SSO across multiple domains and group membership check

I'm not sure what you mean by "NULLing the session out" but we can avoid a bloated VPE as much as possible with the use of wildcards in the AD/LDAP query agent.

And yes, upon authentication and assignment of the webtop, only the assigned resources (based on on the memberof membership) will be available to the group and the ACL will be applied to those resources to further limit a perhaps broad resource assignment. I assume that this is what you mean by a users "allow list"?