APM OWA 2010 webful/webreadyl

Maybe one of the easiest thing would probably be something like this:

when ACCESS_ACL_ALLOWED {
    switch -glob [string tolower [ACCESS:data get session.ldap.last.attr.memberOf]] {
        "*groupa*" {
            pool groupa_pool
            WEBSSO::select groupa_sso
        }
        "*groupb*" {
            pool groupb_pool
            WEBSSO::select groupb_sso
        }
    }
}

The idea here is that, at the end of the access policy evaluation and every request afterwards, you'll switch on the group membership value obtained form the LDAP query, and then 1) send the request to a specific pool, and 2) select a specific SSO profile. The above is just an example, so your specific implementation might be different based on how you query LDAP and what you're looking for. In 11.4+ you can use the LDAP Group Resource Assignment agent in the VPE to select resources (like a pool) based on group membership, but you'd still have to use an iRule to select an SSO profile.