When running the AD Query access policy item, Access Policy Manager^® (APM^®) queries an external Active Directory server for additional information about the user. The AD Query item looks up the attribute memberOf to fetch the groups to which a user belongs and provides an additional option to fetch the primary group.

The AD Query item does not authenticate user credentials. To authenticate users, use another or an additional authentication item in the access policy.

A nested group is a group that is a member of another group. For example, group1 is a member of group3 and group4. A user, user1, that belongs to group1 and group2 also belongs to group3 and group4 through nesting.

Access Policy Manager^® (APM^®) supports password management for Active Directory authentication.

For Active Directory, Access Policy Manager^® (APM^®) converts an attribute value to hex only if the value contains unprintable characters. If the session variable contains several values, and one or more of those values is unprintable, then APM converts only those particular values to hex.

7ecc84a2.session.ad.last.attr.objectSid 58 /
 0x01050000000000051500000013fe8e97c03cd5b5ad04e2e255040000

7ecc84a2.session.ad.last.attr.memberOf 460 | 
CN=printable group,OU=groups,OU=someco,DC=sherwood,DC=labt,DC=fp,DC=somelabnet,DC=com | 
0x434e3d756e7072696e7461626c6520c2bdc2a12067726f75702c4f553d67726f7570732c4f553d66352 | /
c44433d73686572776f6f642c44433d6c6162742c44433d66702c44433d66356e65742c44433d636f6d | /
CN=Domain Users,CN=Users,DC=smith,DC=labt,DC=fp,DC=somlabnet,DC=com | /
CN=CERTSVC_DCOM_ACCESS,CN=Users,DC=smith,DC=labt,DC=fp,DC=somelabnet,DC=com | /
CN=Users,CN=Builtin,DC=smith,DC=labt,DC=fp,DC=somelabnet,DC=com | 

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. In the Per-Session Policy column, click the Edit link for the access profile you want to configure.
   The visual policy editor opens the access policy in a separate screen.
3. Click the (+) icon anywhere in the access policy to add a new item.
   Note: Only an applicable subset of access policy items is available for selection in the visual policy editor for any access profile type.
   A popup screen opens, listing predefined actions on tabs such as General Purpose, Authentication, and so on.
4. On the Authentication tab, select AD Query and click Add Item.
   A Properties popup screen opens.
5. From the Server list, select the Active Directory AAA server to query.
6. You can also set these options.

   Option	Description
   SearchFilter	Type a search filter. (Otherwise if left empty, the policy uses the default filter, sAMAccountName=%{session.logon.last.username}. As a result, the SearchFilter parameter is populated with the Subject Alternative Name from the current Active Directory session.)
   Fetch Primary Group	Enable this setting to populate the user's primary group in the session variables. This setting is optional.
   Cross Domain Support	Specifies whether AD cross domain authentication support is enabled for AD Auth agent. This setting is optional.
   Fetch Nested Groups	Enable to populate the memberOf session variable with user's membership in nested groups in addition to the groups to which the user belongs directly. Important: Access Policy Manager does not query for the primary group and add it to the memberOf attribute. You must manually look up the attribute memberOf as well as the primary group.
   Complexity Check for Password Reset	Enable this setting so that APM performs the password policy checks it supports.
   Max Password Reset Attempts Allowed	Select the number of times to allow a user to try to reset their password.
   Prompt user to change password before expiration	Set (N days) to prompt user to change the password before it expires. The default is none (disabled). This setting is optional.

7. Click Save.
8. Click Apply Access Policy to save your configuration.

1. On the Main tab, click Access > Profiles / Policies .
   The Access Profiles (Per-Session Policies) screen opens.
2. Click the name of the access profile that you want to edit.
   The properties screen opens.
3. On the menu bar, click Logs.
   The access profile log settings display.
4. Move log settings between the Available and Selected lists.
   You can assign up to three log settings that enable access system logging to an access profile. You can assign additional log settings to an access profile provided that they enable logging for URl request logging only.

   Note: Logging is disabled when the Selected list is empty.
5. Click Update.

1. In the AD server configuration, use the host name of the DC in the Domain Controller setting.

   apm aaa active-directory /Common/AD-IPv6 {
   admin-encrypted-password ".(.5(lEhJfN\\<^FaLGC0Bt8CG0KMfR\\9;coEKdIm=5@32II" 
   admin-name Administrator
   domain enterprise.lab.fp.mynet.com
   domain-controller win2008.enterprise.lab.fp.mynet.com

   The host name is win2008.enterprise.lab.fp.mynet.com in the example.
2. Update the system's global setting to include a remote host entry for the DC host name that was used in step 1 and map it to an IPv4 address as shown in this example.

   sys global-settings { 
   gui-setup disabled 
   hostname bigip2mgmt.lab.fp.mynet.com 
   mgmt-dhcp disabled 
   remote-host { 
   /Common/abc { addr 165.160.15.20 
   hostname win2008.enterprise.lab.fp.mynet.com 
   } 
   } 
   }

3. Create a pool with the DC IPv6 address as a member as shown in this example.

   ltm pool /Common/AD-IPv6-Pool {
   members {
   /Common/fd00:ffff:ffff:fff1:912e:cdfe:c884:2607.any {
   address fd00:ffff:ffff:fff1:912e:cdfe:c884:2607
   }
   }
   }

4. Create a wildcard TCP virtual server with these settings:
   1. Set the Destination IP settings to the IPv4 address that was used in step 2.
      That address is 172.31.54.99 in the example.
   2. For the Service Port setting, select * All ports.
   3. In the Configuration area, leave the Protocol setting at the default, TCP.
   4. Scroll down to the Source Address Translation setting and select Auto Map.
   5. Scroll down to the Resources area and select the pool that you configured previously from the Default Pool list.

   ltm virtual /Common/bigip2.lab.fp.mynet.com-tcp {
   destination /Common/172.31.54.99:any
   ip-protocol tcp
   mask 255.255.255.255
   pool /Common/AD-IPv6-Pool
   profiles {
   /Common/tcp { }
   }
   source-address-translation automap
   translate-port disabled
   vlans-disabled
   }

5. Create another similar virtual server, but for UDP traffic. (Set the Protocol setting in the virtual server configuration to UDP).

   ltm virtual /Common/bigip2.lab.fp.mynet.com-udp {
   destination /Common/172.31.54.99:any
   ip-protocol udp
   mask 255.255.255.255
   pool /Common/AD-IPv6-Pool
   profiles {
   /Common/udp { }
   }
   source-address-translation automap
   translate-port disabled
   vlans-disabled
   }

When the AD Query access policy item runs, it populates session variables which are then available for use in access policy rules. The tables list the session variables for the Active Directory access policy items and for a logon access policy item.

You might run into problems with Active Directory authentication and query processes in some instances. Follow these tips to try to resolve any issues you might encounter.