Sorry this isnt a more useful response, but....
It definitely can be done, I've seen it working at a client site. As for how you do it, im not so sure.
My Guesses: If you are only using the reportnet portal (and not using PPES, upfront, other products requiring security) - I would have thought that in Cognos Configuration for ReportNet, you would go to Local Configuration --> Security --> Authentication.
Right-Click on Authentication, choose 'New Resource', then choose 'Namespace'. Type a name, and choose 'LDAP'. Then for the new resource, add the namespace id, host and port, and the base distinguished name and reapply the config.
If you are using other cognos products that will need security (such as powerplay cubes etc), you could configure Cognos Access Manager to communicate with Tivoli, and then add the access manager namespace as a 'Series 7' namespace in cognos configuration:
Right-Click on Authentication, choose 'New Resource', then choose 'Namespace'. Type a name, and choose 'Cognos Series 7'. Then for the new resource, add the access manager namespace id, host and port, and the base distinguished name and reapply the config.
But.....I dont know how this relates to single signon.
There was a tiny mention of Tivoli in the 'Cognos Application Firewall Secure Deployment Guide' p. 41