F5 APM Authentication: Active Directory Method

I'm assuming you are talking about AAA (frontend user auth, not SSO).

APM has two functions geared toward AD: AD Auth and AD Query. AD Auth uses the end user's credentials collected from a logon page and put into session.logon.last.username and session.logon.last.password, then transmits those via Kerberos to the specified AD server.

AD Query uses Kerberos to authenticate to an LDAP service on AD to issue queries. The creds from the AAA AD Server definition will be used. If it's empty, then the user's creds will be used.

I think this is covered pretty well in the manual, but you may want to review the APM Operations Guide which has a technical overview. If you feel like the information there is incomplete or confusing, please let us know and we'll update it as required:

https://support.f5.com/kb/en-us/products/big-ip_apm/manuals/product/f5-apm-operations-guide.html