SSO software – where is symmetric key stored?

In SSO software (Oracle E-SSO …), I heard about (primary) key encrypting user’s credentials, but I can’t read anything about how this key is managed ?

When using smartcard, I can understand that this key is encrypted/decrypted using another key pair on the card, but when smartcard is not part of the scheme, how does it work ?