Launching On Demand VPN when launching an app

I am new to F5 and we currently just purchased two 4000s appliances. Currently I have my mobile devices to check for a certificate, if the cert found, it prompts for a login page and checks against AD. This is my two forms of Auth and it works quite well. What I can't figure out is how to I keep that the same but allow on demand to still work. The problem I believe is the logon page but I have to keep that in there so I can carry the credentials for SSO. Ultimately, what I am looking for is the ability to launch the View Client on an Android or IOS device and have it check the Cert verify it is good then prompt for a username and that doesn't seem to work. It works fine if I am within safari and just connecting to the webtop but not when I am actually trying to form a tunnel. Thanks.