Multiple saml cert for same SP

[Rod Widdowson]

> Now, if they push 2nd cert in their SP metadata ( by using SP Key rollover configuration ).... 
> don't I need to do anything at all from IDP side

Refresh your metadata

> ? Because... as IDP... that new / 2nd cert is unknown to me. 

At that stage as an IdP you know about both keys.  So you can handle _either_

> I know I can update/refresh their metadata "manually" tomorrow to grab new cert but that might take 10 mins; 
> what end user is trying to achieve a zero downtime. 

All done by the magic of shib (and locks and multithreading and Javas  object reference counting).  There is no downtime.  The IdP reloads the metadata and any requests which happen when that’s happening will be handled by the old metadata.  Then when everything is ready it will atomically swap in the new metadata and from then on all new requests will use the new metadata.

.... And in case you were going to ask you do not need to halt the IdP to load new metadata, you have probably configured it to reload automatically, and even if you hadn't there is a handy command line tool to make it reload.

Rod