ABOUT DEVCENTRAL

DevCentral News Technical Forum Technical Articles Technical CrowdSRC Community Guidelines DevCentral EULA Get a Developer Lab License Become a DevCentral MVP

RESOURCES

Product Documentation White Papers Glossary Customer Stories Webinars Free Online Courses F5 Certification LearnF5 Training

SUPPORT

Manage Subscriptions Professional Services Professional Services Create a Service Request Software Downloads Support Portal

PARTNERS

Find a Reseller Partner Technology Alliances Become an F5 Partner Login to Partner Central

---

©2024 F5, Inc. All rights reserved.

Problem this snippet solves:

APM variable assign is a powerful tool to manipulate APM variable during policy evaluation supporting tcl code.

On Devcentral answers, there are lots of variable assignment done with irule event ACCESS_POLICY_AGENT_EVENT. \n

these snippets show how to do the same as irule without irule event.

Note : I wrote most of codes, some others are from threads I found in DevCentral Answers section.

How to use this snippet:

create a variable assign box in VPE, then Add new entry

• \n

  In left side,

  \n
  • let custom variable / unsecure default choice
  • set the new variable name (or name of the variable you want to change the value). you should use bold value above tcl code. for timeout changes, you must use bold value above tcl code.
  \n
• \n

  In expression :

  \n
  • let custom expression default choice
  • paste provided code
  \n

Username / Domain management

session.logon.last.username

extract CN from certificate subject and set it in username variable

set subject [split [mcget {session.ssl.cert.subject}] \",=\"]; \nforeach {name value} $subject {\n    if {[string trim $name] equals \"CN\"} { \n        return [string trim $value]; \n    } \n} \n

session.logon.last.username

combine username and domain variables

expr { \"[mcget {session.logon.last.domain}]\\\\[mcget {session.logon.last.username}]\" } \n

session.logon.last.ntdomain

extract NT domain name from logon name

if { [mcget {session.logon.last.username}] contains \"\\\\\" } { \n    set username [string tolower [mcget {session.logon.last.logonname}]];  \n    return [string range $username 0 [expr {[string first \"\\\\\" $username] -1}] ];  \n} else {  \n    return {}  \n}\n

one-line code

expr {[set username [string tolower [mcget {session.logon.last.logonname}]]] contains \"\\\\\" ? [string range $username 0 [expr {[string first \"\\\\\" $username] -1}] ] : \"\" }\n

session.logon.last.domain

static assignment from ntdomain

switch [string tolower [mcget {session.logon.last.ntdomain}]] { \n    \"domain1\" { return \"domain1.local\" } \n    \"domain2\" { return \"domain2.local\" }  \n    default { return \"default.local\" } \n} \n

session.logon.last.username 
Extract username name from logonname (full username from logon page even if split domain from username is checked)

set username [string trim [mcget {session.logon.last.logonname}]];\nif { $username contains \"\\\\\" } {\n     return [string range $username [expr {[string first \"\\\\\" $username] +1}] end ];\n} else { return $username }\n

session.logon.last.upn
Extract UPN value from Certificate X509Extension

set extension [string tolower [mcget {session.ssl.cert.x509extension}]];  \nreturn [string range $extension [expr {[string first \"othername:upn<\" $extension] +14}] [expr {[string last \">\" $extension] -1}] ];  \n

session timeout management

session.inactivity_timeout

Change inactivity session timeout based on a checkbox on the logon page (logon variable trusted)

if { [mcget {session.logon.last.trusted}] == 1 } { return {5400} } else { return {1800} } \n

one-line code (5400 seconds if condition before ? success, 1800 seconds else)

expr { [mcget {session.logon.last.trusted}] == 1 ? {5400} : {1800}}\n

session.inactivity_timeout

Change inactivity session timeout based on client type (iOS, Android and WindowsPhone : half of inactivity timeout configured in profile parameters)

