For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

Thrillseeker_12's avatar
Thrillseeker_12
Icon for Cirrus rankCirrus
Jan 23, 2017

How to get group name CN from session.ad.last.attr.memberOf ?

Hi all,

 

When I use the session.ad.last.attr.memberOf variable the group values are like:

 

| CN=webaccess,CN=Users,DC=mydomain,DC=com |

 

The question is how can I strip the first group name CN part from this string in a APM access policy using the variable assign element? So in the example above I only need CN=webaccess in the end.

 

Thanks a lot for your help Thrillseeker

 

BIG-IP Access Policy Manager (APM)
security

5 Replies

  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Jan 24, 2017

    Hi,

     

    you can use this code:

     

    session.ad.last.attr.memberOfLite

if { [info exists "groups"] }{unset groups;};
foreach value [mcget {session.ad.last.attr.memberOf}] {
regex {(CN=[^,]+)} $value CNFull CNValue;
lappend groups $CNValue;
unset CNFull;
unset CNValue;
};
return $groups
  • JG's avatar
    JG
    Icon for Cumulonimbus rankCumulonimbus
    Feb 13, 2017

    Stanislas' works with spaces in CN, for I have just tested it with tclsh. If you are running v11.6.1, there is an issue "512130-4 : Remote role group authentication fails with a space in LDAP attribute group name", which has been addressed in HF2 that's just been released on the weekend. See its release notes.

     

  • brad_11480's avatar
    brad_11480
    Icon for Nimbostratus rankNimbostratus
    May 24, 2017

    This seems that it might address the issue I'm trying to solve.

     

    I set up a SAML/SSO and they want me to provide the list of AD groups. so I'm sending them the session.ad.last.attr.memberOf array in the response.

     

    But this contains much, much, more than the service provider needs or probably should be shared with them.

     

    It looks like this code will go through each entry of the array and creating a modified result. So if I add the check to see if it matches the type of membership string they are looking for I could limit it to only those?!

     

    I think it would be better if the AD request could be filtered to only return to me those items, and if that is possible it would be preferred, but I haven't found anything to do that type of operation (and would be grateful if there is someone who knows if there is).

     

    Basically want to return a modified result which is the same as the session.ad.last.attr.memberOf array with only the array members that match. Any ideas? Go! (and thanks).

     

    • brad_11480's avatar
      brad_11480
      Icon for Nimbostratus rankNimbostratus
      May 25, 2017

      figured a good method for a filtered list:

      set list "|";
 foreach element [split [mcget {session.ad.last.attr.memberOf}] "|"] {
   if { $element contains "XYZ"}{ append list "$element | "; }
 }
 return $list;
`
      

Returns all groups that contain string XYZ

Now adding some of the logic above to limit the return to only CN= of each group entry:


      `  set list "|";
  foreach element [split [mcget {session.ad.last.attr.memberOf}] "|"] {
   regexp {CN=([^,]+)} $element CNFull CNValue;
     if { $CNValue contains "IS&T"}{ 
       append list " $CNFull |";
     }
  }
  return $list;

      (or append $CNValue if the CN= isn't wanted/needed in the resulting list).