An administrator is configuring an identity source for Single Sign-On. The administrator will use the machine that Single Sign-On is running on, but does not want all users on the machine to be visibi

Active Directory (Integrated Windows Authentication) leverages the Kerberos ticket-based domain membership of the machine running SSO to authenticate AD domain users. Because it operates at the domain level rather than the local OS level, only AD domain accounts are visible to SSO - local machine accounts are not included. This satisfies the requirement to use the SSO machine as the identity source while hiding non-domain local users.

Active Directory as an LDAP Service requires a separately specified LDAP server hostname and credentials and does not use the SSO machine's own domain membership as its identity source.

OpenLDAP requires an external OpenLDAP directory server to be configured - it is not tied to the SSO machine's local or domain identity and introduces a separate directory dependency.

LocalOS exposes all user accounts from the local operating system of the machine running SSO, which directly violates the requirement of not making all users on that machine visible to SSO.