For more information regarding the security incident at F5, the actions we are taking to address it, and our ongoing efforts to protect our customers, click here.

Forum Discussion

njseq_383851's avatar
njseq_383851
Icon for Nimbostratus rankNimbostratus
Apr 09, 2019

VPE Session Variables

Hi, I'm trying to use Session Variables in VPE for controlling resources through Domain Groups. IE: If a user belongs to VPNGroup1 then gets resource1 and if a user belongs to VPNGroup2 then gets resource2, but if user belongs to VPNGroup1 and VPNGroup2 then gets resource1.

 

I have the expressions: Resource 1 - expr {[mcget {session.ad.last.attr.memberOf}] contains "VPNGroup1" Resource 2 - expr {[mcget {session.ad.last.attr.memberOf}] contains "VPNGroup2" Resource 3 - expr {[mcget {session.ad.last.attr.memberOf}] contains "VPNGroup1" && ![mcget {session.ad.last.attr.memberOf}] contains "VPNGroup2"

 

So if a user belongs to those 2 groups it's always adding resource 1 + resource2 instead of just giving resource 1.

 

How can I fix it? What is missing?

 

Thanks.

 

NS

 

application delivery
BIG-IP Access Policy Manager (APM)

6 Replies

  • AMiles_377865's avatar
    AMiles_377865
    Icon for Cirrocumulus rankCirrocumulus
    Apr 09, 2019

    Hello Nuno,

    I think you need to add logic into your resource 2 assignment to make sure it isn't assigned if resource one has already been assigned.

    && ![mcget {session.ad.last.attr.memberOf}] contains "VPNGroup1"

    something like that. That way resource two will never be assigned if resource one was already assigned.

    Best of luck,

    Austin

  • youssef1's avatar
    youssef1
    Icon for Cumulonimbus rankCumulonimbus
    Apr 10, 2019

    Hi,

    try this:

    • Use case 1: G1 --> Ressource.1 

    expr {([mcget {session.ad.last.attr.memberOf}] contains "VPNGroup1") && !([mcget {session.ad.last.attr.memberOf}] contains "VPNGroup2)"

    • Use case 2: G2 --> Ressource.2

    expr {!([mcget {session.ad.last.attr.memberOf}] contains "VPNGroup1") && ([mcget {session.ad.last.attr.memberOf}] contains "VPNGroup2)"

    • Use case 3: G1 + G2 --> Ressource.1

    expr {([mcget {session.ad.last.attr.memberOf}] contains "VPNGroup1") && ([mcget {session.ad.last.attr.memberOf}] contains "VPNGroup1)"

    Regards

  • njseq_383851's avatar
    njseq_383851
    Icon for Nimbostratus rankNimbostratus
    Apr 10, 2019

    I'm getting this error also: Rule evaluation failed with error: can't use non-numeric string as operand of "!"

     

    And the expression was this: expr {[mcget {session.ad.last.attr.memberOf}] contains "VPNGroup1" && ![mcget {session.ad.last.attr.memberOf}] contains "VPNGroup2"}

     

  • youssef1's avatar
    youssef1
    Icon for Cumulonimbus rankCumulonimbus
    Apr 10, 2019

    You forget parentheses

    expr {([mcget {session.ad.last.attr.memberOf}] contains "VPNGroup1") && !([mcget {session.ad.last.attr.memberOf}] contains "VPNGroup2)"

  • njseq_383851's avatar
    njseq_383851
    Icon for Nimbostratus rankNimbostratus
    Apr 10, 2019

    tied that and it gave me: Rule evaluation failed with error: missing close-brace

     

    I thought that I also needed to close-parenthesis but when I put } and the end of the expression, after )" it gave me this:

     

    Rule evaluation failed with error: syntax error in expression "([mcget {session.ad.last.attr.memberOf}] contains "VPNGroup1...": looking for close parenthesis

     

    The expression is simple: expr {([mcget {session.ad.last.attr.memberOf}] contains "VPNGroup1") && !([mcget {session.ad.last.attr.memberOf}] contains "VPNGroup2)"}

     

  • njseq_383851's avatar
    njseq_383851
    Icon for Nimbostratus rankNimbostratus
    Apr 10, 2019

    BTW if you create a simple expression using AND or OR operators, it does not put the () in the Advenced expression builder Thanks!