Hi Alexander,
Yes that is possible, but not in an hitless fashion like SSO with the 5500 controllers. The access-points need to determine that their primary controller is down which will take at least 10~15 seconds (if you are going to use fast AP heartbeats). And all the clients need to re-authenticate. To answer your question; just configure an primary and secondary WLC on the access-point.
With the virtual WLC your access-points have to run in FlexConnect mode which has some drawbacks (just like the virtual WLC itself, comparing it to an physical WLC). But depending on your deployment, the virtual controller can be much cheaper and lift on the HA infrastructure in the already existing hypervisor layer in your datacenter.
It is also possible to do "local authentication" on FlexConnect AP's when the connection to the controller has been lost, which can be handy when the WAN link is instable. Maybe this feature is an better solution that just add an second WLC in the datacenter far away.
