Change Authentication from IWA to other methods

[RezaTehranifar2]

We have Enterprise 10.9 (Server, Portal, Data Store) on a single machine with IWA authentication. Although the SSO authentication works great, I have come across some bugs with general enterprise usage that are specific to IWA (according to ESRI tech support).

How big of an effort is to change our authentication method? We still want the same SSO experience using our org's AD. 
Would changing impact the user who created an existing content on our portal? e.g if john doe with IWA lose access to their content if we were to change?

[ReeseFacendini]

Correct, you'd use the Python API, and transfer content, group ownership / membership to the new user ID

[RezaTehranifar2]

Thanks for your help!

[EdgarWIparraguirre]

Unfortunately the solution does not apply to all cases, essentially when  - say for historical reasons - SAML's NameID claim cannot be customized to present a value wich is identical to the IdP accountname as known to the Portal. For example, when using a customized NameID claim, Portal may add an underscore ("_") to the claim value and so rendering a worthless Portal's username.