iwokc (iwokc) asked a question.
I want to prevent certain users from performing password resets.
On the Okta login screen, there is a link provided for users who have forgotten their passwords. I would like to disable password resets for users belonging to a specific group.
If someone attempts to log in with a non-existent user (e.g., example@test.com) and clicks on this link, they will see a message stating that password reset is not allowed. It is acceptable to display this message. However, if possible, it would be better to have the ability to modify this message.
Hi @iwokc (iwokc) , Thank you for reaching out to the Okta Community!
The Okta Password Polices can be configured at group level as per the documentation but the messaging cannot be customized and the link cannot be invalidated as it's available before the user puts in any identifiable information.
If my answers helped, remember to mark it as best to increase its visibility for other members of the Okta Community who might have the same questions as you.
Hope my answer helps!
--------------------------------
Watch and Learn: New Okta how-to videos, plus what's new this month in the May newsletter.
@Mihai N. (Okta, Inc.)
Thank you for answering.
As I wrote in the example, if you link after logging in with example@test.com, you will see a message that password reset is not allowed.
Also, in the case of a link after entering an existing ID, a message is displayed to the effect that a password reset email has been sent.
What I want to do is that I want only users belonging to a specific group to have the same behavior as example@test.com.
Why is a message displayed stating that password reset is not allowed for example@test.com? Is it due to Okta tenant settings or because the corresponding ID is not found?
Is it difficult to achieve the same behavior as example@test.com through Okta tenant settings?
I tried to reproduce the flow on my end and I get the same result regardless of what kind of ID I put in (existing or non-existing user). As I would expect for my environment - I get the generic "Email has been sent to random_email@fakemail.com with instructions on resetting your password."
Please open a case to work with one of our Support Engineers who can review your configuration and provide further assistance and clarification.
@Mihai N. (Okta, Inc.)
After disabling the following items, it became the expected behavior.
Security > Authenticators > Password > [any policy] > [any rule] > password reset