An organization would like to allow employees to use their network username and password to access a third-party service. The company is using Active Directory Federated Services for their directory…

LDAP/S is a directory access protocol used to query and manage directory objects, not a federation or SSO protocol, so it cannot facilitate cross-domain identity federation.

AD FS acts as a SAML Identity Provider (IdP), issuing signed SAML assertions to external service providers to enable cross-domain single sign-on. The third-party must support SAML to consume these assertions and trust the AD FS-issued token.

NTLM is a legacy Microsoft challenge-response protocol designed for internal Windows environments and does not support federated identity scenarios with third-party web services.

OAuth is an authorization delegation framework rather than an authentication federation protocol, and AD FS federation relies on SAML rather than OAuth for issuing cross-domain identity assertions.

AD FS authenticates users against Active Directory using Kerberos before issuing federation tokens, so the federated trust chain depends on Kerberos being supported as the underlying Windows authentication mechanism.