Hi,
I know this question was raised a bit in the past, but my guess is that it had no solution or answer.
I have a VIP which my users access leveraging Kerberos SSO through an APM policy....
it seems to be somehow a regression bug. I had in older 11 releases the same issue for users login with client certificates (username was being extracted from the certificate). At some point it was fixed.