I will give a brief walkthrough on the steps to implement security policies in a vCenter Single Sign-on (SSO or VSA Single Sign-on) deployment scenario using the vCenter Server Appliance (VSA) client.
In the current vSphere 5.1 release, VSA is not included in the vCenter Server Appliance standard installation media, so you'll have to add VSA's Download Archive (DAR) file manually. To install VSA, first you must download and extract the VSA package on your desktop and then run the Setup.bat file, which will create the folder structure and run the necessary setup steps, which will install all executables and required components needed for the application.
The next step is to set up user accounts for planning and configuration. The vSphere SSO Services customer or product administrator grants the user account with the user role objects, such as: Service Catalog, Plugin Admin, System Admin, High Availability Admin, and the Managed Objects and Managed Policies roles. Note that the user account must also be granted the permission to access the vCenter Appliance Server, the complete instructions to set up vCenter SSO are here: vCenter Server SSO Installation d2c66b5586