Custom APPid based on user login

[SDorsey]

I am working with a client in an interesting situation..

We are basically needing to limit sections of the network where certain users and login to a web server. For example, only admins can login from zone1 and only users can login from zone2. The application on the web server is not a custom one built by the client but there is no current ID for it in the app-id db.

Currently, we would like to make the policy decisions based on app.. and have a separate ID based on admins or users.

I created an APP-ID for the application itself and tested it; it works! I also checked "Continue scanning for other applications".

Next, I used a proxy to monitor the packets and found that the username is submitted via HTTP PARAMS. So, I cloned the original APP-ID and made a new one (we will call it App-User). I added an AND condition to the original signature and it looks for:

Context: http-req-params

pattern: user (I have also tried username=user).

Qualifier is http method = POST.

After committing this.. the PAN IDs the traffic as the original APP-ID but does NOT change the app identified once someone sends posts requests with the specific username identified.

Will this not work in the manner I think it would? Any better suggestions?

FWIW: I don't have to create an AND rule for each user. The user base all share a generic ID for this system.