APM Pool assign based on host header or URL path

You can definitely assign different pools via the VPE, for a variety of reasons, but I believe an iRule is the only way to dynamically assign different SSO profiles. I would do something like this:

when ACCESS_ACL_ALLOWED {
    switch -glob [string tolower [HTTP::uri]] {
        "/app1*" {
            app1_pool
            WEBSSO::select app1_sso
        }
        "/app2*" {
            app2_pool
            WEBSSO::select app2_sso
        }
        default {
            default_pool
            WEBSSO::disable
        }
    }
}

It goes without saying that each of the SSO profiles requires a set of information to use for the SSO process (ie. name, password, domain, etc.) and you must collect all of this information up front in the single access policy authentication process.