Forum Discussion
NimbostratusMatch Radius.Class attributes
We need to compare variables in the radius class attribute that are returned via an APM radius auth. The class attribute is stored in the APM in hex so I need to convert the hex to string.
I have tried
set e_fields [split [mcget {session.radius.last.attr.class}] "|"];
set strAceServer [expr { [lindex $e_fields 0] }];
set strAceServer [binary format c* $strAceServer];
return $strAceServer;
and
set e_fields [split [mcget {session.radius.last.attr.class}] "|"];
foreach field $e_fields {
if ($field contains "*ace*") {
return "YES";
}
};
returns the hex
set e_fields [split [mcget {session.radius.last.attr.class}] "|"];
return [expr { [lindex $e_fields 0] }]
Any help would be appreciated to sort out the code.
12 Replies
Jonathan_Archerapm 11.2.0 hf3- Kevin_Stewart
Employee
Try this:set e_fields [split [mcget {session.radius.last.attr.class}] "|"]; foreach field $e_fields { set hex [binary format H* [string range [string trim $fields] 2 end]];if { [string match -nocase "*ace*" $hex] } { return $hex } else { return "NO" }};
Three things:
1. The "contains" keyword is iRules-specific and doesn't work in VPE rules.
2. You needed H* for the binary format.
3. The hex value is stored with leading "0x" characters, but the binary format won't work with this, so [string range [string trim $fields] 2 end]] gets rid of them. 
Reddy1Altostratus
Hi Kevin,
The above is the irule or the reg exp on the VPE?
Thanks,
Reddy
- Kevin_Stewart
This is the code inside the VPE agent.
- Reddy1
Thanks Kevin, Do i require to add the Message box within the VPE after the login and add this code?
- Kevin_Stewart
Message Box is a response to the client, so not expressly required.
- Reddy1
Thanks Kevin , Can i use the Logging as place holder for this code?
If not do you mind to help where i can add this code in the VPE?
- Kevin_Stewart
This code goes in a variable assignment agent. Create a session variable (ex. session.radius.last.attr.class.evaluated), then put the VPE code in the right side block. The code will populate the session variable with either the evaluated her value, or the string "NO". You could insert a logging agent after this to send the variable to /var/log/apm (use %{variable} syntax in the logging agent), or you could send it back to the client in a message box agent. The logging agent is probably more practical.
- Reddy1
Thanks much Kevin! Let me try and keep you posted.
- Reddy1
Hi Kevin,
i did implement as per your suggestion. When i checked the logs, i see the value being blank. I have attached the config.
