APM joining the Domain

That's always an interesting question, and really depends on your definition of "joining the domain". In order for a typical *NIX platform to join a Windows domain, that usually requires creating an account in the AD and exporting the keytab from the AD and importing to the *NIX box. If that qualifies as "joining the domain", then yes, APM does indeed join the domain in the client side Kerberos (AAA) config. You create an AD service account, export the keytab, import the keytab to APM as a AAA object, and then configure Kerberos Authentication in the visual policy with that AAA object. The beautiful thing about this process is that APM could essentially join multiple domains.

is there an article about that ? will this help in adding a default suffix to fqdns ? i.e: if i am trying to access or resolve mywebpage the APM will add a default suffix to it to be mywebpage.company.com ?

You can add DNS suffixes in the DNS properties of the BIG-IP, under the "DNS Search Domain List" option.

Hi, more documentation could be found on our support page [https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-authentication-single-sign-on-12-0-0.html] - according to your request, please have also a look on [https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/apm-authentication-single-sign-on-12-0-0/10.htmlconceptid].