Exam AWS Certified Solutions Architect - Associate SAA-C03 topic 1 question 761 discussion

The solution that best meets the requirements. This approach provides a pathway for authenticating LDAP users to AWS without requiring direct LDAP to AWS IAM Identity Center integration or SAML compatibility, offering a flexible and secure method to extend on-premises authentication mechanisms to AWS services.

AnswerD

D is the answer

Identity federation can be accomplished in one of three ways. (1) Use a corporate IdP (such as Microsoft Active Directory) or a custom identity broker application. Each option uses AWS STS. (2) Create an integration that uses Security Assertion Markup Language (SAML). (3) Use a web identity provider, such as Amazon Cognito.

option D As per described here: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_federated-users.html#id_roles_common-scenarios_federated-users-idbroker option A is wrong becouse for use SSO need to be compatible with SAML (at least this is what i understand from here: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_federated-users.html#id_roles_common-scenarios_federated-users-saml20 )

Option D A custom identity broker application can be built to perform a similar function to an identity store that is not compatible with SAML 2.0. The broker application authenticates users, requests temporary credentials from AWS, and provides them to the user to access AWS resources.

If your identity store is not compatible with SAML 2.0, then you can build a custom identity broker application to perform a similar function. .....option D