Load Balance Decision Based on AD group or ID

First APM has Single Sign-On (SSO) features so a user could login through APM and then could automatically be signed into the backend application.

This would allow you to authenticate and query LDAP within the APM profile and then a simple iRule to select the correct Pool or Node to forward traffic too.

If you do not want to use APM then SIDEBAND connection or write an iRule LX solution.

Checkout LDAP Query From An iRule and/or Use APM With Non-HTTP Services for some help on doing the LDAP look up from within an iRule using Sideband.

From within an iRule LX you will simply need an LDAP query module like NPM simple-ldap-search