Office 365 Logon Enhancement – Username Capture

Great post!

Slight modification if being redirected from mail.office365.com. This will capture the username if found and write it to the session.logon.last.username only if the URI and referrer are matched. You can then use this in VPE as described above to pre-populate username

when HTTP_REQUEST {
 if { [HTTP::uri] starts_with "/adfs/ls/" } {
      if { [HTTP::header exists "Referer"] && [HTTP::header "Referer"] contains "office365.com" } {
           set received_requesturl [HTTP::uri]
           log local0. "Starting GetURIUsername"
           log local0. $received_requesturl
           if { $received_requesturl contains "username="} {
                log local0. "requested URL has username"
                set username [URI::decode [URI::query $received_requesturl username]]
                log local0. "Username detected as $username"
           }
           unset received_requesturl
       }
 }
 }

when ACCESS_SESSION_STARTED {
if { [ info exists username ] } {
    ACCESS::session data set session.logon.last.username $username
    log local0. "Username set to $username"
}
}