APM Kerberos authentication

To complete Kevin’s answer

• AD auth authenticate user with session variables

  session.logon.last.username

  and

  session.logon.last.password

• AD Query request user attributes with LDAP filter

  sAMAccountName=${session.logon.last.username}

  except if you customize the filter in VPE AD Query box.

You can provision these variables with

• logon pages
• 401 response pages
• variable assign box
• irules

When working with clientside Kerberos, ntlm, saml or oauth, the password variable is not provisionned because it is not received by APM.