APM Pool assign based on host header or URL path

I assume i can also do something as follows to use the host?

Just keep in mind that [HTTP::host] returns the Host header portion of the URL (ie. www.host.com), while [HTTP::uri] returns the URI portion of the URL (ie. /path/to/file.html). Your example was close, but to switch on the Host, you wouldn't add the URI pattern.

when ACCESS_ACL_ALLOWED {
    switch -glob [string tolower [HTTP::host]] {
        "ww1.*.com" {
            app1_pool
            WEBSSO::select app2_sso
        }
        "www2.*.com" {
            app2_pool
            WEBSSO::select app2_sso
        }
        default {
            default_pool
            WEBSSO::disable
        }
    }
} 

I notice that this is run on ACCESS_ACL_ALLOWED and i assume this means at the end of the policy being complete. Does this replace the resource assign action in the policy ? If so would there be any way to make something like this run after the user has logged and just create a session variable which could be used in a branching decision later on in the policy ? I'd rather use the VPE to assign rescources (if possible)

Yes for the pool selection, but not for the SSO selection. The ACCESS_ACL_ALLOWED event is synonymous with the HTTP_REQUEST event, but is triggered after each HTTP_REQUEST event and after the access policy is complete.

If I could create a session variable as part of an iRule it appears to me that the branching rules with in the VPE are quite limited. For example i can't see any way to use a session variable in a Branch rule. Any idea on if and how i can do that ?

You can certainly use session variables in branch conditions. For example:

expr { [mcget {session.custom.foo}] equals "bar" }

This would return a Boolean response that would (or would not) cause processing to follow the branch it was assigned to.