Company XYZ uses an office model where the employees can use any open desk and plug their laptops in. They want to authenticate the end users using their domain username and password before allowing…

LDAP is a directory query protocol used to look up credentials but is not a network access control protocol and cannot enforce port-based authentication or carry segmentation policy attributes to the network device.

EAP is an authentication framework that must be encapsulated within a carrier protocol such as RADIUS to reach a network access server; it cannot operate independently as a network access authentication solution.

TACACS+ is designed for device administration, command authorization, and management plane access on network infrastructure, not for authenticating end-user workstations seeking data plane network access.

RADIUS integrates with 802.1X to authenticate end users via domain username and password against Active Directory, suiting a hot-desking environment where any port must validate the user. It also supports vendor-specific attributes such as VLAN assignment and Cisco TrustSec Security Group Tags (SGTs), which provide the per-user or per-group policy hooks needed for future macro or micro segmentation without a redesign.