F5 APM || Multi domain support

If you have no logic to determine whether a given username is in domain a, b, or c, you have no choice but to query them all. Inefficient or not, it is your only option. You could store a username/domain database cache on the BIG-IP in the form of a datagroup and use an irule to lookup the correct domain, but you would be responsible for maintaining and keeping it current, and what happens if a given username is in multiple domains?

Just have fallback a go to b, and fallback b go to c. Fallback of c (failed all three) is Deny. All the rest are Accept. Yes it will be slower for b and slowest for c, but it is your only option given your requirements above.