Major healthcare firm uses a global view of ID to enable SSO to apps like Kronos—without disrupting the AD environment.