About session variable names

The name of a session variable consists of multiple hierarchical nodes separated by periods (.).

Note: Do not use the word .subsession in a session variable. It may be interpreted as a subsession variable.

Session variables for Active Directory authentication and query

Access Policy Manager names session variables in the following manner:

session.ad.<username>.queryresult = query result (0 = failed, 1=passed)
session.ad.<username>.authresult = authentication result (0 = failed, 1=passed)
session.ad.<username>.attr.<attr_name> = the name of an attribute retrieved during the Active Directory query. Each retrieved attribute is converted to a separate session variable.

Attributes assigned to a user on the AAA server are specific to that server, and not to Access Policy Manager.