expr { [mcget {session.client.platform}] == \"WindowsPhone\" || [mcget {session.client.platform}] == \"Android\" || [mcget {session.client.platform}] == \"iOS\" ? [mcget {session.inactivity_timeout}]/2 : [mcget {session.inactivity_timeout}] }\n

session.max_session_timeout

force to close the session à 17:00

expr { [clock scan \"17:00\"] - [mcget {session.user.starttime}] }\n

session.max_session_timeout

After a AD query which retreive attribute logonHours, force to close the session when user at the end of allowed logon hours

set maximumSessionSeconds 604800\nif {[set logonHours [mcget {session.ad.last.attr.logonHours}]] != \"\" && $logonHours != \"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF\"} {\n    #convert string to binary string\n    binary scan [binary format H* $logonHours] b* logon_hours_binary_string\n    # evaluate the number of seconds from last sunday\n    set time_from_sunday [expr {[clock seconds] - [clock scan \"last sunday\"]}];\n    # search in string next hours with 0 value\n    set current_index [expr {$time_from_sunday / 3600}];\n    # convert the index to number of seconds from last sunday\n    if {[set next_denied_index [string first 0 $logon_hours_binary_string$logon_hours_binary_string $current_index]] == $current_index } {return 0}\n    # evaluate number on seconds to disconnect time\n    return [expr { $next_denied_index*3600 - $time_from_sunday}]\n} else { return $maximumSessionSeconds}\n

Windows Info

session.windows_info_os.last.fqdn

search and return FQDN hostname in computer names list after windows Info Box

foreach x [split [mcget {session.windows_info_os.last.computer}] \"|\"] {\n    if { $x ends_with \".f5demo.lab\" } {\n        return $x\n    }\n}\n

session.windows_info_os.last.computer_name

search FQDN hostname in computer names list after windows Info Box, then return shortname (without domain name)

foreach x [split [mcget {session.windows_info_os.last.computer}] \"|\"] {\n    if { $x ends_with \".f5demo.lab\" } {\n        return [lindex [split $x \".\"] 0]\n    }\n}\n

Machine cert

To allow machine certificate revocation validation, add a variable assign with 2 following variables before OCSP or CRLDP boxes.

session.ssl.cert.whole

store machine certificate as it was user certificate

expr {[mcget {session.check_machinecert.last.cert.cert}]}\n

session.ssl.cert.certissuer

store machine certificate issuer as it was user certificate issuer

expr {[mcget {session.check_machinecert.last.cert.issuer}]} \n

HTTP auth returned cookie parsing

session.custom.http_auth_mycookie

extract from HTTP auth cookie list the cookie value of mycookie

expr { [lindex [regexp -inline {mycookie=([^;\\\\\\r]*)} [mcget session.http.last.response_cookie]] 1] }\n

replace portal or network access Webtop by full webtop if unsupported resource are assigned

Webtop can be:

• Portal webtop : define an internal web server as home page
• Network access Webtop : start automatically Network access when connected
• \n

  Full Webtop : display all assigned ressources in one page hosted on the F5.

  \n

  Some customers want to assign different webtop based on assigned ressources.

  \n
• \n

  one portal ressource only -> portal webtop

  \n
• one Network access ressource only -> Network Access ressource
• more than one portal ressource -> Full webtop
• more than one Network access ressource -> Full webtop
• RDP, Application tunnel, SAML ressources assigned -> Full Webtop

In Advanced ressource assign, the last assigned webtop is applied to the session. If the user is assigned non portal ressource (ex : RDP) and portal webtop, he will not be allowed to connect.

session.assigned.webtop

this code code is used if portal or network access webtop are assigned and number of resources is supported only with full webtop

set fullwt /Common/wt-Full;\nset wt [mcget {session.assigned.webtop}];\nset pa [llength [mcget {session.assigned.resources.pa}]];\nset at [llength [mcget {session.assigned.resources.at}]];\nset na [llength [mcget {session.assigned.resources.na}]];\nset rd [llength [mcget {session.assigned.resources.rd}]];\nset saml [llength [mcget {session.assigned.resources.saml}]];\nif {$rd || $at || $saml || ([expr { $pa + $na }] > 1)} {set wt $fullwt};\nunset fullwt;\nunset pa;\nunset at;\nunset na;\nunset rd;\nunset saml;\nreturn $wt;\n

one-line code. Don't forget to replace \"/Common/wt-Full\" with your own webtop full in expression.

