A variable resource derives its values from ActiveDirectory or user session attributes and can be used to configure a single access rule for users and manage the resources.When using Session attributes it will replace the variable using attributes of the current user session and will query the AD server for user attributes when an AD attribute is defined as a variable.
1.Navigate to Resources ,click on New and select the type of resource to be defined.(IP range and subnet cannot be configured using variable). 
2.Click on variable and then Edit variables.
3.Create a new variable by clicking on New.
4.Configure Active Directory attribute and test connection for a user using a Realm configured with Active Directory authentication 
5.Verify the correct value is being returned and Save the variable.
6.Select the defined variable,save the resource and apply pending changes
The value for Variable Host will now be replaced with the value configured for ActiveDirectory attribute userWorkstations for the user.