CirrusActive Directory Logon Hours and APM session timeout
Hi,
Not really a question but documenting here incase anyone else wants to reuse this code.
I was asked to create a VPN connection on our F5 that would only allow access during a users normal working hours. As this information is already store in Active Directory under "User Logon Hours" I decided to use this to calculate when to terminate the APM session. Obviously a user can't authenticate against AD outside of their logon hours, so all I needed to do was to calculate how long left the user has until their logon hours expire. I used the following code in a Variable Assign to update the "Maximum Session Timeout" value for APM.
if {[ expr { [mcget {session.ad.last.attr.logonHours}] != "" }] } {
Get the value from AD
set logonHours [mcget {session.ad.last.attr.logonHours}]
set default maximum session time
set maximumSessionSeconds 604800
set start of session times
set startHour [clock format [mcget {session.user.starttime}] -format %H]
set startTime [clock format [mcget {session.user.starttime}] -format %H%M]
set startDay [clock format [mcget {session.user.starttime}] -format %w]
set default session timeout
set secondsRemaining 1
set finishDay $startDay
set rolledOver 0
create array to store the binary list of permitted logon hours
array set daysofweek {}
for { set a 0} {$a < 7} {incr a} {
set hexHours "0x[string range $logonHours [expr 2+$a*6] [expr 7+$a*6] ]"
set hexHours "[string range $logonHours [expr 2+$a*6] [expr 7+$a*6] ]"
set daysofweek($a) [string cat [string reverse [binary format %08b "0x[string range $hexHours 2 3]"]] [string reverse [binary format %08b "0x[string range $hexHours 4 5]"]] [string reverse [binary format %08b "0x[string range $hexHours 6 7]"]]]
binary scan [binary format H* $hexHours] b* tmp1
set daysofweek($a) $tmp1
}
set value so that it forces entry into the loop
set finishHour 2359
while { $finishHour == 2359 && $secondsRemaining < $maximumSessionSeconds } {
set finishHour [string first 0 $daysofweek($finishDay) $startHour]
if { [ expr $finishHour == "-1"] } {
set finishHour 2359
incr rolledOver
}
incr secondsRemaining [expr [clock scan $finishHour] - [clock scan $startTime] ]
if { [expr $finishHour ==2359 ] } {
if { [expr $finishDay < 6 ]} {
roll over to following day
incr finishDay
} else {
except Sat needs reseting to Sun
set finishDay 0
}
we have rolled over days
so reset the time to midnight
set startTime 0000
set startHour 0
and give back the extra minute that we "borrowed" to make the time calculation work
incr secondsRemaining 60
}
If we have finally looped around a full week then we need to break out of the loop
if { $startDay == $finishDay && $rolledOver > 1 } {
set finishHour [string first 0 $daysofweek($finishDay) $startHour]
incr secondsRemaining [expr [clock scan $finishHour] - [clock scan $startTime] ]
break
}
}
return $secondsRemaining
} else {
return $maximumSessionSeconds
}This takes the blob from the the AD attribute logonHours and decodes it and then works out how many seconds it is from now until the next denied logon hour according to AD. We then set that number to the maximum session timeout, so that the APM will close the session when the user is denied access by AD.
Rob
