Forum Discussion
CirrusWhich variables to set in APM to authenticate against Active directory
For a VPE that I have I let the user enter their email address instead of the samaccountname or UPN. I do a look against AD to retrieve both attributes now I need to authenticate the user so I need to set one of the session variables. Currently I'm setting the following variable session.logon.last.username = expr { [mcget {session.ad.last.attr.sAMAccountName}] } but this seems like it is not doing the trick. I know that domain might be a factor in this but this is one of the confusing about authenticating in F5 which variables are used especially when you have split domain turned on and the optional of cross domain in the AD auth component.
Last time I did this I did it by trail and error and had a matrix Split domain | Cross domain session.logon.last.username
Any help would appreciated
2 Replies
- Kevin_Stewart
Employee
Are you by chance querying AD to find the SAM or UPN based on the mail attribute? If so, then you probably shouldn't enable split domain in the logon form.
- Present user with logon form and accept email address and password
- Query AD with mail=%{session.logon.last.username}
- Variable (re)assign session.logon.last.username with session.ad.last.attr.sAMAccountName
- Pass to AD auth
- Kevin_Stewart
The expr command will work here, but technically you should probably be using return.
return [mcget {session.ad.last.attr.sAMAccountName}]
