Which of the following allows an application to securely authenticate a user by receiving credentials from a web domain?

TACACS+ is a Cisco-proprietary AAA protocol that separates authentication, authorization, and accounting over TCP, and is primarily used for device administration (e.g., network gear CLI access), not web-domain-based application authentication.

RADIUS is a UDP-based AAA protocol used primarily for network access authentication (e.g., VPN, Wi-Fi), and does not support the web-domain federation or token-based assertion model required for cross-domain application authentication.

Kerberos is a ticket-based authentication protocol used within a single trusted network domain (e.g., Active Directory), and is not designed to authenticate users across separate web domains or pass credentials between federated web services.

SAML is specifically designed for web-based single sign-on (SSO), allowing an Identity Provider (IdP) to authenticate a user and pass a signed XML assertion (token) to a Service Provider (SP) across web domains. This federated identity model means the application (SP) never directly handles the user's credentials - it simply receives and validates the SAML assertion from the trusted web domain IdP, making it the only option here designed for cross-domain web authentication.