Documentation / QueryTek Tapestry glossary / Identity Broker
An identity broker sits between applications and the identity providers that authenticate users, translating each provider's assertions into one consistent representation. Applications trust the broker rather than every upstream directory, so adding a new customer's identity provider does not mean changing the applications themselves.
Enterprise software rarely faces one identity provider. Different customers arrive with different directories and protocols, and some organizations run several at once after an acquisition. Wiring each application directly to each provider produces a mesh where every new customer is an integration project and every protocol quirk is handled in several places.
A broker collapses that mesh into two relationships: applications trust the broker, and the broker maintains connections upstream. Three things follow from that position.
Protocol translation. The broker terminates whichever protocol the upstream provider speaks and presents a single normalized result downstream. Applications stop carrying provider-specific code.
Claim normalization. Providers describe the same facts differently — group membership, organizational unit, employee identifier. The broker maps those into consistent claims so downstream authorization logic can be written once.
One trust boundary. Because authentication arrives through a single mediated path, the question "which directory vouched for this user, and for which organization" has one answer rather than one per integration.
The common mistake is treating a broker as the source of truth for authorization. It is not. A broker establishes who is acting and under whose authority; what that person may do is an authorization decision made against current entitlements. Brokers that quietly become permission stores go stale, because the upstream directory keeps changing after the assertion was issued.
Identity brokering is usually the first thing that determines whether an enterprise rollout takes days or a quarter. If each customer's directory requires application changes, onboarding cost scales with the customer count.
It also decides how much of an incident you can reconstruct. When authentication is mediated in one place, questions about who accessed what and on whose behalf have a single trustworthy account instead of several partial ones.
QueryTek Tapestry brokers identity so partner systems and product surfaces share one model of who is acting and which organization they act for, which is what makes a cross-system handoff attributable. Tenant boundaries remain the platform's concern rather than the broker's. Specific upstream provider configuration, claim mapping rules, and per-customer connection detail are handled during onboarding and are not published.
