BOXI using kerberos gettig moved behind BigIP

Answering my own question.

Yes, set up an APM policy and perform Kerberos just like any other SSO KPT request. The trick with Business Objects is the set up on the BO server. Follow all the best practices from SAP on setting up for Kerberos on BO XI, but then add a obscure setting in the web.xml as below: idm.allowS4U true

Turns out BO sets allowS4U to disable by default. More helpful info at: http://wiki.scn.sap.com/wiki/display/Community/Configuring+SSO+for+Business+Objects+Infoview+with+BEA+Weblogic

Tom