Irule to block specific users from login to back office system

It seems like the error is in your username assignment. It doesn't seem to be getting the username properly, at least when I tested it. I wrote this segment of code to grab the value of whatever comes after 'username=' in a urlencoded post.

log local0. "Payload: [HTTP::payload]"
set payload [string range [HTTP::payload] [string first username [HTTP::payload]] [string length [HTTP::payload]]]
set findex [string first = $payload]
set lindex [string first & $payload]
if {$lindex eq -1}
{
    set lindex [string length $payload]
    incr lindex
}
log local0. "Modified Payload: $payload"
set username [string range $payload [incr findex 1]  [incr lindex -1]]

I added in some error handling in case the username value was in different places in the payload. Hopefully, this will solve your problem if you replace your username variable assignment with it.

If you have any more questions, I am sure I can help.