Which two options should the Architect consider for authenticating the third-party app using the canvas framework?

Universal Containers (UC) is building an integration between Salesforce and a legacy web applications using the canvas framework. The security for UC has determined that a signed request from Salesforce is not an adequate authentication solution for the Third-Party app .

Which two options should the Architect consider for authenticating the third-party app using the canvas framework? Choose 2 Answers
A . Utilize the SAML Single Sign-on flow to allow the third-party to authenticate itself against UC’s Id
C . Utilize Authorization Providers to allow the third-party appliction to authenticate itself against Salesforce as the Idp.
D . Utilize Canvas OAuth flow to allow the third-party appliction to authenticate itself against Salesforce as the Idp.
E . Create a registration handler Apex class to allow the third-party appliction to authenticate itself against Salesforce as the Idp.

Answer: A,C