A third-party scheduling application needs to read users' corporate calendars through the provider's API. The company forbids users from giving their passwords to the application and wants access limited to calendar data and revocable by the user. Which technology BEST fits?
Select an answer to reveal the explanation.
Short Explanation
OAuth is the valet key: it lets the app drive your calendar without getting the key to your whole house. You consent, the app gets a limited token, and you can take it back anytime. SAML signs you in, but it doesn't hand the app delegated API access - classic trap.
Full Explanation
Open Authorization (OAuth) is a delegated authorization framework. The user is redirected to the authorization server, authenticates there, and consents to a specific scope such as reading calendars. The application then receives an access token limited to that scope, which it presents to the calendar API. The application never sees the user's password, and the user or administrator can revoke the grant without changing credentials. That matches every stated requirement. LDAP is a directory access protocol used to look up identities and attributes; it is not a mechanism for granting consent-based, scoped API access to calendar content, and binding to it typically involves passwords. SAML provides federated authentication, letting the application know who the user is so it can sign them in to its own interface; on its own it does not grant the application authorization to call the calendar provider's API on the user's behalf. A shared service account whose password is stored in the application grants broad access to everyone's data, cannot be scoped or revoked per user, and places a credential in a third party's hands. Exam caveat: OpenID Connect adds an identity layer on top of OAuth. Operational check: review the consent screen's requested scopes and confirm a revoked grant immediately stops API calls.