LDAP resource assign not working - AMP VPE-

Which version you are trying? Any logs? webui.log anything?

Are you by chance not doing an LDAP query before the LDAP resource assign? In the absence of that query, the agent wouldn't know the group membership of the supplied user, and would exhibit the exact behavior you're describing.

A few things:

1. I don't know if there's official configuration instructions on this. Those seem to be missing.

    

2. The functionality is, in a nutshell, a resource assignment agent based on AD/LDAP group membership. You could certainly have done this before with branch rules and simple resource assignment, but this agent is intended to make the process more straight forward.

    

3. After a successful LDAP query, add the LDAP Group Resource Assignment agent. Click the Add New Entry button, and then manually add the name of a group as it would appear in the directory. With that, select any portal access, network access, webtop, remote desktop, static pool, etc. as required.

    

4. The search button that you're referring to is used within the UI itself, not to query AD/LDAP as you might have expected.

    

5. If it's still failing, you may need to take a closer look at a) what group membership data is being returned per user, and b) what you're looking for in the group assignment.

    

The search button searches within the UI - the list of already created objects. So if you had a large list of groups defined, the search command would essentially filter this list in the display. Perhaps not to useful with only a handful of objects created.

Bobby, what version of the big-ip software are you running? Did you ever hear back on your support ticket? I had an LDAP group resource assign working properly in 11.4.1 and 11.5.1 but it breaks in 11.6.0. I have a support case open as well and am waiting for word back so I'll try to remember to post here with what I hear.

The config is such that I do an LDAP query and LDAP auth, I have verified in variables that the memberOf attribute returns the group that I am using, and although the access policy completes it does not recognize the group names I put in the ldap group resource assign. Resources with no group load fine. Resources with a group don't show up regardless of membership.

Hi all, I have the same problem here with v11.6.0 HF4. It seems to be another bug of F5 :-( :-( A case is open at F5 and I will write the answer here when I get it.

Peter

hey guys - did this ever get resolved? if it did can someone post the syntax that was used to search for the LDAP group? I need to search on a LDAP room 999999, does anyone know the difference between LDAP room and LDAP group? it doesnt seem to be working for me and i am using 11.6 HF6.