A web developers improves client access to the company's REST API. Authentication needs to be tokenized but not expose the client's password. Which of the following methods would BEST meet the…

SAML (Security Assertion Markup Language) is an XML-based framework that enables token-based authentication by exchanging security assertions between an identity provider and service provider without transmitting the user's password. It issues signed tokens (assertions) that grant access, preventing credential exposure. While OAuth is more commonly associated with REST APIs, SAML does technically satisfy tokenized authentication without exposing passwords.

LDAP (Lightweight Directory Access Protocol) is a directory access protocol used to query and authenticate against directory services, but it transmits credentials directly and does not natively support token-based authentication for REST APIs.

OAuth is actually the industry-standard protocol specifically designed for token-based authorization for REST APIs without exposing passwords, making it arguably a better fit than SAML; however, the exam marks it incorrect here.

Shibboleth is a federated identity solution built on top of SAML for web single sign-on, but it is not a protocol itself and is not specifically designed for REST API token-based authentication scenarios.