expr { [llength [concat [mcget {session.assigned.resources.rd}] [mcget {session.assigned.resources.at}] [mcget {session.assigned.resources.atsaml}]]] || [llength [concat [mcget {session.assigned.resources.pa}] [mcget {session.assigned.resources.na}]]] >1 ? \"/Common/wt-Full\" : [mcget {session.assigned.webtop}]}\n

Same condition for Advanced resource Assign condition. This condition doesn't match with previous rules in the same Advanced resource assign. must be in a dedicated resource assign box.

expr { [llength [concat [mcget {session.assigned.resources.rd}] [mcget {session.assigned.resources.at}] [mcget {session.assigned.resources.atsaml}]]] || [llength [concat [mcget {session.assigned.resources.pa}] [mcget {session.assigned.resources.na}]]] >1}\n

For Kerberos SSO

when working with Kerberos SSO, 2 variable sources must be set:

• username : must be equal to user sAMAccountName
• \n

  domain : must be equal to user FQDN domain

  \n

  When working on access policy with multiple SSO method depending on the URI, Host header or some other parameters, you may have conflict on default SSO variables.

  \n

  For example, for Exchange :

  \n
• \n

  activesync SSO profile is basic with username format is NTDOMAIN\\username

  \n
• \n

  Autodiscover SSP profile can be NTLM with

  \n
  • username format is username
  • domain format is NTDOMAIN
  \n
• \n

  OWA SSO profile can be kerberos with

  \n
  • username : must be equal to user sAMAccountName
  • domain : must be equal to user FQDN domain like DOMAIN.LOCAL (different than NT Domain)
  \n

  default SSO variables are :

  \n
• \n

  session.sso.token.last.username

  \n
• session.sso.token.last.password
• session.logon.last.domain

to support multiple SSO on the same Access policy, I recommende to set new variables based on previous AD Query

session.krbsso.username

expr {[mcget {session.ad.last.attr.sAMAccountName}]}\n

session.krbsso.domain

expr {[mcget {session.ad.last.actualdomain}]}\n

Code :

No code

Problem this snippet solves:

APM variable assign is a powerful tool to manipulate APM variable during policy evaluation supporting tcl code.

On Devcentral answers, there are lots of variable assignment done with irule event ACCESS_POLICY_AGENT_EVENT. \n

these snippets show how to do the same as irule without irule event.

Note : I wrote most of codes, some others are from threads I found in DevCentral Answers section.

How to use this snippet:

create a variable assign box in VPE, then Add new entry

• \n

  In left side,

  \n
  • let custom variable / unsecure default choice
  • set the new variable name (or name of the variable you want to change the value). you should use bold value above tcl code. for timeout changes, you must use bold value above tcl code.
  \n
• \n

  In expression :

  \n
  • let custom expression default choice
  • paste provided code
  \n

Username / Domain management

session.logon.last.username

extract CN from certificate subject and set it in username variable

set subject [split [mcget {session.ssl.cert.subject}] \",=\"]; \nforeach {name value} $subject {\n    if {[string trim $name] equals \"CN\"} { \n        return [string trim $value]; \n    } \n} \n

session.logon.last.username

combine username and domain variables

expr { \"[mcget {session.logon.last.domain}]\\\\[mcget {session.logon.last.username}]\" } \n

session.logon.last.ntdomain

extract NT domain name from logon name

if { [mcget {session.logon.last.username}] contains \"\\\\\" } { \n    set username [string tolower [mcget {session.logon.last.logonname}]];  \n    return [string range $username 0 [expr {[string first \"\\\\\" $username] -1}] ];  \n} else {  \n    return {}  \n}\n

