Samantha decides to implement SAML2 auto-federation to link accounts on the service provider (SP) with...

Auto-federation is a feature in PingAM 8.0.2 designed to simplify the user experience by automatically linking an IdP identity to an SP identity without manual intervention or a specialized "linking" page.12

According to the PingAM documentation on "Link Identities Automatically with Auto-Federation":

Linking Mechanism (Statement B): Auto-federation does not rely on the SAML NameID. Instead, it uses acommon attribute valuefound in both the SAML assertion and the SP's local identity store. For example, if both systems share an "Email" attribute, the SP can be configured to use the mail attribute from the incoming assertion to search its own datastore. If a match is found, the accounts are linked. This is significantly more flexible than relying on NameID formats (disproving Statement A).

User Experience (Statement C): One of the primary benefits of auto-federation is that it supports a "Just-in-Time" experience. The useronly needs to log in to the Identity Provider (IdP). When they are redirected to the SP, the SP performs the attribute-based lookup and creates the session immediately. The user is never prompted to log in at the SP side just to "prove" who they are for the linking process (disproving Statement D).

Because auto-federation relies on matching attributes and only requires a single login at the IdP, the correct statements areB and C. This makes Option B the correct choice. This feature is particularly useful in Large-Scale B2B or B2C scenarios where pre-mapping thousands of users manually would be impossible.