Can APM proxy the External Logon page?

We're building an APM policy for a standard Full Webtop portal, but want the logon page to be "external", that is, not the F5 APM logon page.

 

The problem is that this page is internal, but this is an externally-facing VS. So if the user hits the VS for app1.company.com, they are redirected to logon.company.com - which is internal, and we really don't want to expose it. Even if we created a VPE path with a special landing URI, there is no way to get to the internal server until an APM session is created.

 

We don't want to duplicate the web page as hosted content because we have a standard "look and feel" for authentication, and don't want the maintenance issues with supporting two copies of the web page by two different organizations.

 

The only idea I've had so far involved writing sideband connections inside of an iRule, but this would require essentially creating a special purpose proxy just for this one page.

 

Anyone have any ideas?