For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

SteveD1979's avatar
SteveD1979
Icon for Cirrostratus rankCirrostratus
Oct 31, 2022

Sending APM AD Query groups as a header

Hi I'm setting up an APM with Kerberos auth that also needs to authenticate group membership to the applications.  They application owners also need to see which groups the users are members of to kn...
devops
Scot_JC's avatar
Scot_JC
Icon for Employee rankEmployee
Nov 20, 2022

Hi,

Such piece of code should work (HTTP_REQUEST_RELEASE is valid, too) and, taking for granted the group membership piece of data does not violate HTTP RFC (syntax, size, ...), I'd suggest we try we removing the directive "clientside".

Otherwise, the perRequest policies come with the "HTTP Headers" agents that should do just that!

  • buulam's avatar
    buulam
    Icon for Admin rankAdmin
    Jan 19, 2023

    Hi SteveD1979 did you have any feedback after this reply from Scot_JC  ?

    • SteveD1979's avatar
      SteveD1979
      Icon for Cirrostratus rankCirrostratus
      Feb 15, 2023

      No i still don't have this working.  Sorry I had other projects going on.  This is my irule right now and it will send all of the member of in CN=, DN=, DN= format.  The header is just too long.  I'm trying to figure out a way to split it with an irule or if i have to create a custom variable in the VPE and call that.

       

      when ACCESS_ACL_ALLOWED {
      HTTP::header replace USERID [ACCESS::session data get session.logon.last.username]
      HTTP::header replace GROUPS [ACCESS::session data get session.ad.last.attr.memberOf]
      }