APM two factor authentication with one password field

Yes, you most certainly can do that. Keep in mind that currently all APM Auth functions assume/require that the value fo the password is set to session.logon.last.password variable. So, use iRules or Variable Assignment VPE action to save off original password, then extract token value, assign it to session.logon.last.password variable, run it through RSA Auth, then after successful RSA Auth set the AD password's value of the original field to session.logon.last.password, and run through AD Auth action.