Forum Discussion

Poseidon1974's avatar
Poseidon1974
Icon for Cirrostratus rankCirrostratus
Jul 20, 2023

expression in an APM policy

H,I am newbi to F5 APM, I would like to know how to add an expression (OR) on APM, to check in two variables see the example below : 

(&(objectclass=person)(name=%{session.saml.last.nameIDValue}) (here need to  add second variable)   (|(memberOf=CN

Thanks, 

 

  • Two ways to accomplish this. Easiest, and you can add branch logic for additional logging or custom error messages to user, would be cascading expression checks. You want an OR? Have the first expression. Pass - point to macro that permits access. Fail - point to second expression. Second expression. Pass - point to macro that permits access. Fail - error message to user.

    Second way is your approach. This is more of an ldapsearch question. You are looking at standard ldapsearch syntax and not something that is F5 proprietary. Please take a look here:

    http://www.ldapexplorer.com/en/manual/109010000-ldap-filter-syntax.htm

    Test your lookup via ldapsearch, then implement on F5 using the same search filter.

     

  • Two ways to accomplish this. Easiest, and you can add branch logic for additional logging or custom error messages to user, would be cascading expression checks. You want an OR? Have the first expression. Pass - point to macro that permits access. Fail - point to second expression. Second expression. Pass - point to macro that permits access. Fail - error message to user.

    Second way is your approach. This is more of an ldapsearch question. You are looking at standard ldapsearch syntax and not something that is F5 proprietary. Please take a look here:

    http://www.ldapexplorer.com/en/manual/109010000-ldap-filter-syntax.htm

    Test your lookup via ldapsearch, then implement on F5 using the same search filter.

     

      • Leslie_Hubertus's avatar
        Leslie_Hubertus
        Ret. Employee

        Hey Poseidon1974  - I marked the reply from whisperer as the Accepted Solution. If it didn't actually help you, let me know and I'll change that - but this way other users can more easily find the answer they need. 🙂