form sso not working

Deployment is APM+LTM, logon and authentication happen on APM, after that it pass to pool member which is a vmware accesspoint and further connect to a VMware connection server.

Currently the client-initiated form sso is not working, I'm able to locate the form should be in one URL.

GET /portal/webclient/views/web/home.html?v=3976975 HTTP/1.1

the response contains a form.

But it seems the form has no action? where it put those username/password to?

If i just replace username/password with %{session.sso.token.last.username} and %{session.sso.token.last.password}, it doesn't work, it seems need some more info.

If i initiate a session with fiddle, I can see my credential is passed through a POST to /broker/xml

POST /broker/xml HTTP/1.1: 
Accept: */*
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: https://ap.test.pss.com/portal/webclient/index.html
Accept-Language: en-US
Accept-Encoding: gzip, deflate
User-Agent: Mozilla/5.0 (Windows NT 6.1; Trident/7.0; rv:11.0) like Gecko
Host: ap.test.pss.com
Content-Length: 407
DNT: 1
Connection: Keep-Alive
Cache-Control: no-cache
Cookie: com.vmware.vdi.broker.location.id=479a25d4-ad86-449e-8b62-4cef5de9d225, maxAge=2147483404s, secure, HTTPOnly; LastMRH_Session=cf60c14d633d8537b0363910eb326d38; MRHSession=cf60c14d633d8537b0363910eb326d38; JSESSIONID=BFB1684B014ED279B16C936E4E8F78EE; clientInfo=eyJhY2NlcHRMYW5ndWFnZSI6ICJlbi1VUyIsICJjbGllbnRWZXJzaW9uIjogIjQuMS4wIiwgImxvZ0xldmVsIjogIjEiLCAiY2xpZW50SVBBZGRyZXNzIjogIjEwLjMzLjIzOC4xNzUsIDEwLjMzLjIzOC4yMDEiLCAiY29udGV4dFBhdGgiOiAiL3BvcnRhbCJ9; ACCESSPOINTSESSIONID=01889370-2994-48b2-9c5b-2985898cb7b4; F5_ST=1z1z1z1468378760z604800; ITO=; UID=; TID=; DID=; STI=; HID=; TCAT4pss.com1468378004801=1; CID=AgAAAP5/KR22Kr3zTqmSinRn3Bg=

windows-passwordusernamejackdomainTESTpasswordCisc01234

Even after that, there is some additional XML data (broker version, user-agent) to same URL.

Any direction on how to get this work?