one-line code

expr {[set username [string tolower [mcget {session.logon.last.logonname}]]] contains \"\\\\\" ? [string range $username 0 [expr {[string first \"\\\\\" $username] -1}] ] : \"\" }\n

session.logon.last.domain

static assignment from ntdomain

switch [string tolower [mcget {session.logon.last.ntdomain}]] { \n    \"domain1\" { return \"domain1.local\" } \n    \"domain2\" { return \"domain2.local\" }  \n    default { return \"default.local\" } \n} \n

session.logon.last.username 
Extract username name from logonname (full username from logon page even if split domain from username is checked)

set username [string trim [mcget {session.logon.last.logonname}]];\nif { $username contains \"\\\\\" } {\n     return [string range $username [expr {[string first \"\\\\\" $username] +1}] end ];\n} else { return $username }\n

session.logon.last.upn
Extract UPN value from Certificate X509Extension

set extension [string tolower [mcget {session.ssl.cert.x509extension}]];  \nreturn [string range $extension [expr {[string first \"othername:upn<\" $extension] +14}] [expr {[string last \">\" $extension] -1}] ];  \n

session timeout management

session.inactivity_timeout

Change inactivity session timeout based on a checkbox on the logon page (logon variable trusted)

if { [mcget {session.logon.last.trusted}] == 1 } { return {5400} } else { return {1800} } \n

one-line code (5400 seconds if condition before ? success, 1800 seconds else)

expr { [mcget {session.logon.last.trusted}] == 1 ? {5400} : {1800}}\n

session.inactivity_timeout

Change inactivity session timeout based on client type (iOS, Android and WindowsPhone : half of inactivity timeout configured in profile parameters)

expr { [mcget {session.client.platform}] == \"WindowsPhone\" || [mcget {session.client.platform}] == \"Android\" || [mcget {session.client.platform}] == \"iOS\" ? [mcget {session.inactivity_timeout}]/2 : [mcget {session.inactivity_timeout}] }\n

session.max_session_timeout

force to close the session à 17:00

expr { [clock scan \"17:00\"] - [mcget {session.user.starttime}] }\n

session.max_session_timeout

After a AD query which retreive attribute logonHours, force to close the session when user at the end of allowed logon hours

set maximumSessionSeconds 604800\nif {[set logonHours [mcget {session.ad.last.attr.logonHours}]] != \"\" && $logonHours != \"FFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFFF\"} {\n    #convert string to binary string\n    binary scan [binary format H* $logonHours] b* logon_hours_binary_string\n    # evaluate the number of seconds from last sunday\n    set time_from_sunday [expr {[clock seconds] - [clock scan \"last sunday\"]}];\n    # search in string next hours with 0 value\n    set current_index [expr {$time_from_sunday / 3600}];\n    # convert the index to number of seconds from last sunday\n    if {[set next_denied_index [string first 0 $logon_hours_binary_string$logon_hours_binary_string $current_index]] == $current_index } {return 0}\n    # evaluate number on seconds to disconnect time\n    return [expr { $next_denied_index*3600 - $time_from_sunday}]\n} else { return $maximumSessionSeconds}\n

Windows Info

session.windows_info_os.last.fqdn

search and return FQDN hostname in computer names list after windows Info Box

foreach x [split [mcget {session.windows_info_os.last.computer}] \"|\"] {\n    if { $x ends_with \".f5demo.lab\" } {\n        return $x\n    }\n}\n

session.windows_info_os.last.computer_name

search FQDN hostname in computer names list after windows Info Box, then return shortname (without domain name)

foreach x [split [mcget {session.windows_info_os.last.computer}] \"|\"] {\n    if { $x ends_with \".f5demo.lab\" } {\n        return [lindex [split $x \".\"] 0]\n    }\n}\n

Machine cert

To allow machine certificate revocation validation, add a variable assign with 2 following variables before OCSP or CRLDP boxes.

