Redirect to external website through APM based on AD group membership.

I was able to find a solution to this using an iRule.

when ACCESS_POLICY_COMPLETED { 
                    set workfront_redirect ""
                            set memberOfList [split [ACCESS::session data get session.ad.last.attr.memberOf] "|"]

                            foreach x $memberOfList {
     if { [class match [string trim $x] equals workfront_datagroup]} {
        set workfront_redirect "true"
                                            }                                              
                            }

            if { $workfront_redirect eq "" } {
                            ACCESS::respond 302 noserver Location "https://mrc.cr1.attasksandbox.com/login"
            } 
     }

I was unable to call HTTP::redirect from within ACCESS_POLICY_COMPLETED, that's why I had to use the workaround with a 302 response.