How to terminate a second APM session using the same MFA account with OTP

I have decided to stick with the original idea, after finding out that it is possible to manipulate the UUID. That was the missing piece of the puzzle.

Two variables are assigned in the policy:

1. After login step 1 (Radius username + OTP), custom variable otp_username is set with Custom expression expr { "[mcget {session.logon.last.username}]" }
2. At the end of the policy, the UUID is set with Predefined variables -> Group Per-Session variable -> Variable UIID, Custom expression expr { "OTP.[mcget {otp_username}]"}

The end result:

when ACCESS_POLICY_COMPLETED {
    if { [ACCESS::session data get "session.server.landinguri"] starts_with "/otp" }{
    	set radius_username [ACCESS::session data get otp_username]
       	set apm_cookie_list [ACCESS::uuid getsid "OTP.$radius_username"]
    	    for {set i 0} {$i < [llength $apm_cookie_list]} {incr i} {
                log local0. "uuid [ lindex $apm_cookie_list $i] is listed for Radius user $radius_username during session [ACCESS::session data get session.user.sessionid]"
        	}
    	    log local0. "Length of cookie list for Radius user $radius_username is now [llength $apm_cookie_list]"
    }
	
	if { ([ACCESS::session data get "session.server.landinguri"] starts_with "/otp") && ([llength $apm_cookie_list] >= 2)}{
    	set session_term [ACCESS::session data get -sid [lindex $apm_cookie_list 0] session.user.sessionid]
    	    log local0. "Selected session $session_term for radius user $radius_username for termination"
    	ACCESS::session remove -sid [lindex $apm_cookie_list 0]
    	    log local0. "session number $session_term terminated for Radius user $radius_username"	
    }
}

This is real complex and I may not be able to help but after the first authentication and saving the seesion variable otp_username and after the second authentication has passed did you try to change/rewrite session.logon.last.username with the value of variable otp_username with a variable assign agent? In a way to make session.logon.last.username after the second authentication to be the same like in the first authentication so the UUID to match what you want.

if this breaks something you can also try to use the ACCESS_POLICY_AGENT_EVENT not ACCESS_POLICY_COMPLETED and placing this event right after you saved otp_username. The ACCESS_POLICY_COMPLETED is when the policy is done so it has session.logon.last.username set to the second authentication, so this seem the issue from what you have written.

https://clouddocs.f5.com/api/irules/ACCESS_POLICY_AGENT_EVENT.html

This are my all ideas, if someone knows something else please share it.

Have you considered to use the iRule table function? See: table (f5.com). Build a table that links username to ssid. If the table entry already exists, you can get the ssid and terminate that session. You can also extend the tables so you have a relation between ssid, otp_username and ad_username.