Protocols: Radius, LDAP, SAML, OATH. Radius is great for internal use (ldap is more of a directory protocol than an auth, IMO) and the last two are designed for external/internet auth. Choose an internal protocol and then an external method. Limiting yourself in this way keeps it clean and helps you to learn.