Enterprise Identity Provider

Okta Integration With QueryTek Tapestry

In Short

Enterprise Okta connects to Tapestry through an upstream identity broker — not directly to every partner app. Customer IT registers an Okta application toward Tapestry’s federation boundary; Tapestry normalizes identity into canonical claims and routes users to certified partners with strict tenant isolation.

How Tapestry Fits

Tapestry uses a hybrid broker posture: inbound SAML or OIDC from Okta terminates at the managed upstream federation provider (Keycloak). Tapestry receives an OIDC authorization-code callback, establishes a Tapestry session, and hands users to partner applications through outbound adapters (OIDC or SAML as registered).

Protocol translation is composition — upstream inbound conversion, Tapestry session, outbound adapter — not a single in-process SAML↔OIDC codec inside Tapestry.

Customer IT Checklist

  • Register an Okta application for Tapestry federation (SAML or OIDC per your tenant contract)
  • Exchange metadata and attribute mappings with your Tapestry operator contact
  • Keep MFA and conditional access policies in Okta — Tapestry does not replace Okta policy enforcement
  • Unsupported or misconfigured federation paths fail closed at the Tapestry boundary

Partner Developers

Partner integrators authenticate sandbox and production API calls separately from enterprise IdP onboarding. See authentication patterns and SPEC-001 error handling on the developer portal.

Learn More