vCenter Single Sign-On is an authentication broker and security token exchange infrastructure. When a user can authenticate to vCenter Single Sign-On, that user receives a SAML token. Going forward, the user can use the SAML token to authenticate to vCenter services. The user can then perform the actions that user has privileges for.
Because traffic is encrypted for all communications, and because only authenticated users can perform the actions that they have privileges for, your environment is secure.
Starting with vSphere 6.0, vCenter Single Sign-On is part of the Platform Services Controller. The Platform Services Controller contains the shared services that support vCenter Server and vCenter Server components. These services include vCenter Single Sign-On, VMware Certificate Authority, and License Service. See vCenter Server Installation and Setup for details on the Platform Services Controller.
For the initial handshake, users authenticate with a user name and password, and solution users authenticate with a certificate. For information on replacing solution user certificates, see vSphere Security Certificates.
The next step is authorizing the users who can authenticate to perform certain tasks. In most cases, you assign vCenter Server privileges, usually by assigning the user to a group that has a role. vSphere includes other permission models such as global permissions. See the vSphere Security documentation.
