Hi,
It is possible . i'm using Pam PTA to authenticate AD user from SSO application.
it works perfectly. the configurationis SSO app +> 389 + SSSD -> AD
As mentionned by Mark Reynolds use PAM PTA and filter with pamFilter .
Contact me if you need more information.