Custom Identity Broker for Non-SAML LDAP to AWS Console

SAA-C03 By islever Editorial Last updated

Design secure access to AWS resources.

Short answer

D Develop an on-premises custom identity broker application that authenticates LDAP users and requests short-lived credentials from AWS STS.

Question

A company needs to use its on-premises LDAP directory service to authenticate its users to the AWS Management Console. The directory service is not compatible with Security Assertion Markup Language (SAML). Which solution meets these requirements?
  1. Enable AWS IAM Identity Center (AWS Single Sign-On) between AWS and the on-premises LDAP.
  2. Create an IAM policy that uses AWS credentials, and integrate the policy into LDAP.
  3. Set up a process that rotates the IAM credentials whenever LDAP credentials are updated.
  4. Develop an on-premises custom identity broker application or process that uses AWS Security Token Service (AWS STS) to get short-lived credentials. Correct Answer

Key Takeaways

The question tests identity federation strategies, specifically highlighting that non-SAML directories require a custom broker using AWS STS rather than direct integration or IAM Identity Center.

This page explains how to authenticate on-premises LDAP users to the AWS Management Console when the directory is not SAML-compatible, identifying the custom identity broker pattern as the correct solution.

Common mistake: Learners often incorrectly select IAM Identity Center (Option A) because it handles single sign-on, failing to recognize its strict requirement for SAML 2.0 compatibility with the upstream identity provider.

Expert Analysis

Why the Answer Is Correct

The scenario requires authenticating LDAP users to AWS when the directory does not support SAML. According to AWS best practices, when an identity store is not compatible with SAML 2.0, you must build a custom identity broker application. This broker authenticates users against the LDAP service and then uses AWS Security Token Service (AWS STS) to request temporary security credentials (via AssumeRoleWithWebIdentity or similar mechanisms) to grant access to AWS resources. This allows seamless console access without exposing long-term credentials.

Why the Other Options Are Wrong

Option A is incorrect because AWS IAM Identity Center (formerly AWS Single Sign-On) integrates with identity providers via SAML 2.0. Since the prompt explicitly states the LDAP service is not SAML-compatible, this integration cannot be established directly. Option B is technically invalid; IAM policies define permissions but cannot be "integrated" into an LDAP directory structure. Option C describes a manual credential rotation process, which is insecure, operationally complex, and violates the principle of least privilege by requiring long-term static credentials instead of short-lived tokens.

Community Comment Notes

The community consensus strongly supports Option D. As noted by user NSA_Poker, identity federation generally falls into three categories: corporate IdPs (SAML), web identity providers, and custom brokers using STS. User TwinSpark highlighted that IAM Identity Center requires SAML compatibility, confirming why Option A fails. User LeonSauveterre reinforced that integrating IAM policies into LDAP is not a valid architectural pattern, leaving the custom broker as the only viable technical solution.

Official Reference

https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_federated-users.html#id_roles_common-scenarios_federated-users-idbroker

This link opens the official vendor documentation in a new tab.

Exam Strategy

When asked about federating non-SAML identities to AWS, always look for "Custom Identity Broker" combined with "AWS STS." Avoid options suggesting direct integration with IAM Identity Center unless SAML compatibility is confirmed.

Frequently Asked Questions

Why can't I use IAM Identity Center with my LDAP?

IAM Identity Center requires the upstream identity provider to support SAML 2.0. If your LDAP is not SAML-compatible, it cannot establish the trust relationship needed for SSO.

What is the role of AWS STS in this solution?

AWS STS issues temporary security credentials. The custom broker uses these to allow LDAP users to assume IAM roles, providing secure, short-lived access to AWS resources.

More SAA-C03 FAQ →

Community Votes

D
100%

100% of anonymous learners picked answer D. Votes are pick records left by other test-takers — they are not the verified answer.

Discussion 8 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded, and comments reflect the views of individual contributors.

From public community threads 8

  1. kempes 👍 10 Answered D
    The solution that best meets the requirements. This approach provides a pathway for authenticating LDAP users to AWS without requiring direct LDAP to AWS IAM Identity Center integration or SAML compatibility, offering a flexible and secure method to extend on-premises authentication mechanisms to AWS services.
  2. TwinSpark 👍 2 Answered D
    option D As per described here: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_federated-users.html#id_roles_common-scenarios_federated-users-idbroker option A is wrong becouse for use SSO need to be compatible with SAML (at least this is what i understand from here: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_common-scenarios_federated-users.html#id_roles_common-scenarios_federated-users-saml20 )
  3. NSA_Poker 👍 2 Answered D
    Identity federation can be accomplished in one of three ways. (1) Use a corporate IdP (such as Microsoft Active Directory) or a custom identity broker application. Each option uses AWS STS. (2) Create an integration that uses Security Assertion Markup Language (SAML). (3) Use a web identity provider, such as Amazon Cognito.
  4. Naveena_Devanga 👍 2
    Option D A custom identity broker application can be built to perform a similar function to an identity store that is not compatible with SAML 2.0. The broker application authenticates users, requests temporary credentials from AWS, and provides them to the user to access AWS resources.
  5. jaswantn 👍 2
    If your identity store is not compatible with SAML 2.0, then you can build a custom identity broker application to perform a similar function. .....option D
Show 3 more comments
  1. LeonSauveterre 👍 1 Answered D
    A - AWS IAM Identity Center (formerly AWS SSO) allows integration with SAML-compatible identity providers, which won't work with on-premises LDAP directory (not SAML-compatible). B - There's no way to "integrate" an IAM policy into LDAP. C - Too complex. AWS already provides better mechanisms for handling temporary credentials - AWS STS. D - YES. Actually, this approach is commonly used when SAML is not an option.
  2. ike001 👍 2
    D is the answer
  3. Scheldon 👍 2 Answered D
    AnswerD

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

S3 Multi-Region Access Point and Replication Strategy

S-grade

Securing NLB with Security Groups for Minimal Change

S-grade

Most Cost-Effective 7-Year Retention for EBS Snapshots?

S-grade

AWS Forecast vs SageMaker for Time-Series Prediction

S-grade

Practice All SAA-C03 Questions

Access 120 questions with complete answers and detailed explanations.

View Full SAA-C03 Practice Test →

← Back to SAA-C03 Study Guide