feat: add OIDC federation support (Entra ID / external IdP)

source/infrastructure/lambda/aws-exports-handler/index.ts

@@ -18,6 +18,8 @@ interface CloudFormationEvent {
     UserFilesBucketRegion: string;
     IoTEndpoint: string;
     IoTPolicy: string;
+    OAuthDomain?: string;
+    OAuthRedirectUrl?: string;
   };
   PhysicalResourceId?: string;
 }
@@ -44,11 +46,13 @@ export const handler = async (event: CloudFormationEvent): Promise<CloudFormatio
     UserFilesBucketRegion,
     IoTEndpoint,
     IoTPolicy,
+    OAuthDomain,
+    OAuthRedirectUrl,
   } = ResourceProperties;
 
   try {
     if (RequestType === "Create" || RequestType === "Update") {
-      const awsExports = {
+      const awsExports: Record<string, string> = {
         UserPoolId,
         PoolClientId,
         IdentityPoolId,
@@ -59,6 +63,9 @@ export const handler = async (event: CloudFormationEvent): Promise<CloudFormatio
         IoTPolicy,
       };
 
+      if (OAuthDomain) awsExports.OAuthDomain = OAuthDomain;
+      if (OAuthRedirectUrl) awsExports.OAuthRedirectUrl = OAuthRedirectUrl;
+
       await s3Client.send(
         new PutObjectCommand({
           Bucket: BucketName,

source/webui/src/components/navigation/TopNavigationBar.tsx

@@ -3,9 +3,23 @@
 
 import { TopNavigation, TopNavigationProps } from "@cloudscape-design/components";
 import { useAuthenticator } from "@aws-amplify/ui-react";
+import { fetchAuthSession } from "aws-amplify/auth";
+import { useState, useEffect } from "react";
 
 export default function TopNavigationBar() {
   const { user, signOut } = useAuthenticator();
+  const [displayName, setDisplayName] = useState<string | null>(null);
+
+  useEffect(() => {
+    fetchAuthSession()
+      .then((session) => {
+        const payload = session.tokens?.idToken?.payload;
+        if (payload) {
+          setDisplayName((payload.name as string) || (payload.email as string) || null);
+        }
+      })
+      .catch(() => {});
+  }, [user]);
 
   const solutionIdentity: TopNavigationProps.Identity = {
     href: "/",
@@ -20,7 +34,7 @@ export default function TopNavigationBar() {
   const utilities: TopNavigationProps.Utility[] = [
     {
       type: "menu-dropdown",
-      text: user.username ?? "User",
+      text: displayName ?? user.username ?? "User",
       iconName: "user-profile",
       items: [
         {

source/webui/src/contexts/UserContext.tsx

@@ -58,15 +58,20 @@ export const UserContextProvider = (props: { children: ReactNode }) => {
         ...responseUser,
       });
       try {
-        const userAttributesOutput = await fetchUserAttributes();
-        setEmail(userAttributesOutput.email ?? null);
-
-        // Attach IoT policy when user is authenticated
+        // Attach IoT policy first — fetchUserAttributes may fail for federated users
+        // and must not block IoT setup needed for real-time metrics
         const response = await fetch("/aws-exports.json");
         const config = await response.json();
         if (config.IoTPolicy) {
           await attachIoTPolicy(config.IoTPolicy);
         }
+
+        try {
+          const userAttributesOutput = await fetchUserAttributes();
+          setEmail(userAttributesOutput.email ?? null);
+        } catch (attrError) {
+          console.log("fetchUserAttributes failed (expected for federated users):", attrError);
+        }
       } catch (e) {
         console.log(e);
       }

source/webui/src/main.tsx

@@ -41,6 +41,17 @@ getRuntimeConfig().then((json) => {
         userPoolId: json.UserPoolId,
         userPoolClientId: json.PoolClientId,
         identityPoolId: json.IdentityPoolId,
+        ...(json.OAuthDomain && {
+          loginWith: {
+            oauth: {
+              domain: json.OAuthDomain,
+              scopes: ["email", "openid", "profile"],
+              redirectSignIn: [json.OAuthRedirectUrl],
+              redirectSignOut: [json.OAuthRedirectUrl],
+              responseType: "code",
+            },
+          },
+        }),
       },
     },
     API: {