Forum Discussion

Brandon_12607's avatar
Brandon_12607
Icon for Nimbostratus rankNimbostratus
Jan 23, 2019

Load Balance Decision Based on AD group or ID

Cisco Finess is new application to be load balanced in our environment.

 

They would like for us to LB to Server A or Server B based on AD Groups or User ID.

 

We looked at APM for a minute but the Business Side doens't want the users to have to login to the APM. Bascially a second login

 

So the Cisco Finess team is requesting we see if we have the F5 do a LDAP Query for this informantion.

 

To be honest I am little lost on this. In some of the forums, I see some Irules for Side band and others for ldap query.

 

We are running 13.1

 

application delivery
BIG-IP Access Policy Manager (APM)
iRules
  • Andy_McGrath's avatar
    Andy_McGrath
    Icon for Cumulonimbus rankCumulonimbus
    Jan 23, 2019

    First APM has Single Sign-On (SSO) features so a user could login through APM and then could automatically be signed into the backend application.

     

    This would allow you to authenticate and query LDAP within the APM profile and then a simple iRule to select the correct Pool or Node to forward traffic too.

     

    If you do not want to use APM then SIDEBAND connection or write an iRule LX solution.

     

    Checkout LDAP Query From An iRule and/or Use APM With Non-HTTP Services for some help on doing the LDAP look up from within an iRule using Sideband.

     

    From within an iRule LX you will simply need an LDAP query module like NPM simple-ldap-search