For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Juraj's avatar
Juraj
Icon for Cirrus rankCirrus
Jan 29, 2019

Just a quick thought from top of my head - you can write an iRule to extract the data you need, and store it in the session:

when ACCESS_ACL_ALLOWED {

  set ad_memberOf [ACCESS::session data get "session.ad.last.attr.memberOf"]

  ACCESS::session data set "session.custom.memberOfABC" [string match "*CN=ABC Users*" $ad_memberOf]
}

Then, you can return it in your SAML assertion via 

%{session.custom.memberOfABC}
, which will contain either 
0
or 
1
, depending on whether the user is a member of 
CN=ABC Users