser to see exactly which search field that mapped to which in my case was distinguisedName.

I then updated the AD Query filter to have distinguishedName=%{session.ssl.cert.subject}.

This sends a request to AD that matches the subject on the certificate. After this is done you should see you have all the AD attributes populated and then can make rules based on that data.

If you still want to query on the sAMAccountName then you will have to do some string manipulation to get just Administrator out of the subject string.

Hope this helps.

-Seth

.... please tell me what i have to use in search filter as well as in branch rule..below is my VPE.... evry time am getting the error "" Following rule 'fallback' from item 'AD Query' to ending 'Deny' """

You need to figure out wha's the best search and the sessions variable to check. Please see my example.

ldapsearch: (cn=Administrators)

Branch rule (Advanced): expr {[mcget {session.ad./Common/myPolicy_act_active_directory_query_ag.attr.member}] contains [mcget {session.logon.last.username}]}

Here I am checking the user belongs to Administrator group. Try to initiate a session and the go to Reports and there explore the session variables. You will find which one is the best for your case.

Also have a look to the operation guide, it is very helpful: https://support.f5.com/content/kb/en-us/products/big-ip_apm/manuals/product/f5-apm-operations-guide/_jcr_content/pdfAttach/download/file.res/f5-apm-operations-guide.pdf