Okta Admin Console Displays a "Password reset failed" Error for Federated Users

An error occurs in the Okta Admin Console when attempting to reset the password of a federated user from the target hub organization. Initiating the password reset from the source spoke organization or the external identity provider resolves the issue. Okta generates the following error:

Password reset failed

• Okta Identity Engine (OIE)
• Okta Classic Engine
• User Lifecycle Management
• Federation

This error occurs when the user requiring a password reset is a federated user, and the password reset attempt originates from the target hub organization instead of the source spoke organization.

How is the password reset failed error resolved for federated users?

Verify the user type using the Okta API or the Okta Admin Console, and initiate the password reset from the source organization or external identity provider.

1. Verify the user type by executing the following API call to retrieve the user details.

   /api/v1/users/<id>

2. Review the API response to confirm if the user is federated. The following image displays a Postman response indicating a federated user type.
   
3. Alternatively, navigate to Directory > People in the Okta Admin Console and select the user to view the federated Identity Provider (IdP) in the user details.
4. Initiate the password reset from the source spoke organization if the user is federated with Okta via Org2Org.
5. Execute the following API call as an alternative method to reset the password for an Okta-federated user.

   <url>/api/v1/users/<userId>/lifecycle/reset_password?sendEmail=false

6. Initiate the password reset from the third-party external IdP if the user authenticates through an external IdP instead of Okta.