How to keep only the value of "CN" part in session.ldap.last.attr.memberOf

Look at this article:

https://devcentral.f5.com/codeshare/apm-variable-assign-examples-1107

use this variable assign:

set group_name[split [lindex [mcget {session.ldap.last.attr.memberOf}] 0] ",="]; 
foreach {name value} $group_name{
    if {[string trim $name] equals "CN"} { 
        return [string trim $value]; 
    } 
}