For a discussion about key findings in the study, check out this.
Is this starting to sound difficult? One factor is something the user knows, such as their username and password combination.
Do your users regularly access multiple apps during the course of their day? This attribute is the link that associates the Salesforce user with the third-party identity provider.