Should be able to user username which is his user id in ssl certificate

I would imagine this would be highly dependent upon what they are trying to log into. Unless your using APM I wouldn't really recommend doing all that bigip side. If this is a webserver and you can parse out the user id from their certificate then instead insert a HTTP header or cookie and let the backend server consume that with the webform only allowing a password to be entered.