Which protocol is used to map usernames to user groups when User-ID is configured?

SAML (Security Assertion Markup Language) is for exchanging authentication and authorization data, primarily for single sign-on, not for direct user-to-group mapping for User-ID.

RADIUS (Remote Authentication Dial-In User Service) provides centralized Authentication, Authorization, and Accounting (AAA) but is not the primary protocol User-ID uses for group mapping from a directory.

TACACS+ (Terminal Access Controller Access-Control System Plus) is a proprietary Cisco protocol for AAA services, similar to RADIUS, and is not used by User-ID for group mapping from directory services.

LDAP (Lightweight Directory Access Protocol) is the standard protocol used by Palo Alto Networks User-ID to query directory services like Microsoft Active Directory. This allows the firewall to retrieve user group information based on identified usernames, which is then used in security policies for granular access control.