A network engineer wants to deploy user-based authentication across the company's wired and wireless infrastructure at layer 2 of the OSI model. Company policies require that users be centrally…

SAML operates at the application layer (Layer 7) for web-based SSO and is not applicable to Layer 2 wired or wireless network access authentication.

WAYF (Where Are You From) is a discovery service used in federated web identity systems to route users to their home IdP and has no role in Layer 2 network authentication.

LDAP provides a hierarchical directory structure (supporting 'hierarchical trust' as stated in the requirement) and serves as the central user store from which authentication credentials and group/role memberships are retrieved. It natively supports workstations and mobile devices through directory-integrated authentication and is the backend typically queried by the RADIUS server to validate credentials.

RADIUS implements 802.1X authentication at Layer 2 of the OSI model for both wired (IEEE 802.1X port-based NAC) and wireless infrastructure, enforcing per-user network access policies. It integrates directly with LDAP to authenticate users centrally and can return vendor-specific attributes (VSAs) to enforce role-based VLAN or ACL assignments on switches and access points.

Shibboleth is a web-based SAML federation solution for application-layer SSO and does not participate in Layer 2 network access control.

PKI provides certificate infrastructure and can complement 802.1X (EAP-TLS), but on its own it is not a user management or Layer 2 authentication system with centralized role-based access control.