We actually have to keep SSO enabled in order to use Federated access. I was hopeful about disabling lightweight when we started researching this, but it isn't an option for this particular case.