Problems with Kerberos and delegation account

I'll refer you to this thread for some more SSO configuration info:

https://devcentral.f5.com/questions/kerberos-and-ntlm-authentication-using-apm

btw - which type of user-name should I use in the SSO profile ? - SamAccountname or what attribute should I use ?

As described above, you can use the account's pre-Windows 2000 NETBIOS name, or a service principal name. If you're not doing any sort of cross-domain stuff, it might be easier to just use the NETBIOS name.

I do a LDAP lookup before I pass the name to the Kerberos SSO profile so I can use a arbitrary attribute from there.

You'll notice in the Kerberos SSO profile the username and realm source fields. The only thing you need to do from a user perspective is make sure these corresponding session variables are populated BEFORE the end of the access policy evaluation with a valid domain username and the domain realm respectively. If you don't populate the realm variable, it'll pull it from the SSO config (another cross-domain flexibility).