update SSO user note

Author: rani2655

modules/ROOT/pages/api-user-management.adoc

@@ -127,7 +127,31 @@ To update user details:
 * +++<a href="{{navprefix}}/restV2-playground?apiResourceId=http%2Fapi-endpoints%2Fusers%2Fupdate-user">POST /api/rest/2.0/users/{user_identifier}/update</a>+++ (Rest API v2)
 * xref:user-api.adoc#update-user[PUT /tspublic/v1/user/{userid}] (Rest API v1)
 
+[NOTE]
+====
+Updating the username of an SSO user, `account_type` set to `SAML_USER` or `OIDC_USER`, requires changes in both the IdP and ThoughtSpot.
+
+If you rename an SSO user through the REST API and that user then logs in through the IdP:
+
+* If Just-in-Time (JIT) provisioning is enabled, ThoughtSpot creates a new duplicate account. The duplicate account does not inherit the original user's content, groups, or permissions.
+* If JIT provisioning is disabled, the user cannot log in.
+
+To safely update the username of an SSO user:
 
+. Update the username in your IdP.
+. Before the user logs in again, update the username in ThoughtSpot to match the new value using the REST API or Admin UI.
+
+Both updates must be complete before the user's next SSO login.
+The order of the two steps can be reversed — you may update ThoughtSpot first and the IdP second — provided the user does not log in during the interval between the two changes.
+
+For SSO users, ThoughtSpot derives email address and display name directly from the IdP. Update these attributes in your IdP only.
+ThoughtSpot automatically reflects the new values when the user next logs in through SSO.
+Do not use the REST API or the Admin UI to update the email address or display name of an SSO user.
+
+
+For users who authenticate directly with ThoughtSpot (not through an external IdP), you can update username, email address, and display name using the REST API or Admin UI.
+No IdP coordination is required for local users.
+====
 
 
 ////

modules/ROOT/pages/configure-saml.adoc

@@ -119,7 +119,7 @@ Make a note of all of the redirects within the SAML workflow. Each server must b
 To configure SAML SSO authentication on the ThoughtSpot embedded instance, complete the following steps:
 
 * xref:configure-saml.adoc#admin-portal[Enable SAML authentication on ThoughtSpot with IAMv1]
-* xref:configure-saml.adoc#IAMv2[Enable SAML authentication on ThoughtSpot with IAMv2] (Requires assistance from ThoughtSpot Support)
+* xref:configure-saml.adoc#IAMv2[Enable SAML authentication on ThoughtSpot with IAMv2]
 * xref:configure-saml.adoc#idp-config[Configure the IdP server for SAML authentication]
 * xref:configure-saml.adoc#auth-config-sdk[Enable SSO authentication in Visual Embed SDK]
 * xref:configure-saml.adoc#saml-redirect[Add SAML redirect domain to the allowed list in ThoughtSpot]
@@ -261,6 +261,26 @@ link:https://docs.thoughtspot.com/cloud/latest/saml-okta#_enable_saml_authentica
 You can map your SAML groups,or groups and Orgs from your IdP to your ThoughtSpot. This means that you do not have to manually recreate your groups and Orgs in ThoughtSpot if they are already present in your IdP.
 Refer to link:https://docs.thoughtspot.com/cloud/latest/saml-group-mapping[Configure SAML group mapping, window=_blank].
 
+[#update-idp-cert-iamv2]
+=== Update your IdP certificate
+If your IdP certificate expires or is rotated, you can update it in the ThoughtSpot UI.
+ThoughtSpot IAMv2 supports self-serve certificate management — changes take effect immediately after you save.
+
+To update your IdP certificate:
+
+* Go to *Admin* > *User management* > *Authentication*
+* Navigate to your SAML connection and click the **More** menu image:./images/icon-more-10px.png[the more options menu] > *Edit*
+* In the *IDP provider certificate* field, replace the existing certificate with the new certificate file from your IdP.
++
+[NOTE]
+====
+Download the raw certificate file from your IdP settings page.
+The accepted format is `PEM / .cer / .crt`.
+====
+* Click *Save*.
+
+Your users can sign in using the updated certificate immediately.
+If users experience sign-in failures after a certificate rotation, verify that the certificate in ThoughtSpot matches the certificate currently active on your IdP.
 
 [#idp-config]
 === Configure the IdP server for SAML authentication