update SSO user note and certificateIdp

Author: rani2655

modules/ROOT/pages/api-user-management.adoc

@@ -128,7 +128,31 @@ To update user details:
 * xref:user-api.adoc#update-user[PUT /tspublic/v1/user/{userid}] (Rest API v1)
 
 
+[NOTE]
+====
+Updating the username of an SSO user, `account_type` set to `SAML_USER` or `OIDC_USER`, requires changes in both the IdP and ThoughtSpot.
+
+If you rename an SSO user through the REST API and that user then logs in through the IdP:
+
+* If Just-in-Time (JIT) provisioning is enabled, ThoughtSpot creates a new duplicate account. The duplicate account does not inherit the original user's content, groups, or permissions.
+* If JIT provisioning is disabled, the user cannot log in.
+
+To safely update the username of an SSO user:
 
+. Update the username in your IdP.
+. Before the user logs in again, update the username in ThoughtSpot to match the new value using the REST API or Admin UI.
+
+Both updates must be complete before the user's next SSO login.
+The order of the two steps can be reversed — you may update ThoughtSpot first and the IdP second — provided the user does not log in during the interval between the two changes.
+
+For SSO users, ThoughtSpot derives email address and display name directly from the IdP. Update these attributes in your IdP only.
+ThoughtSpot automatically reflects the new values when the user next logs in through SSO.
+Do not use the REST API or the Admin UI to update the email address or display name of an SSO user.
+
+
+For users who authenticate directly with ThoughtSpot (not through an external IdP), you can update username, email address, and display name using the REST API or Admin UI.
+No IdP coordination is required for local users.
+====
 
 ////
 The IAMv2 users also have an additional user state, `SUSPENDED`. With this, the IAMv2 users do not require a password reset when transitioning between states such as `ACTIVE`, `EXPIRED`, or `INACTIVE`. It also supports seamless migration from IAMv1 to IAMv2 for embedded users.

modules/ROOT/pages/configure-saml.adoc

@@ -261,6 +261,26 @@ link:https://docs.thoughtspot.com/cloud/latest/saml-okta#_enable_saml_authentica
 You can map your SAML groups,or groups and Orgs from your IdP to your ThoughtSpot. This means that you do not have to manually recreate your groups and Orgs in ThoughtSpot if they are already present in your IdP.
 Refer to link:https://docs.thoughtspot.com/cloud/latest/saml-group-mapping[Configure SAML group mapping, window=_blank].
 
+[#update-idp-cert-iamv2]
+=== #Update your IdP certificate#
+If your IdP certificate expires or is rotated, you can update it in the ThoughtSpot UI.
+ThoughtSpot IAMv2 supports self-serve certificate management — changes take effect immediately after you save.
+
+To update your IdP certificate:
+
+* Go to *Admin* > *User management* > *Authentication*
+* Navigate to your SAML connection and click the **More** menu image:./images/icon-more-10px.png[the more options menu] > *Edit*
+* In the *IDP provider certificate* field, replace the existing certificate with the new certificate file from your IdP.
++
+[NOTE]
+====
+Download the raw certificate file from your IdP settings page.
+The accepted format is `PEM / .cer / .crt`.
+====
+* Click *Save*.
+
+Your users can sign in using the updated certificate immediately.
+If users experience sign-in failures after a certificate rotation, verify that the certificate in ThoughtSpot matches the certificate currently active on your IdP.
 
 [#idp-config]
 === Configure the IdP server for SAML authentication