Pulling Group Attribute via Authentication Rules

Here's the response from one of our developers working in the auth area:

 

 

1) We do not authenticate to NIS+.

 

 

2) There are no currently scheduled releases with enhanced auth rules that have the ability to redirect to an error page. That said, a simple modification to the rule should allow this to happen quite easily. I am currently working on some auth enhancements, and I'll see if I can't figure out how to get that into an auth option. I think it makes the most sense to make a redirect page part of the auth profile. If the rule can get arguments from the profile, then we can write one rule that always redirects correctly.

 

 

3) Big-IP cannot currently pass information up from the bottom of the PAM stack. i.e. once a user is authenticated, no additional information (such as group affiliation, user attributes, etc.) is passed up to the BIG-IP to be used for authorization. However, I have written up an example of what I call "selective authentication". Using this method, you can authenticate users who are in a chosen group, have a certain attribute, etc.

 

 

I'm not sure if that will solve the problem this user has. However, again, we have a plan to do this in a future release.

 

 

Regards,

 

Loc