Forum Discussion
Marvin_129795
Nimbostratus
Dec 13, 2016F5 APM retrieve AD groups and resend using HTTP POST parameter
Dear all,
I am looking at a particular situation where an internal web server needs to know what kind of AD membership groups are assigned to a user that tries to login. The authentication only ...
- Dec 13, 2016
Yes this is fairly simple. Use LTM+APM mode, and AD Query / AD Auth in your Access Policy. Set the "start uri" parameter to your backend app's URI, and use forms-based SSO (server-initiated) to fill in the resultant session variables from your AD Query into your form parameter. The groups will be in the form of a pipe-delimited list of the group DNs that came back from the query.
Matt_Mueller_10
Nimbostratus
Dec 27, 2004
when HTTP_REQUEST {
if {[HTTP::uri] contains "/customer1"} {
pool Customer114.i
} elseif {[HTTP::uri] contains "/customer2"} {
pool Customer214.i
} else {
pool Defaulthomepage
return
}
if {[HTTP::uri] starts_with "/webcentral"} {
HTTP::uri "/archibus"
}
log local0.info
}
Please note the rule as I currently have it configured, also the log line. Is that correct? I tried placing the log line outside of the when HTTP_REQUEST brackets, but it said invalid command.
I apologize, but I have no idea where you mean by the following location, can I get to this in the web gui?
"Please note that these messages end up as entries in /var/log/ltm or as specified by /etc/syslog.conf."
Again to explain our setup, the customer would type in http://192.168.150.225/webcentral/customer1
Based on the iRule, the BIGIP would turn around and go to this address:
http://192.168.150.214/archibus
thanks for your help