APM pass through to SAML SP

I have what thought would be a common scenario but can't find a thread on this. I have an on-prem service that does SAML, we leverage Okta for SAML, which can work with no problem. But I still don't want to expose the on-prem webserver, I would like APM to sit in front of this and pass the SAML token back to the on prem SP.

I've looked at the F5 stuff on Okta and SAML but everything I see has big-ip as either the SP or IdP, neither of these will work. Is there a way I can leverage big-ip to secure this?