The vSphere Client only seems to allow access based on the permissions of the inventory objects. The Web Client however authenticates against SSO (i.e. allows user access for all configured Identity Sources), but it will only show the inventory objects the user has permissions for.
André