session.ssl.cert.whole

store machine certificate as it was user certificate

expr {[mcget {session.check_machinecert.last.cert.cert}]}\n

session.ssl.cert.certissuer

store machine certificate issuer as it was user certificate issuer

expr {[mcget {session.check_machinecert.last.cert.issuer}]} \n

HTTP auth returned cookie parsing

session.custom.http_auth_mycookie

extract from HTTP auth cookie list the cookie value of mycookie

expr { [lindex [regexp -inline {mycookie=([^;\\\\\\r]*)} [mcget session.http.last.response_cookie]] 1] }\n

replace portal or network access Webtop by full webtop if unsupported resource are assigned

Webtop can be:

• Portal webtop : define an internal web server as home page
• Network access Webtop : start automatically Network access when connected
• \n

  Full Webtop : display all assigned ressources in one page hosted on the F5.

  \n

  Some customers want to assign different webtop based on assigned ressources.

  \n
• \n

  one portal ressource only -> portal webtop

  \n
• one Network access ressource only -> Network Access ressource
• more than one portal ressource -> Full webtop
• more than one Network access ressource -> Full webtop
• RDP, Application tunnel, SAML ressources assigned -> Full Webtop

In Advanced ressource assign, the last assigned webtop is applied to the session. If the user is assigned non portal ressource (ex : RDP) and portal webtop, he will not be allowed to connect.

session.assigned.webtop

this code code is used if portal or network access webtop are assigned and number of resources is supported only with full webtop

set fullwt /Common/wt-Full;\nset wt [mcget {session.assigned.webtop}];\nset pa [llength [mcget {session.assigned.resources.pa}]];\nset at [llength [mcget {session.assigned.resources.at}]];\nset na [llength [mcget {session.assigned.resources.na}]];\nset rd [llength [mcget {session.assigned.resources.rd}]];\nset saml [llength [mcget {session.assigned.resources.saml}]];\nif {$rd || $at || $saml || ([expr { $pa + $na }] > 1)} {set wt $fullwt};\nunset fullwt;\nunset pa;\nunset at;\nunset na;\nunset rd;\nunset saml;\nreturn $wt;\n

one-line code. Don't forget to replace \"/Common/wt-Full\" with your own webtop full in expression.

expr { [llength [concat [mcget {session.assigned.resources.rd}] [mcget {session.assigned.resources.at}] [mcget {session.assigned.resources.atsaml}]]] || [llength [concat [mcget {session.assigned.resources.pa}] [mcget {session.assigned.resources.na}]]] >1 ? \"/Common/wt-Full\" : [mcget {session.assigned.webtop}]}\n

Same condition for Advanced resource Assign condition. This condition doesn't match with previous rules in the same Advanced resource assign. must be in a dedicated resource assign box.

expr { [llength [concat [mcget {session.assigned.resources.rd}] [mcget {session.assigned.resources.at}] [mcget {session.assigned.resources.atsaml}]]] || [llength [concat [mcget {session.assigned.resources.pa}] [mcget {session.assigned.resources.na}]]] >1}\n

For Kerberos SSO

when working with Kerberos SSO, 2 variable sources must be set:

• username : must be equal to user sAMAccountName
• \n

  domain : must be equal to user FQDN domain

  \n

  When working on access policy with multiple SSO method depending on the URI, Host header or some other parameters, you may have conflict on default SSO variables.

  \n

  For example, for Exchange :

  \n
• \n

  activesync SSO profile is basic with username format is NTDOMAIN\\username

  \n
• \n

  Autodiscover SSP profile can be NTLM with

  \n
  • username format is username
  • domain format is NTDOMAIN
  \n
• \n

  OWA SSO profile can be kerberos with

  \n
  • username : must be equal to user sAMAccountName
  • domain : must be equal to user FQDN domain like DOMAIN.LOCAL (different than NT Domain)
  \n

  default SSO variables are :

  \n
• \n

  session.sso.token.last.username

  \n
• session.sso.token.last.password
• session.logon.last.domain

to support multiple SSO on the same Access policy, I recommende to set new variables based on previous AD Query

session.krbsso.username

expr {[mcget {session.ad.last.attr.sAMAccountName}]}\n

session.krbsso.domain

expr {[mcget {session.ad.last.actualdomain}]}\n

Code :

No code

Hi,

Very useful article. I am just not sure what is proper syntax when entering such code into Variable Assign for example.

