Which VMware Single Sign-On component issues Security Assertion Markup Language (SAML) tokens?

The VMware Security Token Service (STS) is the dedicated component within vCenter Single Sign-On that generates, signs, and issues SAML security assertion tokens to authenticated users. These tokens are then presented by clients to access vSphere services without re-authenticating, forming the core of the SSO trust mechanism.

The Administration Server handles configuration and management of SSO settings but does not issue SAML tokens.

VMware Directory Service (vmdir) is an LDAP-compatible directory that stores SSO configuration and user data, but it does not generate or issue SAML tokens.

The Identity Management Service resolves user identities against configured identity sources but does not produce SAML tokens - that function belongs exclusively to the STS.