Forum Discussion

jfb_329380's avatar
jfb_329380
Icon for Nimbostratus rankNimbostratus
Oct 12, 2017

Use session.ldap.last.attr.userPrincipalName in an iRule

Hello,

 

In an iRule, I want to compare the userPrincipalName fetched from LDAP with the DN of an SSL certificate.

 

I have successfully extracted the email address from the certificate in a variable. That part is working fine.

 

Now I'm not able to use the session variable called "session.ldap.last.attr.userPrincipalName" to do my comparison.

 

I tried this:

 

set myupn [ACCESS::session data get "session.ldap.last.attr.userPrincipalName"] log local0. "UPN VALUE is $myupn"

 

... but the variable $myupn remains empty.

 

For the sake of troubleshooting, in the above code, I tried to access session.logon.last.logonname, and in that case it works.

 

In the list of variables of the access policy, I see that "session.ldap.last.attr.userPrincipalName" is there and populated with the expected value.

 

How can I access the value of session.ldap.last.attr.userPrincipalName properly?

 

Thank you in advance.

 

Best Regards,

 

application delivery
LTM
security
  • Stanislas_Piro2's avatar
    Stanislas_Piro2
    Icon for Cumulonimbus rankCumulonimbus
    Oct 12, 2017

    Hi,

    are you sure the userPrincipalName is fetched by the LDAP query?

    I recommend to do this check with variable assign instead of irule.

    session.custom.result ==

    expr {[mcget {session.ldap.last.attr.userPrincipalName}] == [mcget {session.cert.UPN}]}

    this will return 1 if same value, 0 if different.