How do you filter a SAML Attribute

Hello,

 

I was looking for a documented way to send a subset of user groups in a SAML response. And here's what I found - https://communities.ca.com/thread/241696397view SAML assertions. Perhaps, you could find some helpful ideas here too.

 

Just a quick thought from top of my head - you can write an iRule to extract the data you need, and store it in the session:

when ACCESS_ACL_ALLOWED {

  set ad_memberOf [ACCESS::session data get "session.ad.last.attr.memberOf"]

  ACCESS::session data set "session.custom.memberOfABC" [string match "*CN=ABC Users*" $ad_memberOf]
}

Then, you can return it in your SAML assertion via

%{session.custom.memberOfABC}

, which will contain either

0

or

1

, depending on whether the user is a member of

CN=ABC Users