> ## Documentation Index
> Fetch the complete documentation index at: https://docs.ravenna.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Monitoring & Maintenance

> Monitor SSO authentication activity and maintain your SSO configuration over time with proper certificate management and security practices.

## Authentication monitoring

Monitor SSO authentication through your identity provider's built-in logging and monitoring tools.

## SSO health monitoring

Regularly check the status of your SSO configuration:

<Steps>
  <Step title="Check Connection Status">
    Navigate to **Settings** > **Single Sign-On** to view the current status of your SSO connection.
  </Step>

  <Step title="Monitor IdP Activity">
    Use your identity provider's monitoring tools to track authentication patterns and identify any issues.
  </Step>

  <Step title="Test Periodically">
    Run periodic connection tests to ensure your SSO configuration remains functional.
  </Step>
</Steps>

## Updating SSO configuration

### Certificate renewal

<Info>
  **Note**: Certificate renewal is only required for Custom SAML, Keycloak, and PingFederate configurations. Other identity providers handle certificate management automatically.
</Info>

For applicable providers, certificates typically expire annually. To update certificates:

<Steps>
  <Step title="Get New Certificate">
    Download the new X.509 certificate from your identity provider before the current one expires.
  </Step>

  <Step title="Update Ravenna">
    In your SSO settings, replace the old certificate with the new one.
  </Step>

  <Step title="Test Configuration">
    Run a connection test to verify the new certificate is working correctly.
  </Step>
</Steps>

### Modifying domain configuration

To add or remove domains from SSO authentication, you'll need to contact support:

1. **[Contact support](mailto:support@ravenna.ai)** with your domain modification request
2. **Provide details** about which domains you want to add or remove
3. **Verify domain ownership** if adding new domains (support will guide you through this process)
4. **Notify affected users** about authentication method changes once the update is complete

## Security best practices

### Regular security reviews

<CardGroup cols={2}>
  <Card title="Certificate Management" icon="certificate">
    Monitor certificate expiration dates and plan renewals in advance
  </Card>

  <Card title="Access Reviews" icon="user-check">
    Regularly review SSO user access and remove inactive accounts
  </Card>

  <Card title="Configuration Audits" icon="search">
    Periodically audit SSO settings and update as needed
  </Card>

  <Card title="Activity Monitoring" icon="chart-line">
    Use your IdP's monitoring tools to track authentication patterns
  </Card>
</CardGroup>

### Certificate management best practices

* **Set renewal reminders**: Create calendar reminders 30-60 days before certificate expiration
* **Test certificate updates**: Always test in a non-production environment first
* **Maintain certificate inventory**: Keep track of which certificates are used for which configurations
* **Backup certificates**: Store certificate backups securely

### Access control monitoring

* **Regular user audits**: Review user access quarterly or when organizational changes occur
* **Monitor failed authentications**: Track patterns in authentication failures
* **Verify attribute mappings**: Ensure user information is correctly synchronized
* **Check group memberships**: Validate that group-based access is working correctly