SSO: rotate SAML IdP signing certificate without deleting the provider

Is this suited for github?

• Yes, this is suited for github

Is your feature request related to a problem? Please describe.

IdPs rotate their SAML signing certificates regularly. Entra ID certificates expire after three years, and Okta and Google rotate too. With @better-auth/sso 1.7.x there is no stock way to put the new certificate on a provider once users have signed in through it:

• updateSSOProvider returns 409 Cannot change SSO provider identity fields while linked accounts exist as soon as the signing certificate changes, because samlIdentityBoundaryChanged treats the trust anchors as part of the identity boundary.

• deleteSSOProvider followed by registerSSOProvider does work, but:

  • it deletes every linked account row;
  • re-registration always writes domainVerified: false and issues a new DNS verification token;
  • with domainVerification.enabled, SAML sign-in is rejected until the customer publishes a new TXT record.

  So a routine certificate rotation becomes an SSO outage plus a DNS change for the customer.

The only remaining option is to update samlConfig directly in the database, which bypasses the guard entirely.

providers.ts already has a TODO(next): move SSO account links to immutable provider instance ids, then expose explicit relinking for identity-boundary changes.

Describe the solution you'd like

A supported way for an org admin to rotate the IdP signing certificate without deleting the provider, losing domain verification or dropping account links. For example:

• Certificate changes outside the identity boundary. Treat a change of signing certificate alone (same IdP entity ID, SSO URLs and SP settings) as a trust-anchor rotation rather than an identity-boundary change. Or allow it when the new configuration keeps at least one current certificate, so rotation is add-then-remove, like WorkOS's multiple IdP signing certificates.
• An explicit rotation path. Alternatively, an explicit rotation endpoint or option on updateSSOProvider, for example allowTrustAnchorRotation, which could be gated through guardProviderMutation.

Describe alternatives you've considered

• Delete and re-register: loses account links and domain verification, as described above.
• Direct database update of ssoProvider.samlConfig: works, but skips the guard and all validation.

Additional context

Version: better-auth / @better-auth/sso 1.7.6, SAML providers scoped to organizations, with domainVerification.enabled: true.