You can create 2 APM policies and use SSO domain cookie. This will avoid authentication if user from app1 goes to app2 in same session or diffrent tab of same browser.
under domain cookie, type your site domain. e.g. example.com
that's ok for the authentication between the two VS, I managed to do it using one single APM policy and you're true the SSO domain cookie avoid user to be prompted
problem I can't fix is this one :
for one specific url on one of the two VS , and if user isn't member of a specific AD group,, I must reject the request but it has already been accepted by the APM ...
Okay. got it. yes, once user is already authenticated by APM, it won't evaluate APM policy for any other URL inside the application with default apm policy. You would need to use something like per request apm policy or step up authentication to re-evaluate for that one URL. You can also try with iRule to remove APM session ACCESS::session remove and then re-evulate.
to be honest, I haven't done this personally but following doc can provide some guidanace.
