OTP with Google Auth verfication

Hi I was wondering if anyone could help me to config the AD query policy - i need to use the google OTP ,the i rule doesnt work for me its always Fallback- i think i neded to add for the query the user id. When i fill the search filter in the query with (sAmAccountName=%{session.logon.last.*}) i get - "No Google Auth Key".

i follow this link https://devcentral.f5.com/articles/two-factor-authentication-with-google-authenticator-and-apm

Thanks

Eyal