Forum Discussion

FritzHege_14885's avatar
FritzHege_14885
Icon for Nimbostratus rankNimbostratus
Feb 18, 2016

LDAP Group Resource Assign - not working - APM 11.6 HF6

I have a portal access policy that allows the user to authenticate into the portal but when the LDAP Group Resource Assign assigns the Group (LDAP Room 999999) the user receives "denied by access policy". The user is actually in a LDAP room versus a LDAP Group so my syntax may be incorrect.

 

This is what i have configured to use to try to use LDAP Group/Room: expr { [mcget {session.ldap.last.attr.roomNumber}] contains [mcget {session.aa.room}] }

 

It may be that LDAP rooms are not the same as LDAP Groups or i believe TAC was telling me to change the expression but not sure how to do that.

 

Any ideas are greatly appreciated.

 

APM
application delivery
devops

1 Reply

Sort By
  • Josiah_39459's avatar
    Josiah_39459
    Historic F5 Account
    Feb 19, 2016
    I would suggest using the sessiondump command or viewing the session report to make sure those variables are being set the way you expect. There is nothing wrong with the TCL expression you have written, so you need to verify those variables contain the values you expect them to.