What is the purpose of the SAML2 account mapper on the service provider (SP) side?

In a SAML 2.0 federation, a Service Provider (SP) must establish a local session for a user who has authenticated at a remote Identity Provider (IdP). The account mapper on the SP is responsible for this linkage. It uses information from the incoming SAML assertion (the "remote user" identity), such as the NameID or other attributes, to find or create a corresponding user account in the SP's local data store (the "local user profile"). This mapping is a crucial step before a local session can be created.

A: This is incorrect. The account mapper processes a single assertion at a time to map one remote identity to one local account.

B: This describes account linking, a different feature for consolidating multiple local accounts. The SAML mapper's purpose is to link a remote identity to a local one.

C: This describes the process in reverse. The mapper uses attributes from the remote user's assertion to find and map to a local user profile.

1. Ping Identity Access Management Documentation, "Federation and single sign-on > Configuring SAML v2.0 > How AM processes assertions at a service provider." The documentation states, "AM uses the contents of the NameID or other attributes in the assertion to map the remote identity to a user in its local data store."