LocalUser Attributes as Variables for Enforcement

[mharing]

I have a customer who wants to have administrative control over how many devices each individual user can use. We are using the LocalUser DB and will be doing user-based authentication. I created an attribute on Local User called "permitted device count". How do I reference that as a variable in Enforcement. 

Example:

Authentication: Unique Device Count GREATER THAN {%LocalUser:permitted device count} = Deny Access

I've used variables before, but having a hard time with this one.

Thanks.

[cappalli]

Do you see it available in the LocalUser namespace in an enforcement policy?

[mharing]

I have the ability to select it from Name, but need a way to reference the Value configured for each Local User. 

[cappalli · Accepted solution]

%{LocalUser:attribute}

[mharing]

Tried adding that, but it did not even recognize it. Do I need to make that an Authorization attribute for it to work? 

In Access Tracker, under Computed Attributes I see the configured value, but it doesn't appear to be matching or referencing it during the authentication.

I have it currently set to 0, but it allowed me access. 

Condition is Greater Than = Deny Access.

[cappalli]

Try and just use a role map and = to see if you can get it to match.

[mharing]

I got it working. I utilized the Authorization of unique-device-count and the value is the variable of Permitted Device Count in Local User. Thanks for your help!