A small company is developing a new Internet-facing web application. The security requirements are: 1. Users of the web application must be uniquely identified and authenticated. 2. Users of the web…

OpenID allows users to authenticate via a trusted external identity provider such as Google or Microsoft, so each user is uniquely identified and verified without needing an account in the company's own directory services. Because the identity provider handles all credential storage and verification, no passwords are stored in the application code, satisfying all three stated security requirements simultaneously.

A shared TLS client certificate means every user presents the same certificate, making unique per-user identification impossible as required by requirement 1.

SAML with federated directory services requires users to exist in a federated identity store tied to an organizational directory, directly conflicting with requirement 2 that users will not be added to company directory services.

Kerberos requires users to hold accounts in a centralized directory such as Active Directory and is not designed for Internet-facing web application authentication, violating requirement 2.