APM: Reauth required for different URL on same listener

Hi,

 

short question: I have an APM authentication policy bound to a listener. There is a Sharepoint published via the listener. If you connect to sp.acme.com, you get the login form and can access it afterwards.

 

The sharepoint has a default url "sp.acme.com" and if you upload a pic, it is stored in "pics.acme.com". The problem is, the pics are not shown properly as content on the sp-page. If you open the pic in another tab, you are redirected to the logon-page of "pics.acme.com". If you authenticate there, then the pic is shown properly.

 

So my question now is - how could I achieve a single-login for all pages/subdomains that are running on that listener, and not to have a login mask again.

 

Is there any guide to this? On SP directly (without F5 in between), this works properly.

 

I assume ther is something with the SSO/Auth Domains in the Access Profile?

 

Thanks in advance!