An administrator is configuring an identity source for Single Sign-On. The administrator will use the machine that Single Sign-on is running on, but does not want all users on the machine to be…

LocalOS adds all local operating system accounts from the machine SSO runs on, which directly violates the requirement that not all users on the machine be visible.

Active Directory as an LDAP service connects to a separate AD domain controller rather than using the machine SSO is running on, and requires manual LDAP configuration.

OpenLDAP is a third-party LDAP directory service and is not tied to the machine that SSO is running on, so it does not meet the requirement of using that specific machine.

Active Directory (Integrated Windows Authentication) leverages the domain that the vCenter SSO machine is joined to, using Kerberos-based authentication. Unlike LocalOS, it does not enumerate or expose the local machine accounts, so not all users on the physical machine are visible to SSO - only domain accounts are included.