What is 'federated identity' and how does it differ from traditional application authentication?

• A.Federated identity stores each user's password in a shared directory (an LDAP server used by several applications), rather than keeping a separate credential store in each application; the applications query the directory on each login
• B.Federated identity allows users to authenticate using an identity from a trusted external provider (Google, Microsoft, Okta) rather than creating a separate account in each application; the application trusts the identity provider's authentication assertion
• C.Federated identity lets users sign in with a hardware token (a YubiKey, a smart card) rather than a password in each application; the applications trust the token vendor's certificate chain
• D.Federated identity means one application provides login for several websites (a login portal run by the company), rather than each site running its own form; the sites trust the portal's session cookie