A financial services company is building a new customer-facing mobile application that must integrate with third-party partner APIs and also allow employees to access an internal legacy web portal. The identity architect must choose federation protocols. The mobile app requires lightweight token exchange with modern REST APIs and mobile-native flows, while the legacy portal only supports browser-based enterprise SSO with XML-based assertions. Which approach BEST satisfies both requirements?