Hi there,
With this being a new build you may have setup SSO but still need to assign permissions to the vCenter- in this instance you may still be able to log into the web client (but not see any vCenters or inventories) but attempts to log in to the vSphere client with the same user will give you permission denied as you've seen.
Check the user has been granted permission to the vCenter object in the web client- you may need to log in as your SSO admin to do this (administrator@vsphere.local unless you changed the domain during install)
Hope that helps!
vM
-----------------------
VCAP-DCD / VCAP-DCA / VCP-CLOUD / VCP-DT / VCP5 / VCP4
-----------------------
vMustard.com