Can a single sign-on solution be used to share credentials between ExpressionEngine and LDAP/Active Directory?
This LDAP extension looks like a good place to start - the extension is older, but it looks like all the pieces are in place. You could build on this as needed.
It's relatively easy to roll your own SSO solution because signing a user into ExpressionEngine is fairly simple.
If you have the appropriate data, it's easy to create an ExpressionEngine user, create a relationship (I've typically done this using a new database table) and sign this user in based on the response from the API you're using.
I'm not familiar with the required effort when it comes to working with LDAP but if you dig into the ExpressionEngine member module source code you'll see how simple it is to sign a user in or instantiate a new user.