Splunk alone can support using AD as an authentication store. Which, of course, requires you to log in a second time using the same authentication data. But currently, the only supported way to do "true" single signon (where you only enter your login credentials once) is via a proxy server. That proxy server has to know how to interact with your single signon environment, and pass along the right HTTP header information to Splunk.
Most single-signon solutions for web applications require some type of web server plugin module to interact with the single-signon infrastructure. (This is how CA Siteminder works) That plugin has to take care of validating your user's SSO session cookie and pushing them off to a credential collector (log-in screen) if they don't have a valid one. These type of modules just don't exist for Splunkweb, so a proxy is needed to help glue it together.
There's no reason why that proxy shouldn't be able to exist on the same machine as Splunk. And, there's no Splunk-specific reason it can't be Squid -- provided you can get Squid to interact with your SSO infrastructure and pass along the proper headers. I've never used Squid in this way, and don't know if it's possible.
