getting errors while using "on demand certificate authentication with ad query"

I will respond to the comment in an answer so I can get proper formatting to see the config. After connecting to my APM with an On-Demand Certificate I looked at a sessiondump for the session and noticed that session.ssl.cert.subject was the variable that has the user details (CN=Administrator,CN=Users,DC=fr,DC=del,DC=corp) listed.

I then looked in LDAP browser to see exactly which search field that mapped to which in my case was distinguisedName.

I then updated the AD Query filter to have distinguishedName=%{session.ssl.cert.subject}.

This sends a request to AD that matches the subject on the certificate. After this is done you should see you have all the AD attributes populated and then can make rules based on that data.

If you still want to query on the sAMAccountName then you will have to do some string manipulation to get just Administrator out of the subject string.

Hope this helps.

-Seth