Hi Pal, you shouldn't need to make any changes to the DBs when using SSO, I'd suggest you get the AD groups created and assigned as per the BP documentation for integrating with AD, otherwise you are setting yourself up for an administrative nightmare.
Regards, Steve