I assume that it can be entered multi line - much easier to debug than when all entered in one long line.

But what are rules when entered multi line, when ; should be used at the end of line?

I wonder as well if commands like virtual, class can be used here - I doubt but maybe I missed something when testing.

Piotr

In some versions, when entered multi line it works fine but if we edit it later, the code is merge on one line.

; is a character which means that next words are not parameters of current command but a new command.

It doesn’t change behavior in multi lines code but prevent issues.

In variable assign, only native tcl commands are allowed. For example, getfield is not allowed.

Virtual command doesn’t make sense during policy evaluation which is out of request flow but in HTTP_REQUEST OR ACCESS_ACL_ALLOWED events

Hi,

Thanks for info. I am trying to create branch expresion to change flow based on Host in request. Tried to use such code:

expr { [mcget {session.server.network.name}] == \"form-ntlm.mbank.org\" }

but it fails, always fallback branch is used. Using Message Box before Branch test I can see correct value in this var.\nIf I use iRule to assign host header value to some custom session var and then perform the same expression selection is working correctly.

Is session.server.network.name some special kind of session var that can't be used for branch test?

Piotr

@Piotr : I use this expression for several customers and for my lab successfully!

are you sure this is the exact string (no special character or encoded character, uppercase / lowercase mismatch, ...)

Hi,

This is a very good topic but I am not very good in iRule...

I have a use case exemple :\nThe user is accessing the web site protected with APM, using http://myserver.com?myparam=mycontent\nOnce the user pass the authentication agent in APM, I need to insert \"mycontent\" into an APM session variable.

What is the iRule to extract the parameter content and put it in an apm session variable ?

Thank you

you can try this variable assign expression (this is not an irule but an expression you must set in variable assign box):

expr {[set id [lsearch [set params [split [lindex [split [mcget {session.server.landinguri}] ?] 1] \"&=\"]] myparam ]] == -1 ? \"\" : [lindex $params $id+1]}\n

Hi Stanislas,

I have found your solution of variable assign to terminate APM session on particular time.

set endhour 22;\nset endmin 18;\nset starthour [clock format [mcget {session.user.starttime}] -format %H];\nset startmin [clock format [mcget {session.user.starttime}] -format %M]; \nreturn [expr {( $endhour * 3600 ) + ( $endmin * 60 ) - ( $starthour * 3600 ) - ( $startmin * 60 )}]

Can we add date and month as well along with time in this format ? E.G. i want to terminate APM session on March 10, 2018 at 17:00. Can you please advise if this is possible and what will be the syntax?

This expression is the old one.

this code is optimized :

expr { [clock scan \"17:00\"] - [mcget {session.user.starttime}] }\n

and to add date information, you can use this

expr { [clock scan \"2018-03-10T17:00\"] - [mcget {session.user.starttime}] }\n

Stanislas,

I want to set the username to the CN in the session.ssl.cert.subject, BUT I just want a specific part of the CN, not the whole thing. my CN's look like this:

CN=LAST.FIRST.MIDDLE.1122334455

I just want the \"LAST.FIRST\" to be set to the session.logon.last.username

Additionally the entire cert subject has this format:\n(the \"X\" does not represent exact character count)

C=US, O=XXXX, OU=XXXX, OU=XXXX, OU=XXXX, CN=LAST.FIRST.MIDDLE.1122334455

Can you help?

Joe

@Joe Lupo, try this code:

set subject [split [mcget {session.ssl.cert.subject}] \",=\"]; \nforeach {name value} $subject {\n    if {[string trim $name] eq \"CN\"} { \n        return [join [lrange [split [string trim $value] \".\"] 0 1] \".\"]; \n    } \n}\n

the CN is split to a list with dot as separator (

split text \".\"

lrange list 0 1

join list \".\"