Forum Discussion

Glenn_32974's avatar
Glenn_32974
Icon for Nimbostratus rankNimbostratus
Apr 17, 2014

LDAP resource assign not working - AMP VPE-

Hello Folks!   I´m building an access policy to assign resources based on group membership. I'm using the "LDAP resource assign" option available in the VPE, however it seems to work only when th...
BIG-IP Access Policy Manager (APM)
deployment
security
Kevin_Stewart's avatar
Kevin_Stewart
Icon for Employee rankEmployee
Apr 30, 2014

A few things:

 

  1. I don't know if there's official configuration instructions on this. Those seem to be missing.

     

  2. The functionality is, in a nutshell, a resource assignment agent based on AD/LDAP group membership. You could certainly have done this before with branch rules and simple resource assignment, but this agent is intended to make the process more straight forward.

     

  3. After a successful LDAP query, add the LDAP Group Resource Assignment agent. Click the Add New Entry button, and then manually add the name of a group as it would appear in the directory. With that, select any portal access, network access, webtop, remote desktop, static pool, etc. as required.

     

  4. The search button that you're referring to is used within the UI itself, not to query AD/LDAP as you might have expected.

     

  5. If it's still failing, you may need to take a closer look at a) what group membership data is being returned per user, and b) what you're looking for in the group assignment.