getting errors while using "on demand certificate authentication with ad query"

You need to figure out wha's the best search and the sessions variable to check. Please see my example.

ldapsearch: (cn=Administrators)

Branch rule (Advanced): expr {[mcget {session.ad./Common/myPolicy_act_active_directory_query_ag.attr.member}] contains [mcget {session.logon.last.username}]}

Here I am checking the user belongs to Administrator group. Try to initiate a session and the go to Reports and there explore the session variables. You will find which one is the best for your case.

Also have a look to the operation guide, it is very helpful: https://support.f5.com/content/kb/en-us/products/big-ip_apm/manuals/product/f5-apm-operations-guide/_jcr_content/pdfAttach/download/file.res/f5-apm-operations-guide.pdf