AD query search filter

Question

I'm trying to use the AD Query Search Filter feature on APM and having some issues with it. Below is my search:&nbsp;
expr { [mcget {session.ad.last.attr.memberOf}] contains "CN=Test" }&nbsp;
I'm getting this error on the APM which seems to indicate a possible syntax error:&nbsp;
Session variable 'session.ad.last.errmsg' set to 'Bad search filter, base: dc=Testdomain,dc=INT, scope: 2, filter: expr { [mcget {session.ad.last.attr.memberOf}] contains "CN=Test" }'&nbsp;
Has anybody got this feature working?&nbsp;
Thanks&nbsp;

amolari · Answer

LDAP query filter are in LDAP format, not TCL.&nbsp;
Example:  (&amp;(st=WA)(title=*Engineer*))&nbsp;
other examples&nbsp;

markj_58101 · Answer

Thanks, I did try with the % also but that didn't work either:&nbsp;
&nbsp;
Still get the 'Bad search filter, in the logs. &nbsp;

lucas_thompson_ · Answer

Here's a Microsoft article on LDAP searchfilter formatting:&nbsp;
https://msdn.microsoft.com/en-us/library/windows/desktop/aa746475%28v=vs.85%29.aspx&nbsp;
This is a standard LDAP search filter. TCL code (mcget, contains, etc) doesn't go here, it goes into the "Branch Rules" area so that you can define your Policy Item outputs how you like.&nbsp;

michaelatf5 · Answer

From what I can tell, you are setting your search filter to a string, not a comparison.  So it has no way to filter.  SearchFilter = ().&nbsp;
https://msdn.microsoft.com/en-us/library/windows/desktop/aa746475(v=vs.85).aspx&nbsp;
For example, if you were searching for a user, you would use a specific attribute to compare (sAMAccountName=%{session.custom.samaccountname}).  As long as you enable memberOf in the query, it will retrieve the group memberships and auto populate the session.ad.last.attr.memberOf session variable for you.&nbsp;
If you are trying to make sure that the authenticated user is a member of a specific group, you would want to set a query filter to (memberOf=CN=Test....).  You could also just use AD Group Resource assign.&nbsp;
https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-authentication-single-sign-on-11-5-0/3.html&nbsp;

markj_58101 · Answer

Thanks to everyone for all the help which was great. Michael got me in the right direction, I needed to put my query under the advanced branch rules section. As everyone else pointed out as well, the search filter field is for the LDAP query. There is actually a pre-built in condition which allows you to do this which I didn't see before (because I was looking at the search filter field as I thought that's where I needed to put it)&nbsp;
Example below:&nbsp;
&nbsp;
&nbsp;
Michael, I have used the AD group resouce assign for other functions but for this I just wanted to verify if a user was in a specific group before that could access a specific resurce. Didn't want any dynamic allocation etc. &nbsp;
Thanks for all the answers from the other posters. &nbsp;

Forum Discussion

AD query search filter

6 Replies

Recent Discussions

BIG-IP DNS: Check Status Of Multiple Monitors Against Pool Member

Open Redirection Mitigation

F5Access | MacOS Sonoma

enable tls1.2 on management interface on F5 ltm running version 10.x

[ASM] - what is "Browser Challenge file" ?

Related Content

F5 logs - search query

How to search the latest security academic papers

Pool downtime query

iRule Processing query

In search of a security incident response system for the masses