Last Modified: Jul 15, 2026
Affected Product(s):
F5OS F5OS, F5OS-A, F5OS-C
Fixed In:
F5OS v2.0.0
Opened: Aug 13, 2024 Severity: 3-Major
There is no way to map multiple LDAP groups to a single F5OS role in older releases(eg: system aaa authentication roles role admin config ldap-group |(CN=netops)(CN=f5ops) )
Have multiple AD groups that should grant the same F5OS administrative role (e.g., a network ops team and an F5 ops team both needing admin access).
The ldap-group field under system aaa authentication roles supports only a single group value per role - there is no native OR/multi-group syntax.
None.
Support for many-to-one LDAP group-to-role mappings was added in F5OS v2.0.0. The fix allows multiple LDAP groups to map to a single F5OS role, so that users who belong to any configured group will be granted the appropriate role upon login.