Cirrostratus
Cirrus
Are you asking of it's possible for the SSO to kick back in if the APM session is still in progress and the user wants to go back to Web Interface? That should be possible - try to go to SSO config and check "Successfull Logon Detection Match" option to None, and see if SSO works after user logs off WI and then goes back in.
Or are you asking to have users authenticated by the APM again after they log out? That might be more challenging - you can try to use an iRule, but you can't remove the session because it will kill all the associated ICA sessions. You can try to remove MRHSession cookie in the HTTP_RESPONSE event(something like HTTP::cookie remove MRHSession) or better yet, set the MRHSession cookie to a date in the past so that it would expire on the browser side. This way browser would be forced to start a new APM session when they try to go back into WI - and user will end up having mutliple different APM sessions.