Forum Discussion

Thrillseeker_12's avatar
Thrillseeker_12
Icon for Cirrus rankCirrus
Jan 23, 2017

How to get group name CN from session.ad.last.attr.memberOf ?

Hi all,   When I use the session.ad.last.attr.memberOf variable the group values are like:   | CN=webaccess,CN=Users,DC=mydomain,DC=com |   The question is how can I strip the first group na...
BIG-IP Access Policy Manager (APM)
security
brad_11480's avatar
brad_11480
Icon for Nimbostratus rankNimbostratus

This seems that it might address the issue I'm trying to solve.

 

I set up a SAML/SSO and they want me to provide the list of AD groups. so I'm sending them the session.ad.last.attr.memberOf array in the response.

 

But this contains much, much, more than the service provider needs or probably should be shared with them.

 

It looks like this code will go through each entry of the array and creating a modified result. So if I add the check to see if it matches the type of membership string they are looking for I could limit it to only those?!

 

I think it would be better if the AD request could be filtered to only return to me those items, and if that is possible it would be preferred, but I haven't found anything to do that type of operation (and would be grateful if there is someone who knows if there is).

 

Basically want to return a modified result which is the same as the session.ad.last.attr.memberOf array with only the array members that match. Any ideas? Go! (and thanks).

 

brad_11480's avatar
brad_11480
Icon for Nimbostratus rankNimbostratus
May 25, 2017

figured a good method for a filtered list:

set list "|";
 foreach element [split [mcget {session.ad.last.attr.memberOf}] "|"] {
   if { $element contains "XYZ"}{ append list "$element | "; }
 }
 return $list;
`


Returns all groups that contain string XYZ

Now adding some of the logic above to limit the return to only CN= of each group entry:


`  set list "|";
  foreach element [split [mcget {session.ad.last.attr.memberOf}] "|"] {
   regexp {CN=([^,]+)} $element CNFull CNValue;
     if { $CNValue contains "IS&T"}{ 
       append list " $CNFull |";
     }
  }
  return $list;

(or append $CNValue if the CN= isn't wanted/needed in the resulting list).