Which two optimal ways can the IT team provision users and allow Single Sign-on between Salesforce and Google Apps?

Universal Containers (UC) is both a Salesforce and Google Apps customer. The UC IT team would like to manage the users for both systems in a single place to reduce administrative burden .

Which two optimal ways can the IT team provision users and allow Single Sign-on between Salesforce and Google Apps? Choose 2 answers
A . Build a custom app running on Heroku as the Identity Provider that can sync user information between Salesforce and Google Apps.
B . Use a third-party product as the Identity Provider for both Salesforce and Google Apps and manage the provisioning from there.
C . Use Identity Connect as the Identity Provider for both Salesforce and Google Apps and manage the provisioning from there.
D . Use Salesforce as the Identity Provider and Google Apps as a Service Provider and configure User Provisioning for Connected Apps.

Answer: B,D