Our organization is using the SF single sign on feature and the IDP certificate is expiring soon.
SAML SSO with ADFS are used. We need to minimize the user SSO service interruption and our questions include:
1) What is the best SF practice in order to minimize user SSO interruption when the current IDP (ADFS) certificate expires? Beyond this already checked the doc : https://help.salesforce.com/apex/HTViewHelpDoc?id=sso_tips.htm&language=en
2) It is known ADFS generates a secondary certificate 20 days prior to the expiry date. This new IDP certificate will automatically promote and became the primary certificate 15 days prior to the expiry date. We believe all SF user SSO will fail at this point unless the IDP certificate is manually updated in the SF SSO setup. Please what is the advise to minimize this SF SSO interruption when the IDP certificate expires?
3). Is the IDP certificate be automatically updated in SF SSO?
4). Does SF SSO support a secondary IDP certificate and if so what is the procedure?
5). Please is it appropriate to setup a second SAML SSO settings with identical setting but with different certificates? Meaning, the 1st SSO config has the current IDP certificate to be expired and the 2nd SSO config has the new IDP certificate which is to be effective (to be auto promoted as the primary)?