Hi Andreas,
You can read up on the details for findstr here:
http://devcentral.f5.com/wiki/iRules.findstr.ashx
Basically, findstr is looking in the URI for the string "user=" and then skipping five characters forward from the first character of user= and reading up to the end of the URI or to the next &. It's trying to parse the value of the "user" parameter.
You could do this simpler using URI::query:
set user [URI::query [HTTP::uri] user]
if {$user ne ""}{
persist uie $user
}
If you're on v9 or v10, you can use a workaround for a bug in those versions:
set user [URI::query "?&[HTTP::query]" &user]
if {$user ne ""}{
persist uie $user
}
http://devcentral.f5.com/wiki/iRules.uri__query.ashx
Aaron