I'm relatively new to web development and security and I'm looking to limit the access to my web app to specific companies (and/or IP addresses).
Authentication at the user level via username and password is not an option. I could set up a firewall and only allow traffic from certain IP addresses, but this doesn't seem like the most secure solution since someone could just spoof the IP.
Is there an auth pattern that would be able to handle this case? The end result would have all users belonging to a given organization having access to the app. Use a certificate or something like that?