I need to use the SharePoint 2007 Single Sign-on service for the purposes of InfoPath Form authentication on Web Services. I went through the Microsoft installation steps and immediately got
You do not have the rights to perform this operation.
A bit of googling later, and I found that this isn’t uncommon.
Looking at Dave Wollerman’s post on the subject made me check everything again.
In the end the missing link (that I failed to read) from the Microsoft doc was simply that the Single Sign-on Windows service needed to be running with a domain account (I chose the same as the administrator accounts), and it then worked fine.