A company hosts an intranet app on EC2 instances behind an ALB. Currently, users authenticate against an internal database. The company must use an existing AWS Directory Service for Microsoft Active Directory so that all directory users can access the app. Which solution will meet this requirement?

The correct solution leverages Amazon Cognito to integrate with AWS Directory Service for Microsoft Active Directory and authenticate users via the ALB. Cognito User Pools can be configured with a federated identity provider pointing to Active Directory, allowing users to authenticate with their existing directory credentials. The ALB's authenticate-cognito action then directs authentication requests to the specified Cognito User Pool and app client, ensuring all directory users can access the application. The incorrect options are: Creating a new app client in the directory and using authenticate-oidc directly with Active Directory is not a standard or straightforward way to integrate Active Directory authentication with an ALB. Active Directory primarily uses SAML or Kerberos, not OIDC directly for this type of integration. Adding the directory as a new IAM identity provider and using authenticate-oidc is incorrect because IAM identity providers are for AWS console/API access, not directly for application authentication via ALB. Enabling AWS IAM Identity Center (AWS Single Sign-On) is for managing access to AWS accounts and applications, but the authenticate-cognito action requires a Cognito User Pool, not IAM Identity Center directly.