F5 is upgrading its customer support chat feature on My.F5.com. Chat support will be unavailable from 6am-10am PST on 1/20/26. Refer to K000159584 for details.

Forum Discussion

The-messenger's avatar
The-messenger
Icon for Cirrostratus rankCirrostratus
Feb 21, 2017
Solved

Add UPN to existing policy

I have an existing access policy - login page ---- ad auth --- sso. I need to add userprincipalname as a username option.   Do I add ad query before ad auth or add a branch rule to the login pa...
BIG-IP Access Policy Manager (APM)
security
  • The-messenger's avatar
    The-messenger
    Jul 21, 2022

     

    As Stanislas_Piro2 has pointed out in several threads...

    - Add LDAP/AD query to get samAccountName
    - Added a Variable Assign session.logon.last.username = expr { "[mcget {session.ldap.last.attr.sAMAccountName}]" }
    (I've never been able to get SSO-Credential Mapping to change the username to sAMAccountName)

    From here APM will work with the samAccountName,  just do AD Auth whatever else you need.

    Then I need to change the username back to UPN for the application.

     
     
     
     
     
The-messenger's avatar
The-messenger
Icon for Cirrostratus rankCirrostratus
Jul 21, 2022

 

As Stanislas_Piro2 has pointed out in several threads...

- Add LDAP/AD query to get samAccountName
- Added a Variable Assign session.logon.last.username = expr { "[mcget {session.ldap.last.attr.sAMAccountName}]" }
(I've never been able to get SSO-Credential Mapping to change the username to sAMAccountName)

From here APM will work with the samAccountName,  just do AD Auth whatever else you need.

Then I need to change the username back to UPN for the application.