You mention SAML but also that what you want to gain is having Windchill reference you AD groups. Depending on what you want to do with the groups SAML might not be required. so please explain a bit more ...
If it's just that you want user authentication to be handled with AD as the source for passwords and group membership it should be covered by the Windchill docs already
One thing SAML might provide is single-sign-on for simple browser access which might only require Apache and ADFS configuration using something like Shibboleth for the SAML relying party on Apache because Windchill out of the box relies on Apache for the authentication. See e.g. http://stackoverflow.com/questions/7256890/how-can-i-secure-tomcats-webapps-with-adfs-2-0-and-saml-sso
Note I have not tried setting SAML based sso up with Windchill though only done some reading on the topic. I don't know if there will be problems with special client side configurations (DTI, WGM and Java applets in the browser).
