Loadbalancing based on group membership

Hi,

 

 

I have a customer who wants to LB based on group membership.

 

Using sample in http://devcentral.f5.com/wiki/default.aspx/iRules/AUTH__response_data.html, I have created my rule, but it has been failing...

 

From tcpdump and log file, it seems like the authentication itself is success and group membership is sent to Big-IP, but somehow not working.

 

 

When RULE_INIT {

 

set tmm_auth_subscription "*"

 

}

 

when AUTH_RESULT {

 

log local0. "result is [AUTH::status]"

 

array set auth_response_data [AUTH::response_data]

 

set ldap_group [lindex [array get auth_response_data ldap:attr:isMemberOf] 1]

 

if { $ldap_group eq "CN=Sales,DC=rose,DC=lab" } {

 

log local0. "hit 197"

 

use pool iis197

 

} elseif { $ldap_group eq "CN=Tech,DC=rose,DC=lab" } {

 

log local0. "hit 240"

 

use pool iis240

 

}

 

}

 

 

Has anyone done this successfully?

 

If so, could you provide working example?

 

 

TIA,