Hi,
I’m investigating how to preserve individual user identity when a Foundry Custom Widget triggers operations in an external system.
Users authenticate to Foundry through enterprise SSO. The external system has its own OIDC-compatible identity and permission model, and every write must be attributed to the actual user rather than a shared service account.
What is the recommended supported pattern for this?
- Is there an on-behalf-of or token-exchange flow between Foundry and an external identity provider?
- Can an Action or webhook receive a cryptographically verifiable identity for the Foundry user who invoked it?
- Can a Custom Widget access any user-delegated token intended for an external audience, or is its runtime token strictly for Foundry APIs?
I want to avoid passing an unverified user identifier in the request body or treating a service credential as an individual user.