The way I've tackled this type of issue in the past is to use Kerberos. You get you client machines set up to get their Ticket Granting Ticket on user login and then that can be used to connect to most relational databases. You then set up your IdP to support SPNEGO and then your users don't even interacts with the IdP in their web browser.

Excellent breakdown, this clearly illustrates why SSO is only half the story and PAM is essential for securing real privileged access.