SSO in webtop link only

You can only add SSO to webtop link if the destination of that webtop link passes through the BIG-IP (i.e. full tunnel VPN). In that case, you can create a VIP with the ip/port of the webtop link destination, disable arp, attach an access profile, and then attach the SSO you need to that vip (often called a "layered vip") to perform the necessary SSO.